security: gate native export review
Jaime Fournier
2450d60c8dac22c946b1b66178f6b25ac3bacd07
--- a/Makefile +++ b/Makefile @@ -76,7 +76,7 @@ TYPED_LLVMIR_PARITY_FN ?= sample_typed_llvmir_smoke::main LLVM_BIN ?= $(shell if command -v llvm-as >/dev/null 2>&1; then dirname "$$(command -v llvm-as)"; elif [ -x /opt/homebrew/opt/llvm/bin/llvm-as ]; then echo /opt/homebrew/opt/llvm/bin; elif [ -x /usr/local/opt/llvm/bin/llvm-as ]; then echo /usr/local/opt/llvm/bin; fi) TYPED_WRAPPER_DIR ?= build/typed/jerboa -.PHONY: help chez static-supported-check chez-cross build binary binary-typed binary-typed-smoke binary-cross native-cross pure-audit typecheck typed-rust typed-llvmir typed-llvmir-check typed-llvmir-smoke typed-llvmir-parity typed-wrappers typed-build typed-wrapper-smoke typed-split-tree-smoke typed-test typed-clean test test-known-flaky test-reader test-core test-runtime test-try-debug test-stdlib test-ffi test-modules test-expanded test-contract test-ergo test-sqlite-robustness test-limits-primitives test-typed-core test-typed-parser test-typed-checker test-typed-rust test-typed-kotlin test-typed-llvmir test-typed-wrappers test-pure-audit test-features test-wrappers test-phase4a test-phase4b test-phase4c test-phase4d test-phase4e test-phase4f test-phase5 test-phase5e test-phase6 test-phase7 test-phase8 test-functional test-repl test-security test-security-profile test-native test-gaps native clean-native audit audit-native jpkg-audit vendor-jsqlite-security-check tcb-drift-check import-policy-check source-balance restrict-closure-check security-audit clean security security-production security-profile security-hardware-smoke sbom reproducibility-report reproducibility-compare verify release-evidence fuzz fuzz-smoke fuzz-deep fuzz-reader-fuzz fuzz-json-fuzz fuzz-http2-fuzz fuzz-dns-fuzz fuzz-pregexp-fuzz fuzz-csv-fuzz fuzz-base64-fuzz fuzz-hex-fuzz fuzz-uri-fuzz fuzz-format-fuzz fuzz-router-fuzz fuzz-sandbox-fuzz test-rawstring test-regex test-rx test-peg test-regex-all check-docs check-docs-strict data-check docker-build docker-push lint +.PHONY: help chez static-supported-check chez-cross build binary binary-typed binary-typed-smoke binary-cross native-cross pure-audit typecheck typed-rust typed-llvmir typed-llvmir-check typed-llvmir-smoke typed-llvmir-parity typed-wrappers typed-build typed-wrapper-smoke typed-split-tree-smoke typed-test typed-clean test test-known-flaky test-reader test-core test-runtime test-try-debug test-stdlib test-ffi test-modules test-expanded test-contract test-ergo test-sqlite-robustness test-limits-primitives test-typed-core test-typed-parser test-typed-checker test-typed-rust test-typed-kotlin test-typed-llvmir test-typed-wrappers test-pure-audit test-features test-wrappers test-phase4a test-phase4b test-phase4c test-phase4d test-phase4e test-phase4f test-phase5 test-phase5e test-phase6 test-phase7 test-phase8 test-functional test-repl test-security test-security-profile test-native test-gaps native clean-native audit audit-native jpkg-audit vendor-jsqlite-security-check native-export-review-check tcb-drift-check import-policy-check source-balance restrict-closure-check security-audit clean security security-production security-profile security-hardware-smoke sbom reproducibility-report reproducibility-compare verify release-evidence fuzz fuzz-smoke fuzz-deep fuzz-reader-fuzz fuzz-json-fuzz fuzz-http2-fuzz fuzz-dns-fuzz fuzz-pregexp-fuzz fuzz-csv-fuzz fuzz-base64-fuzz fuzz-hex-fuzz fuzz-uri-fuzz fuzz-format-fuzz fuzz-router-fuzz fuzz-sandbox-fuzz test-rawstring test-regex test-rx test-peg test-regex-all check-docs check-docs-strict data-check docker-build docker-push lint .PHONY: check-cross-tools docker fuzz-websocket-fuzz jlsp jlsp-freebsd-amd64 \ jlsp-install jlsp-linux-amd64 jlsp-portable jmcp-freebsd-amd64 \ jmcp-freebsd-arm64 jmcp-linux-amd64 jmcp-linux-arm64 \ @@ -138,6 +138,7 @@ help: @echo " audit Run production security/release gate checks" @echo " audit-native Run cargo audit on Rust native library" @echo " vendor-jsqlite-security-check Verify vendored jsqlite TCB review freshness" + @echo " native-export-review-check Verify native Rust export caller review freshness" @echo " pure-audit Scan jerboa-* repos for non-pure runtime surfaces" @echo " sbom Write local SBOM/toolchain evidence under dist/sbom" @echo " reproducibility-report Compare two local multicall builds" @@ -1746,6 +1747,9 @@ jpkg-audit: build vendor-jsqlite-security-check: @support/check-vendor-jsqlite-security.sh +native-export-review-check: + @support/check-native-export-review.sh --check + tcb-drift-check: @set -eu; \ if git diff --quiet -- .jerboa-system support/container-dependencies.lock \ @@ -1779,7 +1783,7 @@ unsafe-deserialize-check: import-policy-check: build @$(SCHEME) --libdirs $(LIBDIRS) --script tools/check-import-policy.ss examples -audit: source-balance restrict-closure-check unsafe-deserialize-check import-policy-check security-audit audit-native jpkg-audit vendor-jsqlite-security-check tcb-drift-check data-check security-production unification-check +audit: source-balance restrict-closure-check unsafe-deserialize-check import-policy-check security-audit audit-native jpkg-audit vendor-jsqlite-security-check native-export-review-check tcb-drift-check data-check security-production unification-check test-gaps: $(SCHEME) --libdirs $(LIBDIRS) --script tests/test-gaps.ss --- a/docs/ffi-audit.md +++ b/docs/ffi-audit.md @@ -55,7 +55,11 @@ Latest summary from `tools/ffi-audit-report.ss`: K3-P1-01 is now started and reproducibly inventoried, but not complete. The current release gate has a machine-readable count of Scheme FFI sites, native C/Rust files, Rust C ABI exports, pointer/width-sensitive bindings, blocking -candidate calls, and unsafe Rust sites. The full report appends a provisional +candidate calls, and unsafe Rust sites. `make native-export-review-check` +keeps the actual C ABI export/caller map in +`docs/reviews/2026-07-27-native-export-review.sexp` fresh; the current map has +225 actual exported functions, 183 tracked Scheme references, and 42 exports +with no tracked Scheme reference. The full report appends a provisional `hazards` list and `verdict` to every Scheme and Rust site. Scheme verdicts separate blocking calls missing `__collect_safe`, pointer/GC/ownership or integer-width review, and lower-risk API review. Rust verdicts separate unsafe @@ -76,8 +80,8 @@ Remaining work before closing K3-P1-01: - Add targeted scanner rules for null-return checks, integer width confusion, caller-supplied length trust, and bytevector pointer lifetime hazards. - Add `SAFETY:` invariant comments near Rust unsafe sites. -- Reconcile the 231 Rust `#[no_mangle]` exports with live Scheme callers and - unexport or document unused exports. +- Use the native export review's no-Scheme-reference set to unexport or + explicitly retain each currently unused Rust C ABI export. - Keep `vendor/jsqlite` in the TCB until consumers move to the Rust sqlite path. The accepted-risk decision is now recorded in `docs/reviews/2026-07-27-vendor-jsqlite-tcb.md`, and `make audit` runs --- a/docs/index.md +++ b/docs/index.md @@ -76,6 +76,7 @@ work. - [safety-guide.md](safety-guide.md) - practical secure-application guide for Jerboa programs - [release-security.md](release-security.md) - release gates and security evidence - [reviews/2026-07-27-vendor-jsqlite-tcb.md](reviews/2026-07-27-vendor-jsqlite-tcb.md) - accepted-risk review for the vendored SQLite-compatible engine +- [reviews/2026-07-27-native-export-review.md](reviews/2026-07-27-native-export-review.md) - native Rust export/caller review and drift gate - [capability.md](capability.md) - object-capability model - [limits.md](limits.md) - resource limits, sandboxing, and capability primitives - [harden.md](harden.md) - binary hardening for release artifacts --- a/docs/kimi3-security-recommmendations.md +++ b/docs/kimi3-security-recommmendations.md @@ -612,7 +612,11 @@ not started." decision in `docs/reviews/2026-07-27-vendor-jsqlite-tcb.md`; `make audit` now runs `vendor-jsqlite-security-check`, which fails stale advisory reviews or drift between the decision record and the vendored README compatibility target. - Remaining work: unsafe invariant comments and export shrinking/justification. + `make audit` also runs `native-export-review-check`, backed by + `docs/reviews/2026-07-27-native-export-review.sexp`, to keep the Rust C ABI + export/caller map current. Remaining work: unsafe invariant comments and + shrinking or explicitly retaining the 42 exports with no tracked Scheme + reference. ### K3-P1-02 — TOCTOU-safe filesystem capability checks **Serves:** G2. **Effort:** 1 week. --- a/docs/release-security.md +++ b/docs/release-security.md @@ -162,6 +162,9 @@ The same audit gate runs `vendor-jsqlite-security-check`, which requires `docs/reviews/2026-07-27-vendor-jsqlite-tcb.md` to record a fresh accepted-risk review for the vendored pure-Jerboa SQLite-compatible engine and