# ports/: third-party C programs

One directory per program ("a port"), the way Alpine's APKBUILDs and the
BSD ports trees do it:

```
ports/<name>/
├── <name>.sha256   the pinned release tarball: "SHA256  file-name"
├── <name>.url      where to download it (into the git-ignored cache/)
├── patches/        our changes, applied in order (0001-*.patch, ...)
└── build.sh        unpack -> patch -> configure -> make -> install into out/staging
```

No tarball is ever committed; `cache/` is git-ignored and every download is
checked against the SHA256 here.

Status (M1): only the pin for **dash 0.5.12** exists. It becomes
`/bin/sh` for POSIX scripts in M3 (the interactive shell stays `rbsh`).
Later: **sbase** (M4) and **busybox** (M5). Their applets go to
`/usr/lib/busybox`, *off* the default `PATH`, so the Rust tools stay the
default (see docs/plan.md).