λgitsite

~ober/jerboa-sinatra

Imported from ~/mine/jerboa-sinatra

download snapshot

about

# jerboa-sinatra

A Sinatra-style web framework ported to Jerboa.

Status: experimental Lane B web framework. Do not use it for a public
production application until the remaining release gates in `SECURITY.md` and
`docs/threat-model.md` are closed for the application that embeds it.

## Build

```sh
make build
```

## Test

```sh
make test
```

The Makefile derives `JERBOA_HOME` from the selected `jerbuild` when possible.
Override with `JERBOA_HOME=/path/to/jerboa` or `JERBUILD=/path/to/jerbuild` if
needed.

## Security Verification

```sh
make verify
make target-evidence
make release-evidence
```

`make verify` runs the static security gate, test suite, public module import
check, web security smoke tests, deterministic web security corpus, bounded
handler soak evidence, example binary build, and local dependency/toolchain
audit. `make target-evidence` records the production-only hosted load, proxy/TLS,
fuzzing, deployment, and external-review gates. `make release-evidence` adds
SBOM/toolchain provenance and repeated clean-build reproducibility evidence under
`dist/release-evidence/`.

When `../jerboa/dist/jerboa` is present, the Makefile uses it so release checks
exercise current Jerboa binary hardening and deterministic-build features. It
falls back to `jerboa` on hosts that do not have an adjacent source checkout.

The framework now HTML-escapes `render-string` template substitutions by
default, rejects CR/LF in generated headers and cookies, signs sessions with
constant-work comparison, uses secure session cookies by default, bounds static
file reads through descriptor-relative no-follow opens, rejects static traversal
and link escapes, binds loopback by default, enforces finite connection,
per-source, idle, header, and body budgets, hides exception details by default,
rejects `Transfer-Encoding` plus `Content-Length`, rejects unsupported method
overrides, and records a 512-case
route/cookie/template/static security corpus plus a 2048-request local bounded
handler soak.

CI deliberately fails closed at the Jerbuild installation step until the Jerboa
producer publishes a signed release manifest and this repository provisions the
matching signer and digest in `support/jerbuild-bootstrap.lock`.

## Example Binary

```sh
make binary
JERBOA_SINATRA_SESSION_SECRET="$(openssl rand -hex 32)" ./dist/jerboa-sinatra-example
```

For a fully static Linux amd64 example binary:

```sh
make static-binary
```

recent commits