AtlatestRenderedmarkdown

core-channel / treeREADME.md

Read the source

Readme

core-channel

core-channel is the ordinary Sigil library repository behind the authenticated core/ environment-package scope. Reviewed package definitions live under src/ and are imported like any other Sigil modules. The signed snapshot and catalogue authenticate that source tree and its exported canonical package objects. Generated toolchains, source archives, build output, and the seed tarball are deliberately not committed.

Clone, bootstrap, enter

On x86_64 Linux, a checkout becomes a working --channel directory with:

./bootstrap
export SIGIL_REGISTRY_METADATA=/path/to/root-signed/registry.json
SIGIL_CHANNEL="$PWD" sigil env lock -f demo/env.sgl --lock-file env.lock
sigil env shell -f env.lock -- hello

sigil env shell consumes an env.lock, never environment source, so the lock step is separate and comes first. Only the lock step needs the channel and the registry metadata; consumption deliberately needs neither. Requires sigil 0.18.0 or newer, which is the first release with env.

bootstrap downloads the seed and Zig archives from their manifest URLs, verifies their SHA-256 hashes before installation, and refuses altered or unexpected content. It requires sh, sha256sum, tar, and either curl or wget on the host.

Authenticated package values are published under the core/ scope by the catalogue. For example, (core packages wasm) defines Binaryen 112 and the catalogue exports it as core/binaryen. sigil project lock evaluates only the snapshot-pinned src/ closure, verifies the exported package identity, realizes missing outputs, and seals those results into referenced locks.

The older recipes/ directory remains for the original external-build channel prototype. New authenticated package definitions use normal modules under src/; do not duplicate them in recipes/.

Repository layout

  • package.sgl: ordinary Sigil library metadata.
  • src/: reviewed authenticated package-definition modules.
  • objects/: canonical package values named by their SHA-256 identity.
  • snapshot.sgl: signed source/toolchain snapshot.
  • channel.catalogue.sgl: signed exported binding-to-package map.
  • channel.sgl: executable curator declaration for public package bindings.
  • recipes/: legacy external-build prototype recipes.
  • seed/MANIFEST: pinned downloadable seed artifact.
  • seed/MANIFEST.sources and seed/scripts/: pinned seed sources and the reproducible seed build.
  • toolchain/MANIFEST: pinned Zig distribution.

After editing channel source or bindings, run sigil channel publish with the channels-role signing context. make check deterministically re-derives the sealed objects and roots and refuses stale committed artifacts; CI should run the same target. The metadata under test/ and the currently committed root signatures use public, unlocked test keys and are not deployable production artifacts.

  • bootstrap: verified materialization of ignored binary inputs.
  • scripts/gate-*: permanent reproducibility, isolation, tamper, and concurrency checks.

Release seed-v1 must carry seed-x86_64-linux.tar.gz with the exact hash in seed/MANIFEST. The release asset is produced with seed/scripts/build-seed.sh; it is never added to Git.

Gates

scripts/gate-hash-verify.sh
scripts/gate-crosscheckout.sh
scripts/gate-crosspath.sh
SIGIL_BIN="$(command -v sigil)" scripts/gate-concurrency.sh

The fresh-clone gate accepts SIGIL_BOOTSTRAP_SEED_URL and SIGIL_BOOTSTRAP_ZIG_URL solely to test unpublished release assets or local mirrors. Overrides change locations, never expected hashes.