Opaque by design
No package-manager assumptions. Muamba treats every download as bytes plus a reviewed source and integrity lock.
Language-agnostic TOFU vendoring
Trust remote files once. Verify them forever.
Muamba vendors JavaScript, CSS, licenses, source maps, executables, and other opaque release artifacts. Review the source once, lock SHA-384 integrity, then build and test without network access.
Install Muamba
go get -tool github.com/araihu/muamba/cmd/muamba@v0.0.2muamba.yamlSHA-384 locked
Manifest
schema: 1
resources:
alpine:
version: "3.14.9"
downloads:
runtime:
url: https://unpkg.com/alpinejs@${version}/dist/cdn.min.js
path: assets/vendor/alpine/${version}/alpine.min.js
integrity: sha384-…Typed manifest in. Verified bytes out.
One manifest, explicit trust
A small workflow with a hard boundary.
Muamba never decides that changed bytes are trustworthy. Your manifest records the decision; every later command enforces it.
- 01
Lock
Review every URL, fetch each artifact, and write its SHA-384 integrity once.
- 02
Verify
Check committed files and cache blobs offline. Different bytes fail closed.
- 03
Sync
Restore only missing or corrupt files whose remote bytes still match the lock.
Designed for reproducible builds
Remote convenience, local certainty.
Atomic updates
Grouped dependencies stage every declared artifact before the manifest or visible files change.
Package-scoped embedding
Generate deterministic Go registries for vendored files, including normalized hashes for cache busting.
Platform-aware tools
Pin exact GOOS/GOARCH executables with shared destinations, size limits, modes, and per-target locks.
Start with one dependency