bk

Documentation

Overview

Command bk is the pure-Go brewkit — a from-scratch reimplementation of pkgx's build tool that is Target≠Host by design (first-class cross-compile, notably Windows PE bottles built on a linux/darwin host).

This entrypoint currently exposes the pieces implemented so far:

bk target            print the resolved build target (honours BREWKIT_TARGET / --platform)
bk fixup <prefix>    run the post-build relocatability fix-ups on an install prefix
bk versions          list a recipe's candidate versions
bk build             build a recipe into a bottle
bk publish           push a built bottle to an OCI registry
bk closure           print a project set's transitive runtime closure (topological)
bk catalog           build (and publish, signed) the catalogue pkgx ls
                     and <TAB> read
bk runlog            read a factory job log: counts, stages, and whether
                     the parse agrees with bk's own totals
bk lock              resolve a set to the versions it means today, write them down, and --check them later
                     (-runnable pins what is PUBLISHED, so `pkgx --lock` can run the file)
bk factory           build a recipe set's whole closure and publish every bottle
bk source            fetch the source a published bottle attests it was built from
bk vulnid            say, per project, the name a vulnerability database will
                     accept — derived from the recipe, or declared in a table
bk advisories        validate a tree of per-project advisory records and say
                     what state each one is in
bk vulnfetch         ask OSV what it knows about a pantry, in one request,
                     and (with -write) record it as dated detections
bk attest            say what a PUBLISHED bottle carries — SBOM, provenance,
                     signature, OpenVEX — and --require it