SigilDB 0.1.0 — MySQL client, all-Sigil
=======================================

A MySQL/MariaDB wire-protocol client written entirely in Sigil (cc0). One static
binary, no libmysql, no OpenSSL, no runtime, no dependencies of any kind.

What it implements
------------------
  * MySQL client/server protocol 4.1+ — handshake parse, handshake response,
    COM_QUERY, OK/ERR/result-set classification, packet framing.
  * Authentication plugins:
      - mysql_native_password  (SHA-1 challenge/response)
      - caching_sha2_password  (MySQL 8 default) — fast-auth path AND the
        full-auth path (server RSA public key -> RSA-OAEP -> XOR'd password)
      - sha256_password        (always full-auth)
  * Crypto, all in-tree Sigil: SHA-1, SHA-256, bignum modexp, RSA-OAEP with
    MGF1-SHA1, base64, X.509/SPKI public-key parsing.

Self-tests (all 7 pass, verified on this build)
-----------------------------------------------
  sha1_test        FIPS 180-4 known-answer vectors
  base64_test      encode/decode round-trip
  mgf1_test        MGF1-SHA1 vs. an independent RFC 8017 B.2.1 oracle,
                   masklen 50 (spans 3 SHA-1 blocks)
  oaep_test        RSA-OAEP encode/decode round-trip
  mysql_wire_test  packet framing, native-auth response vs. an independent
                   oracle, synthetic-handshake parse, COM_QUERY build
  auth256_test     caching_sha2_password scramble derivation
  rsa_key_test     server RSA public-key (PEM/SPKI) parse

Usage
-----
The connection target is compiled in (see `target_host_ip` / `target_port` /
`target_user` / `target_password` / `target_database` / `target_query` at the
top of apps/sigildb/mysql_client.sg) and defaults to 127.0.0.1:3306, user
`root`, empty password, query `SELECT 1`. Rebuild with your own targets to
point it elsewhere. A command-line argument parser and the libwin Scene UI
(connection form + query box + results table) are not in this release.

Exit codes: 0 = connected, authenticated, query accepted. 2 = TCP connect
failed. 3/6/8 = short or missing server packet. 4 = pre-4.1 server. 5/7 = short
send. 12 = unimplemented auth plugin. 20..89 = login denied (server error code
folded in). 90..98 = query error.

Platforms
---------
  macOS    Apple Silicon (arm64), macOS 12+   Mach-O
  Linux    x86-64, static, no deps            ELF
  Windows  x86-64, no deps                    PE32+

Status note
-----------
This is the NATIVE (host-OS) client. A sigilOS-native arm-el0 build links the
exact same protocol and crypto code unchanged, but cannot connect yet: live
network I/O on sigilOS is pending the kernel's Cap<NetConn> syscalls
(109/110/111/112, "OS 0.8 net lane"). Nothing in mysql_wire.sg needs to change
when that lands.

Source: sigil-apps/apps/sigildb/ — Sigil only, zero Python, zero C.
