v0.16.0 · x86-64 Linux and Windows

MoltoBuild-System, for C and C++.

One manifest, one command, no build script. Molto discovers your sources, resolves your dependencies at exact versions and drives the toolchain your project actually needs.

$ curl -fsSL https://moltobuild.dev/install.sh | sh

Get started View on GitHub

your first project


    
                $
                curl -fsSL https://moltobuild.dev/install.sh | sh
            
                
                  ==> pickup 0.3.3   checksum verified
            
                
                  ==> molto 0.16.0   checksum verified
            
                $
                molto new my_app && cd my_app
            
                $
                molto run
            
                
                Hello, world!

What you stop maintaining

Every feature below replaces something you would otherwise hand-write in a Makefile, a CMakeLists.txt or a CI script.

No file lists

Every .c, .cpp and .cc file under src/ and tests/ is compiled automatically. You never enumerate sources again — but your build settings stay explicit in the manifest, so nothing is ever guessed.

Exact dependencies

molto add fetches a package and pins it at an exact version. Ranges are refused, not interpreted: no release enters your build without a diff. Molto.lock records the whole graph with checksums.

Toolchains, resolved

Your manifest states the capabilities your code needs. pickup answers which local compiler provides them, and the answer is cached in the workspace — asked once, not on every build.

Format and lint included

molto fmt and molto lint drive clang-format and clang-tidy from two JSON files. No .clang-format to copy between repositories, and no linter installed is still not an error.

A bill of materials

molto metadata writes a CycloneDX 1.6 document Dependency-Track, Grype and Trivy read untranslated. No timestamp, no serial number: two runs over one graph produce identical bytes.

Incremental, and honest about it

Only what changed is rebuilt, dependency objects are cached across projects, and every build writes compile_commands.json so clangd sees the flags the build actually used.

The whole configuration

This is a complete project. There is no second file, no generator step and no fallback to a Makefile.

Project.toml


        
                            [package]
                        
                        name
                        =
                        "my_app"
                    
                        version
                        =
                        "0.1.0"
                     
                            [target]
                        
                        std
                        =
                        "c17"
                    
                        include
                        =
                        ["include"]
                    
                        link
                        =
                        ["m"]
                     
                            [deps]
                        
                        sqlite
                        =
                        "3.53.4"
                     
                            [profile.release]
                        
                        opt_level
                        =
                        3
                    
                        debug_info
                        =
                        false

Molto discovers your sources; it does not discover your build settings.
Sources are found for you. Include paths, defines, link libraries and test layout are only ever what the manifest says — which is why a build behaves the same on your machine and in CI.

The commands

Every one of them finds your project by walking up from where you stand.

molto buildCompile the project into build/<profile>/.
molto runBuild, then run, forwarding the program its own exit code.
molto testBuild and run the suite — one binary per test file by default.
molto add <dep>Add a dependency, written into the manifest at an exact version.
molto fmtFormat every source with clang-format. --check fails instead of writing.
molto lintAnalyse the project with clang-tidy and the compiler diagnostics.
molto metadataEmit the CycloneDX bill of materials for what this binary links.
molto publishPublish a package to the registry from its recipe.

The registry

Where a coordinate becomes bytes. One protocol serves toolchains to pickup and packages to molto, so a build fetches what it needs instead of a full compiler release.

Coordinates never change meaning

One blob per name, version and target, forever. Nothing is deleted: a withdrawn artifact is yanked, so the builds that already pinned it keep resolving.

Checksums measured, not declared

The SHA-256 is computed from the stored archive and travels with the download, so a client verifies the bytes it got rather than the bytes a recipe claimed.

Trimmed to what a build uses

A published clang is 77 MB where the upstream release is 11 GB: the sanitizers nobody linked, the debugger and the development kit stay out.

The registry


    
                $
                pickup install clang@22.1.8
            
                
                  ==> clang 22.1.8   checksum verified
            
                $
                molto add sqlite@3.53.4
            
                
                  added sqlite 3.53.4 to [deps]

Browse the registry

Search it, or read what a recipe declares.

Build it with one command

Molto is written in C and builds itself. Clone the repository, read the docs and try it on a project you already have.

Open the repository

Or read the documentation first — it states what the binary does today.