RustForge

foundry

Foundry OS: the operating system built on the Rustbelt kernel

authorGrok Bot <grokbot@localhost>2026-10-31 18:57:10 -0700
commit5b5c90c345a0aeebe7644dc3753f0f43b3cfc0cd
parent141a05d5007b1a1bf8025c1ce8cfa9c560e8f8a1
treebrowse files at this commit
toolchain/musl, ports/, c/: SHA256-pinned download cache instead of vendored tarballs

- toolchain/musl/musl.sha256 + musl.url + fetch.sh: download into the
  git-ignored cache/ and verify (musl 1.2.5, a9a118bb...c75e4).
- toolchain/musl/build.sh (+ empty patches/): static musl into out/sysroot
  via 'make musl'. Not used by the contract-v1 image yet (M2).
- ports/dash: pin only (dash 0.5.12). c/hello-musl.c for M2 (static-PIE).
Ac/README.md+6 -0
Ac/hello-musl.c+14 -0
Aports/README.md+21 -0
Aports/dash/dash.sha256+1 -0
Aports/dash/dash.url+1 -0
Atoolchain/musl/build.sh+27 -0
Atoolchain/musl/fetch.sh+26 -0
Atoolchain/musl/musl.sha256+1 -0
Atoolchain/musl/musl.url+1 -0
Atoolchain/musl/patches/README.md+5 -0

10 files changed, 103 insertions, 0 deletions

@@ -0,0 +1,6 @@+# c/: small C programs of our own++libc smoke tests for Foundry OS, built against musl. Not in the image yet+(milestone M2 adds them to /bin and to the self-test).++- `hello-musl.c`: prints one line; build with `musl-gcc -static-pie`.
@@ -0,0 +1,14 @@+/* The first Foundry OS C program (milestone M2): plain C against musl.+ * Build:  musl-gcc -O2 -static-pie hello-musl.c -o hello-musl+ * (Rustbelt 0.19.0 loads static-PIE programs, so no special link flags.) */+#include <stdio.h>+#include <sys/utsname.h>++int main(void) {+    struct utsname u;+    if (uname(&u) == 0)+        printf("hello from musl on Foundry OS (%s %s)\n", u.sysname, u.release);+    else+        printf("hello from musl on Foundry OS\n");+    return 0;+}
@@ -0,0 +1,21 @@+# ports/: third-party C programs++One directory per program ("a port"), the way Alpine's APKBUILDs and the+BSD ports trees do it:++```+ports/<name>/+├── <name>.sha256   the pinned release tarball: "SHA256  file-name"+├── <name>.url      where to download it (into the git-ignored cache/)+├── patches/        our changes, applied in order (0001-*.patch, ...)+└── build.sh        unpack -> patch -> configure -> make -> install into out/staging+```++No tarball is ever committed; `cache/` is git-ignored and every download is+checked against the SHA256 here.++Status (M1): only the pin for **dash 0.5.12** exists. It becomes+`/bin/sh` for POSIX scripts in M3 (the interactive shell stays `rbsh`).+Later: **sbase** (M4) and **busybox** (M5). Their applets go to+`/usr/lib/busybox`, *off* the default `PATH`, so the Rust tools stay the+default (see docs/plan.md).
@@ -0,0 +1 @@+6a474ac46e8b0b32916c4c60df694c82058d3297d8b385b74508030ca4a8f28a  dash-0.5.12.tar.gz
@@ -0,0 +1 @@+http://gondor.apana.org.au/~herbert/dash/files/dash-0.5.12.tar.gz
@@ -0,0 +1,27 @@+#!/usr/bin/env bash+# Unpack the cached musl tarball, apply patches/*.patch in order, and+# install a static-only musl into a sysroot (headers in include/, libc.a and+# the crt*.o start files in lib/, plus a musl-gcc wrapper in bin/).+#+# Not used by the contract-v1 image yet (milestone M2). Since Rustbelt+# 0.19.0 loads static-PIE programs, the plan is plain+#   out/sysroot/bin/musl-gcc -static-pie hello.c+# with none of the old rb-cc link tricks (see docs/porting.md).+#+# Usage: toolchain/musl/build.sh CACHE_DIR BUILD_DIR SYSROOT+set -euo pipefail+HERE=$(cd "$(dirname "$0")" && pwd)+CACHE=$(realpath "$1") BUILD=$(realpath -m "$2") SYSROOT=$(realpath -m "$3")+read -r _ name < "$HERE/musl.sha256"+rm -rf "$BUILD" && mkdir -p "$BUILD"+tar -xzf "$CACHE/$name" -C "$BUILD"+src=$BUILD/${name%.tar.gz}+for p in "$HERE"/patches/*.patch; do+    [ -e "$p" ] || continue+    echo "[musl] applying $(basename "$p")"; patch -d "$src" -p1 < "$p"+done+cd "$src"+./configure --prefix="$SYSROOT" --syslibdir="$SYSROOT/lib" --disable-shared >/dev/null+make -j"$(nproc)" >/dev/null+make install >/dev/null+echo "[musl] installed into $SYSROOT ($(ls "$SYSROOT/lib" | wc -l) files in lib/)"
@@ -0,0 +1,26 @@+#!/usr/bin/env bash+# Download the musl release tarball into the download cache (default cache/)+# and check it against the SHA256 pinned in musl.sha256. Nothing downloaded+# is ever committed: cache/ is git-ignored.+#+# Offline? Put the tarball in cache/ yourself (any copy with the right+# SHA256 is fine), or set MUSL_TARBALL=/path/to/musl-1.2.5.tar.gz.+#+# Usage: toolchain/musl/fetch.sh [CACHE_DIR]+set -euo pipefail+HERE=$(cd "$(dirname "$0")" && pwd)+CACHE=${1:-cache}+mkdir -p "$CACHE"+read -r sum name < "$HERE/musl.sha256"+url=$(cat "$HERE/musl.url")+dest=$CACHE/$name+if [ -n "${MUSL_TARBALL:-}" ] && [ ! -f "$dest" ]; then cp "$MUSL_TARBALL" "$dest"; fi+if [ ! -f "$dest" ]; then+    echo "[musl] downloading $url"+    curl -fL --retry 3 -o "$dest.part" "$url" && mv "$dest.part" "$dest"+fi+if echo "$sum  $dest" | sha256sum -c --quiet -; then+    echo "[musl] $dest: SHA256 OK"+else+    echo "[musl] $dest: SHA256 MISMATCH -- delete it and try again"; exit 1+fi
@@ -0,0 +1 @@+a9a118bbe84d8764da0ea0d28b3ab3fae8477fc7e4085d90102b8596fc7c75e4  musl-1.2.5.tar.gz
@@ -0,0 +1 @@+https://musl.libc.org/releases/musl-1.2.5.tar.gz
@@ -0,0 +1,5 @@+# musl patches++Patches to musl, applied in file-name order by `../build.sh`+(`0001-short-name.patch`, `0002-...`). Empty for now: musl needs no+changes to run on Rustbelt 0.19.0.