01
A machine contract.
Architecture, instruction-set requirements, operating system, and object format describe where the code can run.
archISAOSformatAN OPEN SOURCE PROJECT
Packages for
assembly.
Build assembly projects with the target and interface spelled out.
The CLI is written in assembly and runs on Linux x86_64. It checks locked package files before each build.
EARLY ALPHALinux x86_64 host · exact package versions
Linux x86_64 / GNU assembler
YOUR FIRST PROJECT
0101
Create a project
./build/asm new hello02
Build the program
cd hello
../build/asm build03
Run it
../build/asm runHello from asm!Run these commands after you build the CLI.
01 Assembly at the core
02 Targets before assumptions
03 Evidence with a scope
GET STARTED
Build the CLI.
Use Linux x86_64 with Git, GNU Make, and GNU binutils. Build the CLI, then run the first-project commands above.
BUILD FROM SOURCE
# Linux x86_64 · Git, Make, and GNU binutils
git clone https://github.com/stubbi/asm.git
cd asm
make
./build/asm --helpInstall the command from your source build
Run these commands from the ASM repository root. The installer refuses to replace a different existing command.
Install for your user account
make install PREFIX="$HOME/.local"
export PATH="$HOME/.local/bin:$PATH"
asm versionThe PATH change applies to this terminal. Registry commands need curl and sha256sum. Source dependencies also need gzip.
Read the installation guideThe CLI uses /usr/bin/curl, /usr/bin/sha256sum, and /usr/bin/gzip for registry operations. A package target is separate from the CLI host.
PACKAGE REGISTRY
Inspect a package.
Read the source, check the target, and inspect the release records. This catalog uses the published registry index.
Package names and versions come from the registry records.
You can also browse the CLI source and the hello example on GitHub.
A checksum checks file integrity. Review the source and evidence before you run a package.
THE PACKAGE MODEL
The target is part
of the package.
A useful assembly routine should be easy to reuse. Its package must state which machine it supports and how other code can call it.
02
An interface contract.
The application binary interface (ABI) defines calls and data layout. Packages also state symbol names, memory ownership, and register use.
ABIsymbolsownership03
A record of the build.
Declared tools, pinned inputs, and recorded outputs give consumers something concrete to reproduce and review.
toolchaininputsdigestsTHE VERIFICATION MODEL
Show the evidence.
Each security claim must name the version, target, and assumptions it covers. Consumers need access to its reports and artifacts.
Read the security modelHosted proof and analysis services are planned.
Each release lists its current checks.
01
Provenance
Who published the package, which source produced it, and which build process was used.
Identity + origin02
Scanning
Reports from named tools, with their versions, findings, and coverage available for review.
Tool + ruleset + findings03
Testing
Recorded results for defined inputs and targets, including boundary cases and ABI behavior.
Cases + environment + results04
Scoped proofs
Specific properties, explicit assumptions, and machine-checkable artifacts where the tooling supports them.
Property + assumptions + checkerWHY ASM
Make the useful
work reusable.
Software should work well for its users and cost less to run. Assembly can give developers direct control over how a machine does that work.
Our working assumption is that AI-assisted development may make assembly practical for more projects. It may also reduce the cost of ports. Both claims need evidence.
Generated code still needs review and verification. Performance claims need reproducible measurements, including results that show no improvement. ASM is building the shared package, release, and evidence tools for that work.
Read the project motivationA measured example
An asmwc experiment measured default counting on a 128 MiB text file. On Apple M3 with macOS 15.6.1, median time was 15.234 ms for optimized assembly and 68.468 ms for native Rust. Each implementation had 24 samples with a warm file cache. The comparison includes algorithm, I/O, and startup differences. ASM checked the published records; we have not reproduced the experiment.
Read the experiment and its limitsBUILT IN THE OPEN
What comes next.
The first release covers local projects and exact dependencies. The next work is broader resolution, more hosts, and hosted verification.
- NOW01
CLI foundation
A native assembly executable, local project commands, and a format for package records.
- NOW02
Exact dependencies
Locked versions, checked source files, native executable installs, and reproducible release artifacts.
- PLANNED03
Registry operations
Authenticated publication, ownership controls, account recovery, and dependency range resolution.
- RESEARCH04
Deeper assurance
Clients for more hosts, isolated analysis, and scoped proof checks for supported routines.
CONTRIBUTE