Port zlib, ncurses, and vim to authenticated src/ packages

Message

zlib and ncurses translate directly: source pin, configure/make/install phases, and core-buildenv as a named binding rather than a raw hash. vim is the first package here with a dependency, so it establishes how one package refers to another.

Dependencies cannot name a sibling package. (sigil env package) requires each entry of dependencies: to be a bare sha256, and (sigil build external) resolves it with store-lookup-output, so a dependency is the content hash of an already-realized output tree. (core outputs) gives those hashes names so that package modules carry no raw hash beyond their upstream source pin, and its header records precisely why that is weaker than it looks: the same package built into three different store roots produced three different output hashes, because the store prefix is baked into installed files while the compiled artifacts stay byte-identical.

The legacy recipes/ definitions are untouched, per the README rule.

Channel roots are re-signed with the public, unlocked channels TEST key already used by the committed artifacts on master. Nothing production is signed here.

Built and executed all three: zlib round-trips through a C program, ncurses' tput reports 256 colors against its own 1861-entry terminfo database, and vim performs a scripted substitute-and-delete edit while linking the ported ncurses.

Changed

 .gitignore                                                                   |  2 ++
 channel.catalogue.sgl                                                        |  5 ++++-
 channel.catalogue.sgl.minisig                                                |  6 +++---
 channel.sgl                                                                  | 10 ++++++++--
 objects/4b55a7c1959668ea8fd26c702350a1640deb4d360bc6877f14985da587552ca7.sgl |  1 +
 objects/e803a7f68e4a55eac49be30b3dc84855749037be91aa48ec7315f73dd5c0d1b3.sgl |  1 +
 objects/ef59035716fe957378c12680f11c954a9eb93202214cfb2efd86fb0f94c7abc3.sgl |  1 +
 snapshot.sgl                                                                 |  4 ++--
 snapshot.sgl.minisig                                                         |  6 +++---
 src/core/outputs.sgl                                                         | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 src/core/packages/compression.sgl                                            | 24 ++++++++++++++++++++++++
 src/core/packages/editors.sgl                                                | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 src/core/packages/terminal.sgl                                               | 45 +++++++++++++++++++++++++++++++++++++++++++++
 13 files changed, 193 insertions(+), 11 deletions(-)

Diff

.gitignoremodified

@@ -5,3 +5,5 @@ seed/sources/

toolchain/bin/

toolchain/zig-x86_64-linux-0.16.0/

toolchain/zig-x86_64-linux-0.16.0.tar.xz

.sigil/

sigil.lock

channel.catalogue.sglmodified

@@ -1,2 +1,5 @@

−1

(catalogue schema: 1 sequence: 1 snapshot: "core-stable@1:sha256:3e680fef604a91b5cda3a7f3cbf755eb18ea9a3a8474b23bdb560ee866aa7b2f" channel-source: "sha256:9a3cd0aa68d3ed4c6c09b8c2b23c2b4a407506596742b57d6552f91aad67b286" content-hash: "sha256:17efc12bb7f838aa4ee4b52844687fcfd63f0d80a7ab3d58cbdec09774783b5e")

(catalogue schema: 1 sequence: 3 snapshot: "core-stable@3:sha256:92696415c49351450ff4601de0174e9222d91214049da93ef79343510d7d703d" channel-source: "sha256:59da1bbefc5232c2120d6221ad0d68ceaba412ee6c0a811189f2c13aea715276" content-hash: "sha256:4f3f6b668ad29865842c3c34557dd40eac9c82e9ecb874bbee7dee6596d1eda3")

(binding name: "core/binaryen" package: "sha256:014baf016eec17892f30a30847b070ffb09e397182d2ef50eda2ceb3fded2a58")

(binding name: "core/ncurses" package: "sha256:e803a7f68e4a55eac49be30b3dc84855749037be91aa48ec7315f73dd5c0d1b3")

