Docs / On-chain builds / Publishing to a registry

Publishing to a registryalpha

Publish a wasm to an ICRC-118 registry with its build record, so installers can see whether it was built on-chain.

moxzi publish uploads a wasm to an ICRC-118 registry, together with where it came from: the build record from the compiler canister, the source repository and commit, and the version it upgrades. The registry then asks the compiler canister whether it built those exact bytes.

The reference registry is l55bi-3aaaa-aaaai-atk4a-cai, with a web interface at https://registry.astroflora.xyz.

Before you publish#

You need	How to get it
A namespace, such as `com.example.myapp`	Claim the domain (`example.com`) in the registry's domain registry and prove it with a DNS TXT record at `_icrc86.example.com`. All namespaces under the domain are then yours
Storage	Buy storage on the registry. Uploads are charged against it

Both are on the registry's Publishing access page. If one is missing, the registry's error says which.

Publish#

Build on-chain, then publish with --canister so the entry carries the build record:

moxzi build src/Main.mo --remote https://icp-api.io --canister xcn6l-iqaaa-aaaai-raq6q-cai
moxzi publish src/Main.wasm --remote https://icp-api.io \
  --registry l55bi-3aaaa-aaaai-atk4a-cai \
  --namespace com.example.myapp --version 1.0.0 \
  --canister xcn6l-iqaaa-aaaai-raq6q-cai

--dry-run shows what would be sent without sending anything:

moxzi publish hello.wasm --remote https://icp-api.io \
  --registry l55bi-3aaaa-aaaai-atk4a-cai \
  --namespace com.example.hello --version 1.0.0 --dry-run

repo            (none: not a git checkout, and --repo not given)
commit          (none: not a git checkout, and --commit not given)
no --canister given: publishing WITHOUT a build attestation (the entry will carry only the hashes computed here)

publishing hello.wasm
  registry   l55bi-3aaaa-aaaai-atk4a-cai
  namespace  com.example.hello
  version    1.0.0
  bytes      246457 in 1 chunk(s)
  sha256     374d6d0c1879373a1e9fc4808b7a7936caf3eacc5ef7ee6c8d549120a1308f6d
  repo       (none)
  commit     (none)
  previous   (none -- this version will be a root of its upgrade path)

--dry-run: nothing was sent

Option	Effect
`--canister ID`, `--job N`	The compiler canister and build to attach. Without `--canister`, the entry has only the hashes computed locally
`--previous VERSION`	The version this one upgrades. Its hash is read from the registry
`--repo URL`, `--commit HASH`	Recorded on the entry. Taken from the git checkout when you're in a clean one
`--create`, `--name NAME`	Create the namespace if it doesn't exist
`--description TEXT`	What this version is

moxzi deprecate marks a version as superseded without removing it.

The verdict#

After uploading, the registry asks the compiler canister whether it linked a module with this hash, and records the answer. moxzi publish prints it:

Verdict	Meaning
`verified`	The compiler canister built and linked exactly these bytes
`unverified`	It didn't. Locally built wasm, and on-chain builds changed after linking, are published as unverified
`DIVERGENT`	Someone has filed a divergence report against this version that hasn't been resolved

Anyone can repeat the check: the compiler canister's attestLinked(sha256) query returns the build record for a linked hash, or null.

What can't be verified#

Build	Why
`--compact-rts`	Linked for off-chain runtimes. `publish` refuses it unless you pass `--allow-offchain`
`--ephemeral`, `--actor-max-pages`, `--top-max-pages`	These change the module after the compiler links it, so it no longer matches