toollock

Overview ¶

Command toollock is the release-time generator for the managed analyzer toolchain of Section 11.7. It downloads every pinned upstream distribution, verifies the digest upstream publishes, runs the build steps a distribution needs (npm ci for the Node packages, a cross `go install` for the Go programs), normalizes each tree into a deterministic tar.gz, publishes the payloads as assets of a tools-v<n> release, and writes internal/toolchain/tools.lock.json.

It is never part of the shipped binary: the product only ever consumes the lock this program emits.

go run ./internal/tools/toollock                 # produce, publish, write the lock
go run ./internal/tools/toollock -check          # re-download every asset and confirm digests
go run ./internal/tools/toollock -tools joern    # limit to one tool