ASM 0.1.0

ASM 0.1.0

The first alpha connects a native assembly CLI to a public assembly package registry.
It supports Linux x86-64 hosts.
Package records can include x86-64, AArch64, and RISC-V Linux artifacts.

Start a project

Install GNU Binutils, curl, GNU Coreutils, and gzip.
The source build also needs Git and GNU Make.
Follow the installation instructions.

asm doctor
asm new hello
cd hello
asm run
asm test

The program prints Hello from asm!.

What this release includes

• A Linux x86-64 CLI written in assembly, with direct system calls.
• Project creation, builds, execution, tests, and cleanup.
• Package search, version lists, artifact downloads, and executable installation.
• Exact direct source dependencies, asm.lock, cache verification, and synchronization.
• Native preparation of a publication record for a reviewed pull request.
• A public catalog with targets, versions, source commits, evidence states, and download observations.
• Commit-bound source archives and a browsable CLI source reference at asm.build.

The registry starts with three reference packages:

Package	Purpose	Targets
stubbi/asm	The CLI and its source.	x86-64 Linux
stubbi/hello	A complete first project.	x86-64, AArch64, and RISC-V Linux
stubbi/math	A small source dependency with an explicit function contract.	x86-64 Linux

Release evidence

SHA256SUMS identifies the release files.
release.json records the source commit, tool versions, build commands, and execution results.
The release job compares two clean builds and deterministic source archives.

The x86-64 examples run natively.
The cross-target examples run through QEMU.
Emulation does not establish performance or compatibility on every physical processor.

The release workflow requests GitHub provenance attestations for the published artifacts.
Check the workflow result and the attestation for the exact digest before relying on that claim.
The current CLI checks the registry digest; it does not verify attestations itself.

Integrity and failure behavior

Downloads must match both their declared size and SHA-256 digest.
Install checks the ELF target and segment bounds.
Source extraction rejects unsafe paths, links, special files, ambiguous members, and resource-limit violations.
Existing destination files remain intact when an operation fails.

Dependency commands use exact versions.
The lock file records the target, artifact URL, size, digest, and registry origin.
Builds check locked archives and extracted source trees before assembly.
The assembler can still read other local files through explicit includes.
A lock file is not a build sandbox.

Known limits

This is an alpha, with a deliberately stated support boundary.

• The native CLI host and project build target are Linux x86-64.
• Dependencies are direct and exact. There is no transitive resolver or version-range syntax.
• Publication uses maintainer review. asm publish prepares a local record; it does not upload or reserve a name.
• The HTTPS registry is the digest authority. Separate signed metadata and rollback protection are future work.
• Download counts are GitHub asset requests, not unique users or installations.
• Formal proofs, vulnerability analysis, and agent review are separate proposed services.
• There is no self-update command, self-service ownership recovery, or isolated public build service.

Read the security model before running package code.
Report defects through GitHub Issues.
Use private vulnerability reporting for a security defect.

Why ASM

We expect AI to make useful assembly cheaper to produce and maintain.
Reliable reuse then needs common package formats, explicit targets, and inspectable evidence.
That expectation guides the project; experiments must still support each performance, correctness, and cost claim.

Read the working assumptions.