boxlang-runtime-compiled-native-binaries — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-runtime-compiled-native-binaries (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MatchBox can compile BoxLang source code to standalone native executables using --target native. The resulting binary embeds a small Rust runner stub (~500 KB) with the compiled BoxLang bytecode appended, requiring no JVM or MatchBox installation on the target machine.
# Compile script to a native executable (same OS/arch as build machine)
matchbox --target native app.bxs
# Output: ./app (or app.exe on Windows)
# Run it
./app --config=prod.json --debugThe binary accepts the same CLI argument format as the matchbox runner.
Build for multiple platforms using GitHub Actions (recommended) or the cross Rust tool:
# .github/workflows/release.yml
name: Build Native Binaries
on:
push:
tags: ["v*"]
jobs:
build:
strategy:
matrix:
include:
- os: ubuntu-latest
target: x86_64-unknown-linux-gnu
artifact: app-linux-x64
- os: ubuntu-latest
target: aarch64-unknown-linux-gnu
artifact: app-linux-arm64
- os: macos-latest
target: x86_64-apple-darwin
artifact: app-macos-x64
- os: macos-latest
target: aarch64-apple-darwin
artifact: app-macos-arm64
- os: windows-latest
target: x86_64-pc-windows-msvc
artifact: app-windows-x64.exe
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- name: Install MatchBox
run: curl -sSL https://raw.githubusercontent.com/ortus-boxlang/matchbox/master/install/install.sh | bash
- name: Compile
run: matchbox --target native --arch ${{ matrix.target }} app.bxs -o ${{ matrix.artifact }}
- uses: actions/upload-artifact@v4
with:
name: ${{ matrix.artifact }}
path: ${{ matrix.artifact }}cargo crosscargo install cross
# Linux ARM64 from macOS or Linux x64
cross build --release --target aarch64-unknown-linux-gnuThe default release binary is ~500 KB. You can reduce further with these Rust profile settings in Cargo.toml:
[profile.release]
opt-level = "z" # Optimize for size (not speed)
lto = true # Link-time optimization
codegen-units = 1 # Single codegen unit (better LTO)
strip = true # Strip debug symbols from binaryNative Fusion lets you write Rust functions and expose them as BoxLang BIFs inside a native binary. This is for performance-critical operations that can't be done efficiently in BoxLang:
// src/main.rs
use matchbox_sdk::prelude::*;
fn fast_hash(value: &str) -> String {
// your Rust implementation
format!("{:x}", md5::compute(value))
}
fn main() {
let engine = MatchBoxEngine::new()
.register_bifs(vec![
bif!("FastHash", fast_hash)
])
.run_file("app.bxs");
}// app.bxs — calls the Rust BIF
var hash = FastHash( "hello world" )
println( hash )Build as a combined Rust + BoxLang executable:
cargo build --release
# Output: target/release/myappmatchbox --target native app.bxs -o myapp
# Distribute: just the `myapp` file, no dependencies neededFROM scratch
COPY myapp /myapp
ENTRYPOINT ["/myapp"]Results in an image with only the executable — < 1MB total.
matchbox app.bxs (interpreted) before compiling to nativeopt-level="z", lto=true, strip=true for minimal binary sizeFROM scratch Docker images for microservice deployments~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.