Stitch
Press payload images and a loader into one executable. Fat packages carry the runtime as a slot; lean packages resolve it on first run.
CAPABILITIES
Six things the box does.
Tebako is a packaging and loading ecosystem. These are its six core capabilities — the same six for a Ruby application, a font collection, or a native toolchain.
Load
Payloads mount — recursively, if they declare it — into one virtual filesystem per process, then control transfers to the declared entrypoint.
Share
Runtimes and payloads download once into a machine-wide content cache, sha256-verified. Every package on the machine reuses them.
Shim
Every executable an installed payload provides becomes a registered command on PATH, with a version chain resolved per invocation.
Jail
A declarative host-filesystem policy per run, enforced by the VFS layer. The filesystem view is read-only unless you grant more.
Trust
Signing and encryption are opt-in per package; verification of signed artifacts is always strict. Unsigned stays first-class.
THE GROUND THEY STAND ON
Built to be boring.
Three properties hold for everything tebako ships — they are invariants, not features.
Any payload
Application code, data, fonts, native tools, runtimes themselves — all images of one kind, differing only in what their manifests declare.
Seven triplets
aarch64 and x86_64 macOS, gnu and musl Linux, Windows UCRT. Native payloads press per triplet; pure-language payloads can ship universal.
No shell-outs
HTTP, imaging, and crypto all run in-process inside the shipped binaries. Nothing shells out to curl, git, or a system tool — no system dependencies, ever.