Bump the sigil pins to ^0.19; the 0.17 reason has expired

Message

The pin carried its own justification:

  sigil-tls's native codegen needs the 0.17 runtime headers.

Measured on host sigil 0.19.2, two isolated git archive trees differing only in these four pins:

  ^0.17:  libsigil-tls.a builds, 164998 B   sigil test FAILS
  ^0.19:  libsigil-tls.a builds, 165542 B   sigil test 19/19 passes

The library builds either way, so the pin does not protect what it names. What it does do is break the test harness: at ^0.17 the dev-deps resolve to sigil-test-runner 0.17.17, whose core.sgb is bytecode v10, while a 0.19 host emits v11, and sigil test dies with "unsupported bytecode version 11 (expected 10)" before running anything.

sigil-crypto carries the same paragraph with one noun swapped and was measured the same way with the same result (100/100 at ^0.19, identical bytecode error at ^0.17). Two packages, two very different C surfaces -- 165 KB of TLS bindings against 5.9 MB of vendored mbedTLS -- and the same verdict, which is what makes this a class rather than a per-package quirk.

Caveat worth keeping: this package's own green rests on a product-layer sabotage control taken in sigil-crypto (sha256 broken -> 97 passed / 3 failed, attributed to exactly the sha256 cases). No separate sabotage arm was run against these 19 tests.

Patch, not minor: raising a toolchain floor looks like a compatibility change, but every consumer it could break is already broken, since ^0.17 is what makes sigil test fail on a 0.19 host. A defect is removed; no working thing stops working.

Evidence: topics/sigil-crypto-017-pin-does-not-protect-native-codegen

Changed

 package.sgl | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

Diff

package.sglmodified

@@ -9,8 +9,8 @@

(package

name: "sigil-tls"

−12

version: "0.16.5"

−13

sigil: "^0.17"

+12

version: "0.16.6"

+13

sigil: "^0.19"

description: "TLS/SSL connections for Sigil"

url: "https://codeberg.org/sigil/sigil-tls"

license: "BSD-3-Clause"

@@ -18,16 +18,26 @@

dependencies: (list

;; Explicit sigil-lib pin: overrides the extraction-era implicit

−21

;; sigil-stdlib/sigil-lib (^0.15 from the retired sigil-lang repo)

−22

;; that the reintegrated monorepo test-runner chain would otherwise

−23

;; derive. sigil-tls's native codegen needs the 0.17 runtime headers.

+21

;; sigil-stdlib/sigil-lib (^0.15 from the retired sigil-lang repo) that

+22

;; the reintegrated monorepo test-runner chain would otherwise derive.

+23

;;

+24

;; Was ^0.17, justified as "sigil-tls's native codegen needs the 0.17

+25

;; runtime headers". Measured 2026-08-24 on host sigil 0.19.2, two

+26

;; isolated trees differing only in these pins: libsigil-tls.a builds

+27

;; BOTH ways (164998 B at ^0.17, 165542 B at ^0.19). sigil-crypto's

+28

;; identical pin was measured the same way with the same result. See

+29

;; topics/sigil-crypto-017-pin-does-not-protect-native-codegen.

(from-git url: "codeberg:sigil/sigil"

−25

package: "sigil-lib" version: "^0.17")

+31

package: "sigil-lib" version: "^0.19")

(from-git url: "codeberg:sigil/sigil-crypto" version: "^0.16"))

+34

;; These must track the host runtime. At ^0.17 they resolved to

+35

;; sigil-test-runner 0.17.17, whose core.sgb is bytecode v10, and a 0.19

+36

;; host emits v11: `sigil test` died with "unsupported bytecode version 11

+37

;; (expected 10)" before running anything. At ^0.19: 19/19 pass.

dev-dependencies: (list

−29

(from-git url: "codeberg:sigil/sigil" package: "sigil-test" version: "^0.17")

−30

(from-git url: "codeberg:sigil/sigil" package: "sigil-test-runner" version: "^0.17"))

+39

(from-git url: "codeberg:sigil/sigil" package: "sigil-test" version: "^0.19")

+40

(from-git url: "codeberg:sigil/sigil" package: "sigil-test-runner" version: "^0.19"))

;; Native library definition

;; Note: mbedTLS headers/libs come from sigil-crypto dependency — the