Skip to content

HollowScript v0.1.0 preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@hollowscript-releases hollowscript-releases released this 29 Oct 12:42
· 1 commit to main since this release
v0.1.0
e07f493

HollowScript v0.1.0 is the first public preview. It implements specification 1.1.1 and includes the command line tool, language server, C SDK and release source. The command line, embedding API and bytecode format may change before 1.0.

Supported binary platform: macOS on Apple Silicon. Intel macOS, Linux, Windows, downloadable WebAssembly builds, registry packages and editor extension stores are deferred. Their source build targets are not a support claim.

Install the command line tool and language server:

curl -fsSL https://get.hollowscript.org/install.sh | sh -s -- --version v0.1.0

Restart the shell, then run hollowscript version. The installer verifies the release signature using minisign or OpenSSH and checks the archive hash before installing. Downloads are signed by the project, not notarised by Apple. See the installation guide for options and uninstall instructions.

Verification and reproduction:

  • SHA256SUMS.minisig and SHA256SUMS.sshsig sign the same SHA256SUMS, with the public key pinned in scripts/hollowscript-release.pub.
  • With minisign: minisign -Vm SHA256SUMS -p scripts/hollowscript-release.pub, then shasum -a 256 -c SHA256SUMS in the directory containing the downloaded files.
  • The checksum set covers both native archives, the CycloneDX SBOM and hollowscript-0.1.0-aarch64-apple-darwin-build.json.
  • The build record identifies this mirror's source commit and the pinned Rust 1.98.1 toolchain. Rebuild from tag v0.1.0 with scripts/release-build.sh --version v0.1.0 --targets aarch64-apple-darwin.
  • All four shipped native products matched two builds from different checkout paths and Cargo homes on one Apple Silicon Mac. This is an operator-signed build record and same-host reproducibility, not independent build provenance.

The installer also accepts the latest release by default. The latest.txt pointer is unsigned and has no expiry, so a compromised download service could keep a default install on an older signed release above the installer's release floor. The pinned command above avoids relying on that pointer. Freshness protection is planned before a stable release.

The public mirror contains one commit for this release, with no development history or internal release material. Code is Apache-2.0 or MIT; documentation is CC BY 4.0 with separate branding terms. Report suspected vulnerabilities privately through this repository's Security tab.

Assets 9
Loading