HollowScript v0.1.1 preview

HollowScript v0.1.1 is a preview. It adds signed command line and C SDK archives for Linux on x86_64 and Windows on x86_64, alongside macOS on Apple Silicon. The command line, embedding API and bytecode format may still change before 1.0.

Supported binary platforms: macOS on Apple Silicon, Linux on x86_64 (static musl build) and Windows on x86_64. Linux on ARM64, Intel macOS, downloadable WebAssembly builds, registry packages and editor extension stores are not part of this release. Their source build targets are not a support claim.

Install on macOS or Linux:

curl -fsSL https://get.hollowscript.org/install.sh | sh -s -- --version v0.1.1

Install on Windows, in PowerShell:

$env:HOLLOWSCRIPT_VERSION = 'v0.1.1'; irm https://get.hollowscript.org/install.ps1 | iex

Restart the shell, then run hollowscript version. The installers verify the release signature with minisign or OpenSSH and check the archive hash before installing. macOS downloads are signed by the project, not notarised by Apple. The Windows executables are not Authenticode signed, so Smart App Control, where it is turned on, may refuse to run them. See the installation guide for options and uninstall instructions.

What changed:

• On Windows, fs and the module loader refuse a hard-linked file, as on Unix. On every platform a file is accepted only when its link count is exactly one.
• The PowerShell installer parses under Windows PowerShell 5.1 and PowerShell 7, and Windows diagnostics display paths with forward slashes.
• The full list is in CHANGELOG.md.

Verification and reproduction:

• SHA256SUMS.minisig and SHA256SUMS.sshsig sign the same SHA256SUMS, with the public key pinned in scripts/hollowscript-release.pub.
• With minisign: minisign -Vm SHA256SUMS -p scripts/hollowscript-release.pub, then shasum -a 256 -c SHA256SUMS in the directory containing the downloaded files.
• The checksum set covers the six archives, the CycloneDX SBOM and two build records: hollowscript-0.1.1-aarch64-apple-darwin-build.json (macOS and Windows archives, built on Apple Silicon macOS) and hollowscript-0.1.1-x86_64-unknown-linux-musl-build.json (Linux archives, built on a native x86_64 Linux builder with a pinned image).
• Each build record names this mirror's source commit and the pinned Rust 1.98.1 toolchain. Every product matched a second build from a different checkout and Cargo home on the same builder. That is not an independent reproduction.

The installer also accepts the latest release by default. The latest.txt pointer is unsigned and has no expiry, so a compromised download service could keep a default install on an older signed release above the installer's release floor. The pinned commands above avoid relying on that pointer. Freshness protection is planned before a stable release.

The public mirror contains one commit for this release, with no development history or internal release material. Code is Apache-2.0 or MIT; documentation is CC BY 4.0 with separate branding terms. Report suspected vulnerabilities privately through this repository's Security tab.

HollowScript v0.1.0 preview

HollowScript v0.1.0 is the first public preview. It implements specification 1.1.1 and includes the command line tool, language server, C SDK and release source. The command line, embedding API and bytecode format may change before 1.0.

Supported binary platform: macOS on Apple Silicon. Intel macOS, Linux, Windows, downloadable WebAssembly builds, registry packages and editor extension stores are deferred. Their source build targets are not a support claim.

Install the command line tool and language server:

curl -fsSL https://get.hollowscript.org/install.sh | sh -s -- --version v0.1.0

Restart the shell, then run hollowscript version. The installer verifies the release signature using minisign or OpenSSH and checks the archive hash before installing. Downloads are signed by the project, not notarised by Apple. See the installation guide for options and uninstall instructions.

Verification and reproduction:

• SHA256SUMS.minisig and SHA256SUMS.sshsig sign the same SHA256SUMS, with the public key pinned in scripts/hollowscript-release.pub.
• With minisign: minisign -Vm SHA256SUMS -p scripts/hollowscript-release.pub, then shasum -a 256 -c SHA256SUMS in the directory containing the downloaded files.
• The checksum set covers both native archives, the CycloneDX SBOM and hollowscript-0.1.0-aarch64-apple-darwin-build.json.
• The build record identifies this mirror's source commit and the pinned Rust 1.98.1 toolchain. Rebuild from tag v0.1.0 with scripts/release-build.sh --version v0.1.0 --targets aarch64-apple-darwin.
• All four shipped native products matched two builds from different checkout paths and Cargo homes on one Apple Silicon Mac. This is an operator-signed build record and same-host reproducibility, not independent build provenance.

The installer also accepts the latest release by default. The latest.txt pointer is unsigned and has no expiry, so a compromised download service could keep a default install on an older signed release above the installer's release floor. The pinned command above avoids relying on that pointer. Freshness protection is planned before a stable release.

The public mirror contains one commit for this release, with no development history or internal release material. Code is Apache-2.0 or MIT; documentation is CC BY 4.0 with separate branding terms. Report suspected vulnerabilities privately through this repository's Security tab.