(binding name: "core/vim" package: "sha256:ef59035716fe957378c12680f11c954a9eb93202214cfb2efd86fb0f94c7abc3")

(binding name: "core/zlib" package: "sha256:4b55a7c1959668ea8fd26c702350a1640deb4d360bc6877f14985da587552ca7")

channel.catalogue.sgl.minisigmodified

@@ -1,4 +1,4 @@

untrusted comment: signature from minisign secret key

−2

RUQ0HOFEHrNeRNiTeCpvjEtPJex6zo7rtG1Fm3j/1t7QfXedhCevtI2KMZlSW+UMXWo4+Oyl8FUCGeSWBuIJWLh65QBPfHXOlQM=

−3

trusted comment: registry=pkg.usesigil.org path=/v1/channels/core-stable/channel.catalogue.sgl seq=502 ts=2026-07-28T13:00:01Z

−4

6HwfAW1UtiZNcaSxnJfFDu18iPazlPH1tgRnEW6llhnbR1fFe6gr7lfAJm69VFZEkqjTVY1pBQHSb0bSV+XWCA==

RUQ0HOFEHrNeRK+KIRrAOzVy4tWZ3NTdzxE930nKR98cPCkTmI/R3clWQXh4d1Q6GTJzlLiKdtzqWKo6AbjYKxL4/bXLVcm0jQs=

trusted comment: registry=pkg.usesigil.org path=/v1/channels/core-stable/channel.catalogue.sgl seq=506 ts=2026-07-30T18:50:00Z

8brhT9ENX6zPYbh31yWj+6LFWSc6hU+vn6vJ2qkbfE5oiCzLrCBa2L4ou0RRb1z+DJ+3BF4ICHBQqrfB9KGsAw==

channel.sglmodified

@@ -1,6 +1,12 @@

−1

(import (core packages wasm))

(import (core packages wasm)

(core packages compression)

(core packages terminal)

(core packages editors))

(channel

stream: "core-stable"

bindings: (list

−6

(channel-binding name: "core/binaryen" value: binaryen)))

(channel-binding name: "core/binaryen" value: binaryen)

+10

(channel-binding name: "core/zlib" value: zlib)

+11

(channel-binding name: "core/ncurses" value: ncurses)

+12

(channel-binding name: "core/vim" value: vim)))

objects/4b55a7c1959668ea8fd26c702350a1640deb4d360bc6877f14985da587552ca7.sgladded

@@ -0,0 +1 @@

(package-v1 name: "zlib" version: "1.3.1" source: (source location: "https://zlib.net/fossils/zlib-1.3.1.tar.gz" sha256: "9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23") buildenv: "894ca74bdb03c25d79f00ce915bbe25c56eba192334963c69e1846e6c84526cb" dependencies: () phases: ((phase kind: configure args: ("--prefix=/out") patches: ()) (phase kind: make args: () patches: ()) (phase kind: install args: () patches: ())) divergences: ())

objects/e803a7f68e4a55eac49be30b3dc84855749037be91aa48ec7315f73dd5c0d1b3.sgladded

@@ -0,0 +1 @@

(package-v1 name: "ncurses" version: "6.6" source: (source location: "https://ftp.gnu.org/gnu/ncurses/ncurses-6.6.tar.gz" sha256: "355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11") buildenv: "894ca74bdb03c25d79f00ce915bbe25c56eba192334963c69e1846e6c84526cb" dependencies: () phases: ((phase kind: configure args: ("--prefix=/out" "--without-ada" "--without-tests" "--without-cxx" "--without-cxx-binding" "--without-debug" "--disable-stripping" "--without-shared" "--with-normal" "--enable-widec" "--with-default-terminfo-dir=/out/share/terminfo" "--with-terminfo-dirs=/out/share/terminfo") patches: ()) (phase kind: make args: () patches: ()) (phase kind: install args: ("ticdir=/tmp/sigil/build/out/share/terminfo") patches: ())) divergences: ())

objects/ef59035716fe957378c12680f11c954a9eb93202214cfb2efd86fb0f94c7abc3.sgladded

