@amritk/nish-x86_64-linux 0.20.0 → 0.22.1

package/INSTALL.md

@@ -143,6 +143,36 @@ for — which catches a truncated download, a tarball built for another
 architecture, and an asset whose name does not match what is inside it — and
 only then swapped in. If any of that fails the install you had is untouched.
 
+**Every download is checked before it is unpacked.** install.sh compares the
+tarball's SHA-256 with the release's `SHA256SUMS` (or with the digest pinned
+for releases that predate it) and refuses a mismatch. For releases after
+0.21.0 it also checks the release's **build provenance attestation** when a
+signed-in GitHub CLI is present whose `gh attestation verify` takes the
+options below. The attestation
+is a Sigstore-signed statement, made by `actions/attest-build-provenance` in
+the release workflow, that every file in `SHA256SUMS` was built by
+`.github/workflows/release.yml` at the release's tag on a GitHub-hosted
+runner. A failed verification refuses the install; with no `gh`, a signed-out
+one or one too old for those options, the check is skipped with a note saying so, and the
+SHA-256 still applies. The same command by hand, on a tarball you downloaded:
+
+```bash
+gh attestation verify nish-<version>-<asset>.tar.gz \
+  --repo amritk/nish \
+  --signer-workflow amritk/nish/.github/workflows/release.yml \
+  --source-ref refs/tags/v<version> \
+  --deny-self-hosted-runners
+```
+
+It works on any file the release attaches, the npm tarballs included. Each
+release also attaches `nish-<version>.spdx.json`, an SPDX 2.3 software bill of
+materials: every attached file with its SHA-256, the clang, linker, Node.js
+and seed compiler that built each tarball (recorded by the build row itself),
+and the vendored code from
+[THIRD_PARTY_NOTICES.md](../THIRD_PARTY_NOTICES.md) that each of them contains.
+How these fit the rest of the release's defences is
+[docs/security/supply-chain.md](security/supply-chain.md).
+
 The npm route installs the **native** compiler, and it is a download rather than a
 build: nothing is compiled on your machine. The package declares one
 `nish-<os>-<arch>` package per supported platform as an `optionalDependencies`
@@ -224,7 +254,7 @@ routes are
   # on the musl host, with its own clang and the runtime from this repository
   clang app.ll runtime/runtime.c runtime/runtime-os.c runtime/runtime-parallel.c \
     runtime/runtime-cross.c runtime/runtime-host.c runtime/runtime-net.c \
-    runtime/runtime-simd.c runtime/runtime-aes.c -lm -o app
+    runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-term.c runtime/runtime-bytes.c -lm -o app
   ```
 
   `--link`ing inside the container is the mistake to avoid: it shells out to the
@@ -360,22 +390,25 @@ it into `build/seed/`; `NISH_BOOTSTRAP=<path>` names one you already have and
 skips the download. §2a has what the build does with it.
 
 The published package ships `bin/` (the `nish` command, which is a launcher),
-`runtime/` (the C runtime — eight translation units, the wasm subset and their header),
-`scripts/build.sh` (the link pipeline) and `std/` (the standard library). The
+`runtime/` (the C runtime — ten translation units, the wasm subset and their
+header — and `runtime/sqlite/`, SQLite's vendored source),
+`scripts/build.sh` (the link pipeline), `std/` (the standard library) and
+`docs/AI.md` (the rules card). The
 compiler itself is not in it: it arrives as one prebuilt
 `@amritk/nish-<asset>` package per platform, and `bin/nish` hands over to
-whichever one npm installed. `nish` locates the runtime, the script and `std/`
+whichever one npm installed. That package carries its own copy of all of
+these, and its `docs/AI.md` is the one an agent's `nish --help` names. `nish` locates the runtime, the script and `std/`
 relative to its own install directory, so a global install works from any
 working directory — and the binary runs from inside its own platform package
 for exactly that reason.
 
 Building the IR yourself rather than through `--link` means naming the runtime
-on the `clang` line, and it is eight files:
+on the `clang` line, and it is ten files:
 
 ```bash
 clang app.ll runtime/runtime.c runtime/runtime-os.c runtime/runtime-parallel.c \
   runtime/runtime-cross.c runtime/runtime-host.c runtime/runtime-net.c \
-  runtime/runtime-simd.c runtime/runtime-aes.c -lm -o app
+  runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-term.c runtime/runtime-bytes.c -lm -o app
 ```
 
 `runtime.c` is the part every program touches — the arena, strings, arrays,
@@ -387,15 +420,24 @@ needs `-DNISH_THREADS=1 -pthread` on the line), `runtime-cross.c` copies
 the strings and arrays a task answers, a channel sends or a `Mutex` keeps out
 of the arena they were made in, `runtime-host.c` holds the wall clock,
 entropy, file times and signals, `runtime-net.c` the sockets of `nish:net`,
-and `runtime-simd.c` and `runtime-aes.c` the vector text search and AES-GCM.
+`runtime-simd.c` and `runtime-aes.c` the vector text search and AES-GCM,
+`runtime-term.c` the stdin reads and terminal calls of `nish:term`, and
+`runtime-bytes.c` the byte-class runs of `nish/bytes`, which `nish/json` steps
+over.
 They are separate so that each carries its own measured size ceiling
 ([docs/wp7-runtime.md](wp7-runtime.md)); nothing in the core calls into the
 others, so a line that names only `runtime.c` and `runtime-os.c` still links a
-program that uses none of the other six. `scripts/build.sh` compiles the other
-seven beside any
+program that uses none of the other eight. `scripts/build.sh` compiles the other
+eight beside any
 `runtime.c` it is handed, so a build that goes through it — every `--link`,
 and every `--profile` recipe in these documents — needs to name only the one.
 
+A program whose IR declares an `sqlite3_*` function also needs SQLite on a
+hand-written line. `scripts/build.sh` adds it by itself; by hand, append
+`runtime/sqlite/sqlite3.c` with the options `scripts/build.sh` lists under
+"SQLite's compile-time options" (at least `-DSQLITE_THREADSAFE=0`, or `=2`
+beside `-DNISH_THREADS=1`).
+
 ## 2a. What `npm run build` does
 
 `src/` is the compiler, written in Nish, and it compiles itself
@@ -506,7 +548,7 @@ Removing the directory is always safe.
 | 2 | usage error: unknown flag, missing argument, no input files |
 | 3 | toolchain error: `--link` found no `clang` (`CC` overrides), or `scripts/build.sh` failed (its output is shown; the `.ll` files are still written) — or the `nish` command found no prebuilt compiler for this platform, or one that would not start. Under `--json` all of these are one `NL0002` object |
 | | `nish run` answers these codes until the program starts, and the program's own exit status (`128 + n` for a signal) after that. With neither `HOME` nor `XDG_CACHE_HOME` set to an absolute path it answers 3 |
-| 70 | internal compiler error: an unexpected exception. Please report it at <https://github.com/amritk/nish/issues> with the input and command line; `NISH_DEBUG=1` prints the stack trace |
+| 70 | internal compiler error: a broken invariant in the compiler. Please report it at <https://github.com/amritk/nish/issues> with the input and command line; the compiler is self-hosted and has no stack trace to print, so the message it prints is the whole report |
 
 ## Troubleshooting