Commitad1aeea4Recorded28 Jul 2026Repositorycore-channel

Gate sealed channel publication

Changed
 Makefile                      |  8 ++++++++
 README.md                     |  8 ++++++++
 channel.catalogue.sgl         |  2 +-
 channel.catalogue.sgl.minisig |  4 ++++
 channel.sgl                   |  6 ++++++
 snapshot.sgl                  |  2 +-
 snapshot.sgl.minisig          |  4 ++++
 test/TEST-SIGNING.md          |  5 +++++
 test/registry.json            | 17 +++++++++++++++++
 test/registry.json.minisig    |  4 ++++
 10 files changed, 58 insertions(+), 2 deletions(-)
Diff
Makefileadded
@@ -0,0 +1,8 @@
+1
SIGIL ?= sigil
+2
REGISTRY_METADATA ?= test/registry.json
+3
+4
.PHONY: check
+5
check:
+6
@XDG_CACHE_HOME=$${XDG_CACHE_HOME:-/tmp/sigil-core-channel-check-cache} \
+7
SIGIL_REGISTRY_METADATA=$(REGISTRY_METADATA) \
+8
$(SIGIL) channel check --channel .
README.mdmodified
@@ -38,11 +38,19 @@ prototype. New authenticated package definitions use normal modules under
38
- `objects/`: canonical package values named by their SHA-256 identity.
39
- `snapshot.sgl`: signed source/toolchain snapshot.
40
- `channel.catalogue.sgl`: signed exported binding-to-package map.
+41
- `channel.sgl`: executable curator declaration for public package bindings.
42
- `recipes/`: legacy external-build prototype recipes.
43
- `seed/MANIFEST`: pinned downloadable seed artifact.
44
- `seed/MANIFEST.sources` and `seed/scripts/`: pinned seed sources and the
45
reproducible seed build.
46
- `toolchain/MANIFEST`: pinned Zig distribution.
+47
+48
After editing channel source or bindings, run `sigil channel publish` with the
+49
channels-role signing context. `make check` deterministically re-derives the
+50
sealed objects and roots and refuses stale committed artifacts; CI should run
+51
the same target. The metadata under `test/` and the currently committed root
+52
signatures use public, unlocked test keys and are not deployable production
+53
artifacts.
54
- `bootstrap`: verified materialization of ignored binary inputs.
55
- `scripts/gate-*`: permanent reproducibility, isolation, tamper, and
56
concurrency checks.
channel.catalogue.sglmodified
@@ -1,2 +1,2 @@
−1
(catalogue schema: 1 snapshot: "core-stable@1:sha256:3e680fef604a91b5cda3a7f3cbf755eb18ea9a3a8474b23bdb560ee866aa7b2f" channel-source: "sha256:9a3cd0aa68d3ed4c6c09b8c2b23c2b4a407506596742b57d6552f91aad67b286" content-hash: "sha256:be46e993e4d52449ff67cf2e999d2d7c40c0304326e2b1cc4eba3a6299bc0bc4" signature-algorithm: "sha256-keyed-test-v1" key-id: "sigil-env-snapshot-test-key-2026" signature: "sha256:aa2354a42161f1f48cf818790af1441520756f6d543dd88764a85c7e75a5383f")
+1
(catalogue schema: 1 sequence: 1 snapshot: "core-stable@1:sha256:3e680fef604a91b5cda3a7f3cbf755eb18ea9a3a8474b23bdb560ee866aa7b2f" channel-source: "sha256:9a3cd0aa68d3ed4c6c09b8c2b23c2b4a407506596742b57d6552f91aad67b286" content-hash: "sha256:17efc12bb7f838aa4ee4b52844687fcfd63f0d80a7ab3d58cbdec09774783b5e")
2
(binding name: "core/binaryen" package: "sha256:014baf016eec17892f30a30847b070ffb09e397182d2ef50eda2ceb3fded2a58")
channel.catalogue.sgl.minisigadded
@@ -0,0 +1,4 @@
+1
untrusted comment: signature from minisign secret key
+2
RUQ0HOFEHrNeRNiTeCpvjEtPJex6zo7rtG1Fm3j/1t7QfXedhCevtI2KMZlSW+UMXWo4+Oyl8FUCGeSWBuIJWLh65QBPfHXOlQM=
+3
trusted comment: registry=pkg.usesigil.org path=/v1/channels/core-stable/channel.catalogue.sgl seq=502 ts=2026-07-28T13:00:01Z
+4