@@ -0,0 +1 @@

(package-v1 name: "vim" version: "9.1.1164" source: (source location: "https://github.com/vim/vim/archive/refs/tags/v9.1.1164.tar.gz" sha256: "101526fa580d015edc5b5fb059d8b396cd8b05c29b0ec9ceb2a8763083293979") buildenv: "894ca74bdb03c25d79f00ce915bbe25c56eba192334963c69e1846e6c84526cb" dependencies: ("8695c98c7ed14c29bd12a3e4bc9d0287e1d55fccb25f568662909296d8e51781") phases: ((phase kind: configure args: ("--prefix=/out" "--with-features=normal" "--with-tlib=ncursesw" "--enable-multibyte" "--disable-gui" "--without-x" "--disable-gtk2-check" "--disable-gnome-check" "--disable-motif-check" "--disable-athena-check" "--disable-fontset" "--disable-acl" "--disable-gpm" "--disable-canberra" "--disable-libsodium" "--disable-selinux" "--disable-nls" "--disable-netbeans" "--with-compiledby=Sigil") patches: ()) (phase kind: make args: ("VIMRCLOC=/out/share/vim" "VIMRUNTIMEDIR=/out/share/vim/vim91") patches: ()) (phase kind: install args: () patches: ())) divergences: ())

snapshot.sglmodified

@@ -1,3 +1,3 @@

−1

(snapshot schema: 1 id: "core-stable" sequence: 1 content-hash: "sha256:3e680fef604a91b5cda3a7f3cbf755eb18ea9a3a8474b23bdb560ee866aa7b2f")

(snapshot schema: 1 id: "core-stable" sequence: 3 content-hash: "sha256:92696415c49351450ff4601de0174e9222d91214049da93ef79343510d7d703d")

(toolchain id: "toolchain/zig" version: "0.16.0" recipe: "sha256:5bc02f4c7abc6055b1f5fc37c57c4b063c18f9e3431ba2cab0cc9f30f313e33b" output: "sha256:70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00")

−3

(pkg id: "core/packages/wasm" version: "0.1.0" recipe: "sha256:9a3cd0aa68d3ed4c6c09b8c2b23c2b4a407506596742b57d6552f91aad67b286")

(pkg id: "core/packages/wasm" version: "0.1.0" recipe: "sha256:59da1bbefc5232c2120d6221ad0d68ceaba412ee6c0a811189f2c13aea715276")

snapshot.sgl.minisigmodified

@@ -1,4 +1,4 @@

untrusted comment: signature from minisign secret key

−2

RUQ0HOFEHrNeRAO09/HcQumhJxFvYaTyc8KeSJidWnGx0QM4K9CJUIvQO9a7uUlIwagw7P9YTmJXvkaV+smJ+RZCgajgGY0hOwQ=

−3

trusted comment: registry=pkg.usesigil.org path=/v1/channels/core-stable/snapshot.sgl seq=501 ts=2026-07-28T13:00:00Z

−4

iSKPodikIc9g35e+WLQj9hDoLuZjErvzbYsPZ5wIj7DyA18A1X12w/FwEd+Mw5L+xmrX5J9nvi5dqEHwgh2KAQ==

RUQ0HOFEHrNeRBREnMSDSO/Eao4V+Tz5+fP5UCRar+N3qaBVE43W38YDJ/UE4bIBPUv7ttrvdLIsKgSbNqB0yFjAbzdWdhSMwQU=

trusted comment: registry=pkg.usesigil.org path=/v1/channels/core-stable/snapshot.sgl seq=505 ts=2026-07-30T18:50:00Z

oH/APIz7o8tthwf3+SV/1rRvNPcOKbvDI2bziRleWSEsoWevYSLRyRFoSrP3Glk1l/zDgZWw8t+DvhxyFGfADA==

src/core/outputs.sgladded

@@ -0,0 +1,47 @@

;;; Realized dependency output identities.

