Request: Build liblua54.so with Clang SafeStack instrumentation for SDL compliance

[mhrachana]

Problem

The pre-built liblua54.so in the KeraLua NuGet package was compiled without Clang's SafeStack instrumentation (-fsanitize=safe-stack). This causes BinSkim SDL validation failures for organizations that require SafeStack for native binaries.

BinSkim error:
error BA2025 : 'liblua54.so' was compiled using Clang but without the SafeStack instrumentation pass.

Root Cause

Looking at the KeraLua build configuration, the Linux build uses:

• GCC (not Clang) on Ubuntu 18.04
• No SafeStack flags

SafeStack is a Clang-only feature that provides stack buffer overflow protection. It requires:

• Compiler: Clang (GCC doesn't support SafeStack)
• Flags: -fsanitize=safe-stack on both compile and link

Request

Could you consider one of these options for future releases?

1. Switch to Clang for Linux builds and add -fsanitize=safe-stack flag
2. Provide a variant NuGet package with SafeStack-enabled binaries (e.g., KeraLua.SafeStack)
3. Document how to build SafeStack-compliant binaries so consumers can self-compile