λgitsite

~ober/jerboa-scintilla

Imported from ~/mine/jerboa-scintilla

download snapshot

about

# jerboa-scintilla

Jerboa bindings for Scintilla using the scintilla-termbox backend. This
repository is experimental Lane B native/FFI infrastructure for editor-style
tools.

The native boundary is intentionally narrow:

- Statically registered native symbols are preferred. Development-only dynamic
  loading is lazy and requires an explicit trusted absolute directory.
- Text arguments cross into C as UTF-8 bytevectors with explicit lengths.
- Text results cross into caller-owned bytevectors with a checked capacity and
  an explicit 64 MiB API limit; there is no fixed 64 KiB receive buffer.
- Embedded NUL bytes are rejected before native calls.
- Opaque numeric editor IDs are never reused. Native operations, notification
  delivery, and destruction use synchronized lifecycle references.
- Vendored Scintilla, Lexilla, and termbox_next archives are required only for
  native shim builds.
- Pure API tests can run without a terminal or native vendor checkout.

## Build

Run the pure build and API tests:

```sh
make security
make test
```

Populate the ignored native vendor checkout, then build and test the native
shim:

```sh
make vendor-deps
make vendor-provenance-enforce
make test-native
make native-boundary-corpus
make native-security-tests
make native-thread-tests
make audit
```

By default, the Makefile uses the ignored `./scintilla-vendor` directory. Set
`SCINTILLA_VENDOR=/path/to/scintilla-vendor` to use another checkout.

The Makefile supplies the development loader controls for its native tests.
Other dynamic development hosts must set both
`JERBOA_SCINTILLA_DEV_NATIVE=1` and `JERBOA_SCINTILLA_LIB` to a trusted,
canonical absolute directory containing the shim. Production hosts should
statically register the shim symbols instead. Current-directory, relative,
bare-name, symlinked, unexpected-owner, and world-writable native paths are
rejected by the shared `(std native-loader)` policy, which validates every
ancestor. Group-write is allowed only on same-user components in explicit
unprivileged development mode. Privileged processes ignore the development
environment entirely.

## Security

Review [SECURITY.md](SECURITY.md), [docs/ffi-boundary.md](docs/ffi-boundary.md),
[docs/vendor-provenance.md](docs/vendor-provenance.md), and
[docs/threat-model.md](docs/threat-model.md) before using this library in
release candidates. `make release-evidence` records test output, vendor
provenance status, SBOM manifests, native linkage, sanitized target evidence,
and hash-only reproducibility output under `dist/release-evidence/`. Target
proof files are rejected before copying when they contain overlarge,
host-private, or high-confidence secret material. Public production release
still requires sanitizer coverage of the complete vendored C++ graph, terminal
smoke tests, and marker-complete target-platform evidence. The checked-in shim
harness already runs ASan/UBSan boundary cases and ThreadSanitizer over the
deterministic lifecycle/concurrency suite.

recent commits