📦 Basilisk Bottles (basilisk-mpm/bottles)

This repository functions as the official binary bottle storage and distribution registry for the Basilisk package manager (bsk).

Instead of hosting thousands of individual repositories, all pre-compiled package archives (.tar.zst) are centrally stored within this repository's GitHub Releases. The Rust Core (basilisk) fetches these zero-dependency, relocatable archives directly via high-speed global CDN endpoints.

---

⚡ How Bottles Work

Every bottle is a hermetically sealed, relocatable archive compressed with high-ratio zstd.

[https://github.com/basilisk-mpm/bottles/releases/download/](https://github.com/basilisk-mpm/bottles/releases/download/){pkg_name}-{version}/{pkg_name}-{version}-{arch}.tar.zst

• Relocatable Binaries: Binaries inside these bottles use strictly relative @loader_path and @rpath shared library references. They extract directly into ~/.rmp/store/<hash>/ and run natively without needing /usr/local or /opt/homebrew.
• Zero-System-Touch: Installing a bottle requires no sudo access, making it 100% safe for restricted corporate workstations.
• Deterministic Verification: Every archive is hashed (SHA-256) and cryptographically signed to ensure zero tampering or corrupt downloads.

---

🏷️ Asset Naming & Release Conventions

Releases in this repository follow a deterministic tagging structure:

Element	Format / Example
Release Tag	{package_name}-{version} (e.g., nginx-1.25.3)
Apple Silicon Asset	nginx-1.25.3-aarch64-apple-darwin.tar.zst
Intel Mac Asset	nginx-1.25.3-x86_64-apple-darwin.tar.zst
Signature File	nginx-1.25.3-aarch64-apple-darwin.tar.zst.sig

---

🛡️ Trust & Security Model

All official releases are automatically built in clean, isolated macOS GitHub Actions runners triggered directly by approved Pull Requests in basilisk-mpm/recipes.

[ Pull Request Merged ] ──> [ Clean macOS CI Runner ] ──> [ Build & Sign ] ──> [ Upload to Releases ]

• CI Signed (Official): Bottles compiled by our official GitHub Actions bot are signed using the basilisk-mpm core release key.
• Community Share: Packages contributed via bsk share carry individual developer key signatures, allowing granular security policy toggling in ~/.bsk/config.toml.

---

📄 License

Individual binary packages distributed via these releases inherit their respective open-source licenses. The automation code and metadata in this repository are licensed under the MIT License.