The reference implementation is a single-file executable.
A dk0 shell script (Unix) and a
dk0.cmd Windows batch script are also available that bootstrap and run the single-file executable.
They rely on a small set of external tools per platform; a different implementation may
use different tools or none at all.
Each dk0 version installs into its own dk0exe-<version>-<abi> directory
under the launcher data home (%LOCALAPPDATA%\Programs\dk0 on Windows,
$XDG_DATA_HOME/dk0 or ~/.local/share/dk0 on Unix, DKCODER_DATA_HOME
override). The launchers garbage collect that store on every run: the
version being launched is marked used, then version directories and
superseded verifier/mlfront-signify-* binaries that no launcher has used
in 30 days are removed. Everything in the store re-downloads on demand from
its signed manifest, so pruning is always safe and never blocks a launch.
| File | What |
|---|
pwsh in PATH | enter-object interactive shell (optional; searched 1st) |
powershell in PATH | enter-object interactive shell (optional; searched 2nd) |
cmd in PATH | enter-object interactive shell (fallback; searched last) |
powershell.exe in PATH | dk0.cmd batch script - for InvokeWebRequest (optional; searched 1st) |
bitsadmin in PATH | dk0.cmd batch script - for download (fallback; searched last) |
certutil in PATH | dk0.cmd batch script - verify sha256sums |
forfiles in PATH | dk0.cmd batch script - prune old dk0 versions (optional) |
| File | What |
|---|
/usr/bin/codesign | executables are locally signed when -e GLOB_PATTERN |
/bin/sh | enter-object interactive shell unless SHELL env var set |
/bin/sh | dk0 shell script |
/usr/bin/shasum | dk0 shell script |
/usr/bin/curl | dk0 shell script (optional; searched 1st) |
/bin/curl | dk0 shell script (optional; searched 2nd) |
/usr/bin/wget | dk0 shell script (optional; searched 3rd) |
/bin/wget | dk0 shell script (fallback; searched last) |
/usr/bin/mv | dk0 shell script (optional; searched 1st) |
/bin/mv | dk0 shell script (fallback; searched last) |
/usr/bin/rm | dk0 shell script (optional; searched 1st) |
/bin/rm | dk0 shell script (fallback; searched last) |
/usr/bin/uname | dk0 shell script (optional; searched 1st) |
/bin/uname | dk0 shell script (fallback; searched last) |
/usr/bin/awk | dk0 shell script - to parse sha256sums (optional; searched 1st) |
/bin/awk | dk0 shell script (fallback; searched last) |
| File | What |
|---|
/bin/sh | enter-object interactive shell unless SHELL env var set |
/bin/sh | dk0 shell script |
/usr/bin/shasum | dk0 shell script (optional; searched 1st) |
/usr/bin/sha256sum | dk0 shell script (fallback; searched last) |
/usr/bin/curl | dk0 shell script (optional; searched 1st) |
/bin/curl | dk0 shell script (optional; searched 2nd) |
/usr/bin/wget | dk0 shell script (optional; searched 3rd) |
/bin/wget | dk0 shell script (fallback; searched last) |
/usr/bin/mv | dk0 shell script (optional; searched 1st) |
/bin/mv | dk0 shell script (fallback; searched last) |
/usr/bin/rm | dk0 shell script (optional; searched 1st) |
/bin/rm | dk0 shell script (fallback; searched last) |
/usr/bin/uname | dk0 shell script (optional; searched 1st) |
/bin/uname | dk0 shell script (fallback; searched last) |
/usr/bin/awk | dk0 shell script - to parse sha256sums (optional; searched 1st) |
/bin/awk | dk0 shell script (fallback; searched last) |
/usr/bin/cygpath | dk0 shell script (optional) |
The tables above list files that vary by operating system. The dynamic linker
is the exception: it varies by ABI. A dynamically linked executable names
its loader by absolute path in its ELF PT_INTERP header, so that exact path
must exist to run objects of that ABI. Statically linked objects carry no
PT_INTERP and need no loader; the Linux_x86_64_musl dk0/dk1 launchers
are static for this reason. The loader is normally supplied by the host's own
libc, and must be provided explicitly only when objects of one ABI run on a
host of another - for example Linux_x86_64_musl objects on a glibc host.
| ABI | File | What |
|---|
Linux_arm64 | /lib/ld-linux-aarch64.so.1 | glibc dynamic linker for dynamically linked objects |
Linux_x86 | /lib/ld-linux.so.2 | glibc dynamic linker for dynamically linked objects |
Linux_x86_64 | /lib64/ld-linux-x86-64.so.2 | glibc dynamic linker for dynamically linked objects |
Linux_x86_64_musl | /lib/ld-musl-x86_64.so.1 | musl dynamic linker for dynamically linked objects |
The published Linux binaries are built on manylinux_2_28 container images,
so the glibc ABIs run on any distribution carrying glibc 2.28 or newer. The
Linux_x86_64_musl binaries are statically linked and carry no libc floor.
| ABI | Minimum libc |
|---|
Linux_arm64 | glibc 2.28 |
Linux_x86 | glibc 2.28 |
Linux_x86_64 | glibc 2.28 |
Linux_x86_64_musl | none (statically linked) |
Slot artifacts that contain native code are built with one system toolchain
per ABI family. This section is the contract for where that toolchain comes
from and what compatibility floor the built artifacts inherit.
| ABI family | System toolchain | How it is located |
|---|
Linux_* (glibc) | gcc, as, binutils | resolved from PATH at build time |
Linux_*_musl | x86_64-linux-musl-* cross toolchain | bundled inside the slot |
Windows_* | MSVC | at consume time: vswhere, then vcvarsall capture |
Darwin_* | /usr/bin/clang | fixed path (Xcode Command Line Tools) |
Linux_* (glibc): distribution builds must run in a glibc 2.28 build
environment, canonically the quay.io/pypa/manylinux_2_28_* containers,
so slot artifacts run on any distribution carrying glibc 2.28 or newer.Linux_* (glibc): glibc links are backward-compatible only, so a build
on a newer-glibc host inherits that host's glibc floor. Such builds work
for local use (the DkML compiler is relocatable as of CommonsLang_OCaml
release 0.1.20260820083108), and a newer-glibc host can never
produce distribution-grade artifacts natively.Linux_* (glibc): runtime objects are compiled as position-independent
code, so native links succeed under PIE-default toolchains.Linux_*_musl: the slot bundles its cross toolchain (bare
x86_64-linux-musl-* tool names plus dispatch shims) and its output is
statically linked.Windows_*: MSVC is the sole official Windows slot toolchain. vswhere
finds the Visual Studio installation, a vcvarsall environment capture
supplies INCLUDE, LIB, LIBPATH and PATH, and the slot to
vcvarsall architecture mapping is the CommonsLang_OCaml table
assets/table/msvc-arch/Release.<slot>.
CommonsBase_LLVM.Toolchain.MinGW is a cross toolchain for building C
userland packages.Darwin_*: /usr/bin/clang is the xcode-select trampoline installed
with the Xcode Command Line Tools.- Per-ABI build-environment conformance checks run once, in the shared
diskuv/dk-distribute action that every dk package's distribute
workflow invokes, before the distscript executes. A published
attestation therefore implies the build environment conformed; the
combine job's file-based architecture check on the produced binaries
is the post-build complement.