Skip to content

ASM 0.2.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Nov 02:01
Immutable release. Only release title and notes can be modified.
v0.2.0
4f3367b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ASM 0.2.0

This alpha connects a native assembly CLI to a public assembly package registry.
It supports Linux x86-64 hosts.
Package records can include x86-64, AArch64, and RISC-V Linux artifacts.

License policy

ASM now uses AGPL-3.0-or-later.
Starter text and the reference examples retain their MIT licenses.
Independent packages retain the license declared for each version.
Run asm license for the license, source location, and warranty notice.
Read the license scope before modifying or distributing ASM.

Version 0.1.0 was published under MIT.
This release does not change that historical license.

Start a project

Install GNU Binutils, curl, GNU Coreutils, and gzip.
Binary installation and manual updates also need GitHub CLI 2.93.0 or later.
No GitHub login is required.
The source build also needs Git and GNU Make.
Follow the installation instructions.

asm doctor
asm new hello
cd hello
asm run
asm test

The program prints Hello from asm!.

What this release includes

  • A Linux x86-64 CLI written in assembly, with direct system calls.
  • A bootstrap installer that verifies the signed release before installation.
  • Native asm self update for manual, provenance-verified updates from the hub.
  • Project creation, builds, execution, tests, and cleanup.
  • Package search, version lists, artifact downloads, and executable installation.
  • Exact direct source dependencies, asm.lock, cache verification, and synchronization.
  • Native preparation of a publication record for a reviewed pull request.
  • A public catalog with targets, versions, source commits, evidence states, and download observations.
  • Commit-bound source archives and a browsable CLI source reference at asm.build.

The registry starts with three reference packages:

Package Purpose Targets
stubbi/asm The CLI and its source. x86-64 Linux
stubbi/hello A complete first project. x86-64, AArch64, and RISC-V Linux
stubbi/math A small source dependency with an explicit function contract. x86-64 Linux

Release evidence

SHA256SUMS identifies the release files.
release.json records the source commit, tool versions, build commands, and execution results.
The release job compares two clean builds and deterministic source archives.

The x86-64 examples run natively.
The cross-target examples run through QEMU.
Emulation does not establish performance or compatibility on every physical processor.

The release workflow creates and verifies GitHub provenance attestations for each published artifact.
Verification checks the repository, workflow identity, source commit, workflow commit, and runner environment.
Check the workflow result and the attestation for the exact digest before relying on that claim.
The published release-attestation.sigstore.json contains the action-produced signature bundle.
Bootstrap installation and asm self update verify that bundle with the fixed release policy.
General package downloads still check registry digests; they do not inherit the CLI release's provenance result.

Integrity and failure behavior

Downloads must match both their declared size and SHA-256 digest.
Install checks the ELF target and segment bounds.
Source extraction rejects unsafe paths, links, special files, ambiguous members, and resource-limit violations.
Existing destination files remain intact when an operation fails.

Dependency commands use exact versions.
The lock file records the target, artifact URL, size, digest, and registry origin.
Builds check locked archives and extracted source trees before assembly.
The assembler can still read other local files through explicit includes.
A lock file is not a build sandbox.

Known limits

This is an alpha, with a deliberately stated support boundary.

  • The native CLI host and project build target are Linux x86-64.
  • Dependencies are direct and exact. There is no transitive resolver or version-range syntax.
  • Publication uses maintainer review. asm publish prepares a local record; it does not upload or reserve a name.
  • The HTTPS registry is the digest authority. Separate signed metadata and rollback protection are future work.
  • Download counts are GitHub asset requests, not unique users or installations.
  • Formal proofs, vulnerability analysis, and agent review are separate proposed services.
  • Self-update is manual and limited to the direct user-owned $HOME/.local/bin/asm installation.
  • Self-service ownership recovery and isolated public build workers remain future work.

Read the security model before running package code.
Report defects through GitHub Issues.
Use private vulnerability reporting for a security defect.

Why ASM

We expect AI to make useful assembly cheaper to produce and maintain.
Reliable reuse then needs common package formats, explicit targets, and inspectable evidence.
That expectation guides the project; experiments must still support each performance, correctness, and cost claim.

Read the working assumptions.

Assets 15
Loading