;;;

;;; `(sigil env package)` requires every entry of a package's `dependencies:`

;;; list to be a bare 64-character SHA-256 string, and `(sigil build external)`

;;; resolves each one with `store-lookup-output`. A dependency is therefore

;;; **the content hash of an already-realized output tree**, not the identity of

;;; a sibling package. Package modules import the names below so that no

;;; package definition carries a raw hash that is not an upstream artifact pin.

;;;

+10

;;; READ THIS BEFORE ADDING AN ENTRY. Naming these values does not make them

+11

;;; well-behaved, and they are NOT the same kind of thing as `core-buildenv` in

+12

;;; (core build-environments):

+13

;;;

+14

;;; * `core-buildenv` pins an EXTERNAL artifact the channel consumes -- the

+15

;;; published seed tarball, whose hash is in `seed/MANIFEST` and which the

+16

;;; realizer re-verifies against the file on disk before every build. It is

+17

;;; the same category of value as a source `sha256:`.

+18

;;;

+19

;;; * The values below are PRODUCTS OF THIS CHANNEL. They cannot be computed

+20

;;; without building; nothing checks that a given hash is in fact the output

+21

;;; of the package it is named after; and, measured on 2026-07-30, they are

+22

;;; **not portable between machines or even between store locations**.

+23

;;; Building this channel's `zlib` into three different store roots produced

+24

;;; three different output hashes, because the realizer bakes the store

+25

;;; prefix into installed files (`lib/pkgconfig/zlib.pc` `prefix=` is the

+26

;;; minimal example) while `libz.a` stays byte-identical. The store prefix

+27

;;; contains the derivation hash, and the derivation record contains the

+28

;;; store root, so output identity is self-referentially store-local.

+29

;;;

+30

;;; Consequence: the hashes below are correct for a build whose store is the

+31

;;; default `$XDG_CACHE_HOME/sigil/store` (i.e. `~/.cache/sigil/store`) on

+32

;;; x86_64-linux with this channel's pinned seed and Zig toolchain, and they are

+33

;;; wrong everywhere else. They are a development convenience, not a durable

+34

;;; part of a published channel. See the task note for the API change that

+35

;;; would let a dependency be an actual package binding.

+36

(define-library (core outputs)

+37

(import (sigil core))

+38

(export zlib-output ncurses-output)

+39

(begin

+40

+41

;; core/zlib 1.3.1

+42

(define zlib-output

+43

"e7026efe2fe0fc17c068cab9bad5277f9131f6fc4d379acd2bc7373477cbb9ce")

+44

+45

;; core/ncurses 6.6

+46

(define ncurses-output

+47

"8695c98c7ed14c29bd12a3e4bc9d0287e1d55fccb25f568662909296d8e51781")))

src/core/packages/compression.sgladded

@@ -0,0 +1,24 @@

;;; Compression libraries.

;;;

;;; zlib is a leaf dependency: it has no package dependencies of its own, so it

;;; establishes the plain source + configure/make/install translation from the

;;; legacy `recipes/` form to an authenticated `src/` package value.

(define-library (core packages compression)

(import (sigil core)

(core build-environments)

(sigil env package)

+10

(sigil build external))

+11

(export zlib)

+12

(begin

+13

(define zlib

+14

(package

+15

name: "zlib"

+16

version: "1.3.1"

+17

source: (external-source

+18

location: "https://zlib.net/fossils/zlib-1.3.1.tar.gz"

+19

sha256: "9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23")

+20

buildenv: core-buildenv

+21

phases: (list

+22

(external-phase kind: 'configure args: (list "--prefix=/out"))

+23

(external-phase kind: 'make)

+24

(external-phase kind: 'install))))))

src/core/packages/editors.sgladded

@@ -0,0 +1,52 @@

;;; Terminal editors.

