Skip to content
Muamba

Get started

Pin remote assets once, enforce their identity everywhere after.

Requirements and installation

Muamba requires Go 1.26.5 or newer. Pin the command in your consumer module as a Go tool:

Install 
go get -tool github.com/araihu/muamba/cmd/muamba@v0.0.2
go tool muamba help

Write a manifest

One resource groups every artifact that moves under the same logical version. Paths remain explicit and reviewable.

muamba.yaml 
schema: 1

resources:
  bootstrap:
    version: "5.3.8"
    downloads:
      bundle-js:
        url: https://unpkg.com/bootstrap@${version}/dist/js/bootstrap.bundle.min.js
        path: assets/vendor/bootstrap/${version}/bootstrap.bundle.min.js
      core-css:
        url: https://unpkg.com/bootstrap@${version}/dist/css/bootstrap.min.css
        path: assets/vendor/bootstrap/${version}/bootstrap.min.css
      license:
        url: https://unpkg.com/bootstrap@${version}/LICENSE
        path: assets/vendor/bootstrap/${version}/LICENSE

${version}is the only template token. Strict mode rejects expanded URLs that do not contain the exact declared version.

Establish and enforce trust

1. Lock reviewed sources

First trust 
go tool muamba lock --strict

Lock downloads every unlocked URL and platform variant, stores verified bytes, and writes SHA-384 SRI values atomically.

2. Verify offline

Read-only verification 
go tool muamba verify --strict

Verification reads committed files and integrity cache blobs without network access.

3. Restore known bytes

Materialize 
go tool muamba sync --strict

Sync repairs missing or corrupt destinations only when cached or remote bytes match the lock.

Use the integrity cache

Cache identity is the parsed algorithm and digest—not URL, version, or resource name. Identical locked bytes deduplicate safely.

CI 
go tool muamba sync --strict \
  --target linux/amd64 \
  --cache-dir .cache/muamba

Generate a Go embed registry

Generate one deterministic registry for each package that owns vendored files. The output exposes resources, files, original integrity, and normalized hashes.

Generate 
go tool muamba generate-go \
  --strict \
  -f muamba.yaml \
  --dir assets \
  --output muamba_gen.go
Use 
hash, ok := assets.MuambaHash("bootstrap", "core-css")
if !ok {
	return errors.New("bootstrap/core-css is not embedded")
}
stylesheetURL := "/assets/bootstrap.css?v=" + url.QueryEscape(hash)

Continue

Read the full command and manifest reference in the repository README, including platform maps, selectors, max sizes, updates, and failure guarantees.

Open the complete reference on GitHub.