6HwfAW1UtiZNcaSxnJfFDu18iPazlPH1tgRnEW6llhnbR1fFe6gr7lfAJm69VFZEkqjTVY1pBQHSb0bSV+XWCA==
channel.sgladded
@@ -0,0 +1,6 @@
+1
(import (core packages wasm))
+2
+3
(channel
+4
stream: "core-stable"
+5
bindings: (list
+6
(channel-binding name: "core/binaryen" value: binaryen)))
snapshot.sglmodified
@@ -1,3 +1,3 @@
−1
(snapshot schema: 1 id: "core-stable" sequence: 1 content-hash: "sha256:3e680fef604a91b5cda3a7f3cbf755eb18ea9a3a8474b23bdb560ee866aa7b2f" signature-algorithm: "sha256-keyed-test-v1" key-id: "sigil-env-snapshot-test-key-2026" signature: "sha256:09483f3e12e4db171d5b4e47be780ce47e3daa9d8b86d250592754dd97c87b7c")
+1
(snapshot schema: 1 id: "core-stable" sequence: 1 content-hash: "sha256:3e680fef604a91b5cda3a7f3cbf755eb18ea9a3a8474b23bdb560ee866aa7b2f")
2
(toolchain id: "toolchain/zig" version: "0.16.0" recipe: "sha256:5bc02f4c7abc6055b1f5fc37c57c4b063c18f9e3431ba2cab0cc9f30f313e33b" output: "sha256:70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00")
3
(pkg id: "core/packages/wasm" version: "0.1.0" recipe: "sha256:9a3cd0aa68d3ed4c6c09b8c2b23c2b4a407506596742b57d6552f91aad67b286")
snapshot.sgl.minisigadded
@@ -0,0 +1,4 @@
+1
untrusted comment: signature from minisign secret key
+2
RUQ0HOFEHrNeRAO09/HcQumhJxFvYaTyc8KeSJidWnGx0QM4K9CJUIvQO9a7uUlIwagw7P9YTmJXvkaV+smJ+RZCgajgGY0hOwQ=
+3
trusted comment: registry=pkg.usesigil.org path=/v1/channels/core-stable/snapshot.sgl seq=501 ts=2026-07-28T13:00:00Z
+4
iSKPodikIc9g35e+WLQj9hDoLuZjErvzbYsPZ5wIj7DyA18A1X12w/FwEd+Mw5L+xmrX5J9nvi5dqEHwgh2KAQ==
test/TEST-SIGNING.mdadded
@@ -0,0 +1,5 @@
+1
# Test signing metadata
+2
+3
The committed channel roots and `registry.json` are signed by Sigil's public,
+4
unlocked registry test keys. They are conspicuously non-production fixtures for
+5
the pre-ceremony workstream and must never be deployed to pkg.usesigil.org.
test/registry.jsonadded
@@ -0,0 +1,17 @@
+1
{
+2
"schema": 1,
+3
"protocol": 1,
+4
"registry": "pkg.usesigil.org",
+5
"seq": 120,
+6
"updated": "2026-07-28T12:00:00Z",
+7
"keys": [
+8
{"id":"821167AA8C366517","algorithm":"minisign-ed25519","roles":["root"],"public-key":"RWQXZTaMqmcRgnrQsRDQ4GogHgxbuYSzKVAZA81WWg65yj3RFKbywwvb","status":"active","comment":"TEST ONLY baked root"},
+9
{"id":"445EB31E44E11C34","algorithm":"minisign-ed25519","roles":["channels"],"public-key":"RWQ0HOFEHrNeRPOr5nSm0f4ulNWknyjcuS8dvVtcoL8RaBZJUVomeN9E","status":"active"},
+10
{"id":"6186763CEB9B738F","algorithm":"minisign-ed25519","roles":["index","future-role"],"public-key":"RWSPc5vrPHaGYfNFlEtvl2FPQ/iPK0im4+CER95fgmuJwf0hGOHeZuIs","status":"active"},
+11
{"id":"A8C1F32FAD011C72","algorithm":"minisign-ed25519","roles":["channels"],"public-key":"RWRyHAGtL/PBqJ87DmClurr8qkXAyZhp7wF8T1kf6YAg+7BpYLAWijYj","status":"retired","status-seq":110},
+12
{"id":"34E47D5D11FF95B1","algorithm":"minisign-ed25519","roles":["channels"],"public-key":"RWSxlf8RXX3kNIMaGqfA5SkiO+p/biHQ/5dDtOn2VHlYRjrHLBEMv+fC","status":"revoked"}
+13
],
+14
"log": null,
+15
"reproducibility": null,
+16
"future-field": {"ignored":true}
+17
}
test/registry.json.minisigadded
@@ -0,0 +1,4 @@
+1
untrusted comment: signature from minisign secret key
+2
RUQXZTaMqmcRgtcmbMq3hSD1VMyQ7/qfBHV9AJtxbH4ia7a6y3Srss/L6I5D8XguSoBdHH5wChpghcdfw+A0Li5An0exWICDhA4=
+3
trusted comment: registry=pkg.usesigil.org path=/v1/meta/registry.json seq=120 ts=2026-07-28T12:00:00Z
+4
dG0DBhvMn0RI3gVCzYMOBW7g+McVtEveeWgPsjWz9koYTrgwCxtftCzFmK0qni0xocVeNHu0VV9ONNjQswhQCQ==