;;;

;;; vim is the first package in this channel with a real dependency, so it is

;;; where the dependency-reference pattern is established: the dependency is

;;; named by an imported binding from (core outputs) rather than by a raw hash

;;; literal in this module. Read the header of (core outputs) before adding a

;;; dependency -- the binding is a name for a realized output tree, not for the

;;; sibling package, and it does not travel between machines.

(define-library (core packages editors)

+10

(import (sigil core)

+11

(core build-environments)

+12

(core outputs)

+13

(sigil env package)

+14

(sigil build external))

+15

(export vim)

+16

(begin

+17

(define vim

+18

(package

+19

name: "vim"

+20

version: "9.1.1164"

+21

source: (external-source

+22

location: "https://github.com/vim/vim/archive/refs/tags/v9.1.1164.tar.gz"

+23

sha256: "101526fa580d015edc5b5fb059d8b396cd8b05c29b0ec9ceb2a8763083293979")

+24

buildenv: core-buildenv

+25

dependencies: (list ncurses-output)

+26

phases: (list

+27

(external-phase

+28

kind: 'configure

+29

args: (list "--prefix=/out"

+30

"--with-features=normal"

+31

"--with-tlib=ncursesw"

+32

"--enable-multibyte"

+33

"--disable-gui"

+34

"--without-x"

+35

"--disable-gtk2-check"

+36

"--disable-gnome-check"

+37

"--disable-motif-check"

+38

"--disable-athena-check"

+39

"--disable-fontset"

+40

"--disable-acl"

+41

"--disable-gpm"

+42

"--disable-canberra"

+43

"--disable-libsodium"

+44

"--disable-selinux"

+45

"--disable-nls"

+46

"--disable-netbeans"

+47

"--with-compiledby=Sigil"))

+48

(external-phase

+49

kind: 'make

+50

args: (list "VIMRCLOC=/out/share/vim"

+51

"VIMRUNTIMEDIR=/out/share/vim/vim91"))

+52

(external-phase kind: 'install))))))

src/core/packages/terminal.sgladded

@@ -0,0 +1,45 @@

;;; Terminal libraries.

;;;

;;; ncurses is the wide-character terminal library every terminal editor in

;;; this channel links against. The install phase must pin `ticdir` because

;;; ncurses' own install rule otherwise writes the compiled terminfo database

;;; outside DESTDIR; see the note beside the `install` phase below.

(define-library (core packages terminal)

(import (sigil core)

(core build-environments)

+10

(sigil env package)

+11

(sigil build external))

+12

(export ncurses)

+13

(begin

+14

(define ncurses

+15

(package

+16

name: "ncurses"

+17

version: "6.6"

+18

source: (external-source

+19

location: "https://ftp.gnu.org/gnu/ncurses/ncurses-6.6.tar.gz"

+20

sha256: "355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11")

+21

buildenv: core-buildenv

+22

phases: (list

+23

(external-phase

+24

kind: 'configure

+25

args: (list "--prefix=/out"

+26

"--without-ada"

+27

"--without-tests"

+28

"--without-cxx"

+29

"--without-cxx-binding"

+30

"--without-debug"

+31

"--disable-stripping"

+32

"--without-shared"

+33

"--with-normal"

+34

"--enable-widec"

+35

"--with-default-terminfo-dir=/out/share/terminfo"

+36

"--with-terminfo-dirs=/out/share/terminfo"))

+37

(external-phase kind: 'make)

+38

;; `ticdir` is passed as an absolute path under the staged

+39

;; DESTDIR tree. The builder rewrites the literal prefixes

+40

;; "/out" and "/tmp/sigil/build/out" in phase arguments to the

+41

;; real store prefix, so this string is the portable spelling

+42

;; of "the terminfo directory inside the staged install root".

+43

(external-phase

+44

kind: 'install

+45

args: (list "ticdir=/tmp/sigil/build/out/share/terminfo")))))))