HollowScript v0.1.1 preview

HollowScript v0.1.1 is a preview. It adds signed command line and C SDK archives for Linux on x86_64 and Windows on x86_64, alongside macOS on Apple Silicon. The command line, embedding API and bytecode format may still change before 1.0.

Supported binary platforms: macOS on Apple Silicon, Linux on x86_64 (static musl build) and Windows on x86_64. Linux on ARM64, Intel macOS, downloadable WebAssembly builds, registry packages and editor extension stores are not part of this release. Their source build targets are not a support claim.

Install on macOS or Linux:

curl -fsSL https://get.hollowscript.org/install.sh | sh -s -- --version v0.1.1

Install on Windows, in PowerShell:

$env:HOLLOWSCRIPT_VERSION = 'v0.1.1'; irm https://get.hollowscript.org/install.ps1 | iex

Restart the shell, then run hollowscript version. The installers verify the release signature with minisign or OpenSSH and check the archive hash before installing. macOS downloads are signed by the project, not notarised by Apple. The Windows executables are not Authenticode signed, so Smart App Control, where it is turned on, may refuse to run them. See the installation guide for options and uninstall instructions.

What changed:

• On Windows, fs and the module loader refuse a hard-linked file, as on Unix. On every platform a file is accepted only when its link count is exactly one.
• The PowerShell installer parses under Windows PowerShell 5.1 and PowerShell 7, and Windows diagnostics display paths with forward slashes.
• The full list is in CHANGELOG.md.

Verification and reproduction:

• SHA256SUMS.minisig and SHA256SUMS.sshsig sign the same SHA256SUMS, with the public key pinned in scripts/hollowscript-release.pub.
• With minisign: minisign -Vm SHA256SUMS -p scripts/hollowscript-release.pub, then shasum -a 256 -c SHA256SUMS in the directory containing the downloaded files.
• The checksum set covers the six archives, the CycloneDX SBOM and two build records: hollowscript-0.1.1-aarch64-apple-darwin-build.json (macOS and Windows archives, built on Apple Silicon macOS) and hollowscript-0.1.1-x86_64-unknown-linux-musl-build.json (Linux archives, built on a native x86_64 Linux builder with a pinned image).
• Each build record names this mirror's source commit and the pinned Rust 1.98.1 toolchain. Every product matched a second build from a different checkout and Cargo home on the same builder. That is not an independent reproduction.

The installer also accepts the latest release by default. The latest.txt pointer is unsigned and has no expiry, so a compromised download service could keep a default install on an older signed release above the installer's release floor. The pinned commands above avoid relying on that pointer. Freshness protection is planned before a stable release.

The public mirror contains one commit for this release, with no development history or internal release material. Code is Apache-2.0 or MIT; documentation is CC BY 4.0 with separate branding terms. Report suspected vulnerabilities privately through this repository's Security tab.