Xu 0.8.x: modules, offline builds, and checksum logs

Since the first 0.1.0 snapshot, Xu has grown beyond its language syntax. Recent work focuses on module identity, reproducible dependency installation, offline builds, and content verification independent of the download source. The bilingual website documentation and API now reflect current sources.

0.8.1: slash-separated package paths

Package declarations, imports, and module manifests use /. Local paths look like @team/util and #net/http. Dots in domain names are preserved; an external declaration can use @"example.com/team/my-lib". Import aliases and full path identities are separate.

This change requires migration: replace old dotted package paths while preserving dots in domains, field access, and version numbers. Renaming a module also changes its locked identity, so review and rebuild the lock rather than changing source spelling alone.

0.8.2: installed snapshots and frozen builds

xu install collects transitive dependencies and creates verified vendor snapshots. --offline prevents downloads and uses local sources, existing cache, or vendor. --frozen additionally requires matching lock entries and prevents dependency cache or lock updates. Local file: dependencies must first be installed as vendor snapshots.

xu install app
xu check app/main.xu --offline
xu build app/main.xu --frozen --output app/program

Dependency freezing constrains dependency content; it does not freeze your own project sources or build output. Keep the reviewed xu.lock with the project and investigate content mismatches.

0.8.3: MVS, proxies, and concurrent transactions

External modules can declare exact SemVer minimum requirements. The compiler reads all reachable version manifests and uses MVS to choose the highest minimum requirement for each module. It does not query latest or interpret version ranges. Version graphs use v3 locks, and vendor retains all reachable version snapshots for offline replay.

XUPROXY accepts HTTP(S), absolute file:// URLs, direct, and off. A comma falls back only on 404/410; a vertical bar permits fallback on request errors. Identity or integrity mismatches always fail. XUPRIVATE and XUNOPROXY control proxy bypass for private paths. Dependency resolution, lock merging, and shared downloads use kernel locks.

0.8.4: trusted-key checksum-log verification

XUSUMDB configures a trusted Ed25519 verifier key and optional service URL. For canonical SemVer modules, the client verifies the signed tree head, module digest, record inclusion, and append consistency before accepting a cache or lock entry. Existing cache, vendor, and version snapshots follow the same authentication policy.

XUNOSUMDB controls checksum bypass independently and defaults to XUPRIVATE. Unset/off XUSUMDB retains first-use trust. Configured authentication failures do not downgrade automatically; offline and frozen builds require previously verified proofs.

A public Xu checksum service, independent cross-client witnesses, vanity repository discovery, and power-loss durability remain pending. Local consistency verification does not replace those services or establish that module sources are free of malicious behavior.

Documentation and ecosystem progress

This website refresh covers installation, CLI commands, dependencies, tutorial paths, and platform boundaries. The API index includes 128 standard-library/UI packages and 29 external packages. Declarations, indexes, and counts now share one generation workflow. Concrete service drivers live in the separate packages root module, whose version remains independent of Xu.

Modules and dependencies · packages 0.1.1 · API index · Status & Limitations