Commitdebba446Recorded24 Aug 2026Repositorysigil-crypto

Bump the sigil pins to ^0.19; the 0.17 reason has expired

Message

The pin carried its own justification:

  sigil-crypto's native codegen needs the 0.17 runtime headers to build
  libsigil-crypto.a.

Measured on host sigil 0.19.2, two isolated git archive trees differing only in these four pins:

  ^0.17:  libsigil-crypto.a builds, 5891408 B   sigil test FAILS
  ^0.19:  libsigil-crypto.a builds, 5891528 B   sigil test 100/100 passes

The library builds either way, so the pin does not protect what it names. What it does do is break the test harness: at ^0.17 the dev-deps resolve to sigil-test-runner 0.17.17, whose core.sgb is bytecode v10, while a 0.19 host emits v11, and sigil test dies with "unsupported bytecode version 11 (expected 10)" before running anything.

So the second half of the comment is inverted too. It warned that without these dev-deps a stale bundled (sigil crypto).sgb would be used; at ^0.17 the dev-deps ARE the staleness, one layer up. They are still needed -- at ^0.19.

The passing arm is underwritten by a product-layer sabotage control: with native/crypto.c:118 mbedtls_sha256_starts(&ctx, 0) changed to (&ctx, 1), the suite reports 97 passed / 3 failed, and the three are exactly the sha256 cases. A build failure or a harness that never ran would have reddened all 100 or none.

sigil-tls carries the same paragraph with one noun swapped and reproduces this result exactly (19/19 at ^0.19, same bytecode error at ^0.17) -- two different C surfaces, same verdict, which is what makes it a class rather than a quirk.

Patch, not minor: raising a toolchain floor looks like a compatibility change, but every consumer it could break is already broken, since ^0.17 is what makes sigil test fail on a 0.19 host. A defect is removed; no working thing stops working.

Evidence: topics/sigil-crypto-017-pin-does-not-protect-native-codegen

Changed
 package.sgl | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)
Diff
package.sglmodified
@@ -15,8 +15,8 @@
15
16
(package
17
name: "sigil-crypto"
−18
version: "0.16.4"
−19
sigil: "^0.17"
+18
version: "0.16.5"
+19
sigil: "^0.19"
20
description: "Cryptographic functions for Sigil (SHA, HMAC, ECDSA, ECDH, AES-GCM, HKDF, base64, random)"
21
url: "https://codeberg.org/sigil/sigil-crypto"
22
license: "BSD-3-Clause"
@@ -24,12 +24,17 @@
24
25
dependencies: (list
26
;; Explicit sigil-lib pin: overrides the extraction-era implicit
−27
;; sigil-stdlib/sigil-lib (^0.15 from the retired sigil-lang repo)
−28
;; that the reintegrated monorepo test-runner chain would otherwise
−29
;; derive. sigil-crypto's native codegen needs the 0.17 runtime
−30
;; headers to build libsigil-crypto.a.
+27
;; sigil-stdlib/sigil-lib (^0.15 from the retired sigil-lang repo) that
+28
;; the reintegrated monorepo test-runner chain would otherwise derive.
+29
;;
+30
;; Was ^0.17, justified as "sigil-crypto's native codegen needs the 0.17
+31
;; runtime headers to build libsigil-crypto.a". Measured 2026-08-24 on
+32
;; host sigil 0.19.2, two isolated trees differing only in these pins:
+33
;; libsigil-crypto.a builds BOTH ways (5891408 B at ^0.17, 5891528 B at
+34
;; ^0.19). The reason had expired. See
+35
;; topics/sigil-crypto-017-pin-does-not-protect-native-codegen.
36
(from-git url: "codeberg:sigil/sigil"
−32
package: "sigil-lib" version: "^0.17"))
+37
package: "sigil-lib" version: "^0.19"))
38
39
;; sigil-test + sigil-test-runner are required as dev-deps so
40
;; `sigil test` can build a test-harness binary that statically
@@ -38,9 +43,14 @@
43
;; sigil binary's bundled (and potentially stale) `(sigil crypto).sgb`
44
;; would be used instead of the local source, causing newer bindings
45
;; to surface as `unbound variable`.
+46
;;
+47
;; They must track the host runtime. At ^0.17 they resolved to
+48
;; sigil-test-runner 0.17.17, whose core.sgb is bytecode v10, and a 0.19
+49
;; host emits v11: `sigil test` died with "unsupported bytecode version 11
+50
;; (expected 10)" before running anything. At ^0.19: 100/100 pass.
51
dev-dependencies: (list
−42
(from-git url: "codeberg:sigil/sigil" package: "sigil-test" version: "^0.17")
−43
(from-git url: "codeberg:sigil/sigil" package: "sigil-test-runner" version: "^0.17"))
+52
(from-git url: "codeberg:sigil/sigil" package: "sigil-test" version: "^0.19")
+53
(from-git url: "codeberg:sigil/sigil" package: "sigil-test-runner" version: "^0.19"))
54
55
;; Native library definition
56
libraries: (list