Welcome to Capa Discussions

[nelsonduarte]

This is the conversation space for the Capa programming language: a capability-typed language whose compiler emits supply-chain governance artefacts (CycloneDX SBOM, SPDX, VEX, SLSA provenance) directly from function signatures.

Where to post what

• Q&A: "the analyzer told me X, I don't understand". Stuck on a capability error, an attenuation chain, a syntax oddity, the manifest output. Specific question, specific reproduction.
• Ideas: "what if Capa had X". Language design, new features, attenuation patterns you'd like to see. Pre-implementation thinking. Concrete proposals can graduate to issues.
• Show and tell: a Capa program you wrote, a manifest you found interesting, a CVE walkthrough, an integration with another tool. Code links, screenshots, all welcome.
• Announcements: read-only space for release notes and roadmap updates from the maintainer.
• General: anything else that doesn't fit the above.

Expectations

This is a small space. I am the only maintainer; responses are best-effort. I read everything but reply in batches, not in real-time. The repo is at https://github.com/nelsonduarte/capa and the website at https://capa-language.com/. Start there if you haven't.

For security issues, please use private vulnerability reporting rather than a public discussion.

Nelson