Claude
03027f9769
Ruled by Captain Bob, 2026-11-07: "New root CA on the CI box. Valid StarshipOS rather than snake oil intermediate." - ci/pki/make-ca.sh makes the StarshipOS Root CA (its key stays on the CI box) and the StarshipOS Capsule Signing intermediate it issues, and stores the signing key as the secret CAPSULE_SIGN_KEY. - The kernel finds the signing certificate by one name, CAPSULE_SIGNING_CERT_NAME = pki:starshipos-intermediate.der. The certificate itself lands once make-ca.sh has run; until then the snakeoil intermediate is in the tree under its old name and the capsules check as "no root key" (a warning, as "missing" was). - mkcapsule refuses a signing key that is not that certificate's. - SIGN_KEY has no default; acceptance, build, nightly and release set it from the secret. FABRIC-3.md XLVI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2
tools/
Build-time and integration-test utilities for the StarForth / LithosAnanke toolchain.
Contents
| File | Purpose |
|---|---|
mkcapsule.c |
Assembles .4th capsule files into capsule_generated.c baked into the kernel image. Invoked automatically by kernel/Makefile. |
mkcapsule |
Compiled host binary (rebuilt on demand). |
ttftest.c |
Host TTF glyph-rendering test — font rasterization unit tests, no QEMU needed. |
pe_reloc_gen.py |
Generates PE32+ relocation tables for the UEFI loader. |
svg_to_png.py |
Renders every tracked .svg in the repo to a same-named .png via headless Chromium; leaves the source .svg untouched, run manually. |
hermes_smoke.sh |
Hermes v1 hosted smoke test — swaps in the Hermes init capsule and prints values for manual inspection. |
hermes_channel_smoke.sh |
Exercises the full Hermes channel-negotiation lifecycle (CH-REQUEST → CH-ACCEPT → CH-CLOSE → reap) per the protocol in .claude/HERMES.md. |
hermes_tripod_smoke.sh |
Full Tripod integration test — exercises all 6 inter-VM message paths using the DEFER VM-EXEC/IS VM-EXEC dispatcher shim from init.4th. |
kconfig/ |
Vendored Linux kernel Kconfig tooling (conf/mconf/qconf), GPL-2.0. See tools/kconfig/README.md. |
mkcapsule
# Invoked automatically by the kernel build:
make -f kernel/Makefile ARCH=amd64 clean qemu
# Manual invocation (for inspection):
./tools/mkcapsule capsules/ build/amd64/kernel/capsule_generated.c
Scans capsules/ for .4th files, computes XXHash64 per capsule, assigns
type (m) to init.4th and (p) to everything else.
See also
capsules/README.md— capsule file format and block namespacekernel/Makefile— kernel build system- Project root