stubbi/asm

What Asm does

Asm is a package registry plus command-line tool for assembly projects. It gives assembly code the workflow that higher-level languages already have: named packages with explicit machine targets, repeatable builds, dependency locking, executable installation, and release records that carry verification evidence. It targets developers experimenting with direct instruction and memory control and teams that want to distribute assembly artifacts in a structured way. The 0.6.0 release adds named per-target implementations, standalone Linux cross builds, and target-specific dependency locks. See the why Asm reasoning for the design rationale and the security model for how artifact checks, provenance, proofs, and agent reviews are distinguished.

The CLI itself is written in assembly and uses system tools for assembling, linking, transport, and cryptographic checks. Python handles registry operations and the MCP protocol adapter; JavaScript supports the website.

Quick start

Asm 0.6.0 supports Linux x86-64, Linux ARM64, and Apple Silicon macOS 15 or later. Install GitHub CLI 2.93.0+ first: on Linux gh must be at /usr/bin/gh along with curl and GNU Coreutils; on Apple Silicon it must be at /opt/homebrew/bin/gh.

curl -qfsS -m120 https://asm.build/install.sh | sh

Apply the PATH command the installer prints (or export PATH="$HOME/.local/bin:$PATH"), then verify:

asm version

On Apple Silicon the output is asm 0.6.0 (aarch64-macos). The installer source and self-update requirements are available for inspection.

Install GNU Binutils on Linux (the binutils package on Debian/Ubuntu) or Xcode Command Line Tools on macOS (xcode-select --install). Then create and run a project:

asm doctor &&
asm new hello &&
cd hello &&
asm run &&
asm test

The program prints Hello from asm!. The generated project contains asm.toml, src/main.s, and tests/main.s; asm build assembles and links to build/app, asm run also executes it, and asm test builds and runs the test file, with a zero exit code as pass.

Projects and packages

asm.toml declares the package name, version, source file, and target. asm new picks the host target (x86_64-linux, aarch64-linux, or aarch64-macos). For multi-target projects, use targets/<id>/ directories and [target.<id>] sections; asm build --target riscv64-linux produces a separate Linux artifact and asm test --target riscv64-linux --no-run builds its test without executing. Cross-target native-library linking is not supported.

The registry supports search, version inspection, source download, and executable install:

asm search hello
asm info stubbi/hello
asm versions stubbi/hello
asm fetch stubbi/hello@0.6.0 --target x86_64-linux --kind source
asm install stubbi/hello@0.6.0
asm installed
asm upgrade stubbi/hello
asm uninstall stubbi/hello

asm fetch verifies size and SHA-256. asm install places the executable in $HOME/.local/bin; --output PATH selects another destination, which must be a new file. One package identity can have at most one managed installation. Source dependencies use exact versions: asm add stubbi/math@0.6.0 --target x86_64-linux then asm lock. Commit asm.lock; asm sync restores dependencies and asm build --locked enforces the lock. See the installed-program contract and the complete package example.

Constraints and status

Asm is an early alpha. Transitive dependencies, self-service publication, account recovery, isolated public build workers, and hosted formal verification are still planned; publication currently goes through reviewed pull requests to the registry. The hosted registry and MCP deployment remain under qualification. Published 0.4.0 binaries lack the install-management commands, and updating Asm does not adopt earlier installations. The CLI is licensed AGPL-3.0-or-later; starter code and reference examples are MIT, while packages keep their own declared licenses. Use asm license or see the license scope.

HotRepo's take

The project appeared on the new-project board on 2026-11-05, gaining 52 stars in a roughly two-hour window and reaching 179 stars with zero forks. That is a short observation window on a newly created project, so it tells us the repository drew early attention, not that the ecosystem or tooling has been validated. The substance to watch is the explicit alpha limitations: single-version source dependencies, pull-request publication, and qualification still pending for the hosted registry.