to match the pinned SQLite compatibility target in `vendor/jsqlite/README.md`. +It also runs `native-export-review-check`, which compares +`docs/reviews/2026-07-27-native-export-review.sexp` against the current Rust +C ABI export set and tracked Scheme caller map. It also runs `support/check-release-path-leaks.sh` against `dist/jerboa` and requires `path_leak_status=pass` in `path-leaks.txt`. Release packaging runs the same checker against the final `.tar.gz`, so shipped artifacts cannot new file mode 100644 --- /dev/null +++ b/docs/reviews/2026-07-27-native-export-review.md @@ -0,0 +1,26 @@ +# Native Rust Export Review + +Review date: 2026-07-27 +Review artifact: `docs/reviews/2026-07-27-native-export-review.sexp` +Gate: `make native-export-review-check` + +This review reconciles Rust `#[no_mangle] extern "C"` exports against tracked +Scheme source references. It is intentionally machine-readable so export drift +fails review instead of becoming stale prose. + +Current summary: + +- Actual Rust C ABI exports: 225 +- Exports referenced by tracked Scheme source: 183 +- Exports with no tracked Scheme reference: 42 + +The broader FFI audit still reports raw `no_mangle` marker sites separately; +this review counts only actual exported Rust functions. + +Release rule: + +`make audit` runs `support/check-native-export-review.sh --check`. The check +fails when the committed review artifact does not match the current Rust export +set or the tracked Scheme caller map. New exports must therefore either gain a +Scheme caller, be removed, or remain visible in the no-Scheme-reference set for +an explicit follow-up decision. new file mode 100644 --- /dev/null +++ b/docs/reviews/2026-07-27-native-export-review.sexp @@ -0,0 +1,233 @@ +(native-export-review + (schema "jerboa.native-export-review/1") + (generated-by "support/check-native-export-review.sh") + (policy scheme-callers-or-documented) + (summary (exports 225) (scheme-referenced 183) (no-scheme-reference 42)) + (exports + (export (symbol "ed25519_derive_pubkey_standalone") (file "jerboa-native-rs/src/ed25519.rs") (line 44) (scheme-callers 0 (none))) + (export (symbol "ed25519_sign_standalone") (file "jerboa-native-rs/src/ed25519.rs") (line 9) (scheme-callers 0 (none))) + (export (symbol "embed_decrypt") (file "jerboa-native-rs/src/embed_crypto.rs") (line 98) (scheme-callers 0 (none))) + (export (symbol "embed_encrypt") (file "jerboa-native-rs/src/embed_crypto.rs") (line 43) (scheme-callers 0 (none))) + (export (symbol "embed_pbkdf2_sha256") (file "jerboa-native-rs/src/embed_crypto.rs") (line 19) (scheme-callers 0 (none))) + (export (symbol "embed_random_bytes") (file "jerboa-native-rs/src/embed_crypto.rs") (line 157) (scheme-callers 0 (none))) + (export (symbol "embed_read_passphrase") (file "jerboa-native-rs/src/embed_crypto.rs") (line 180) (scheme-callers 0 (none))) + (export (symbol "jerboa_aead_open") (file "jerboa-native-rs/src/crypto.rs") (line 388) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 161)))) + (export (symbol "jerboa_aead_seal") (file "jerboa-native-rs/src/crypto.rs") (line 318) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 140)))) + (export (symbol "jerboa_antidebug_check_all") (file "jerboa-native-rs/src/antidebug.rs") (line 147) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 46)))) + (export (symbol "jerboa_antidebug_check_breakpoint") (file "jerboa-native-rs/src/antidebug.rs") (line 98) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 42)))) + (export (symbol "jerboa_antidebug_check_ld_preload") (file "jerboa-native-rs/src/antidebug.rs") (line 60) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 40)))) + (export (symbol "jerboa_antidebug_check_tracer") (file "jerboa-native-rs/src/antidebug.rs") (line 30) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 38)))) + (export (symbol "jerboa_antidebug_ptrace") (file "jerboa-native-rs/src/antidebug.rs") (line 8) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 36)))) + (export (symbol "jerboa_antidebug_timing_check") (file "jerboa-native-rs/src/antidebug.rs") (line 119) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 44)))) + (export (symbol "jerboa_aproc_close") (file "jerboa-native-rs/src/aproc.rs") (line 581) (scheme-callers 0 (none))) + (export (symbol "jerboa_aproc_dup") (file "jerboa-native-rs/src/aproc.rs") (line 565) (scheme-callers 0 (none))) + (export (symbol "jerboa_aproc_killpg") (file "jerboa-native-rs/src/aproc.rs") (line 616) (scheme-callers 1 (caller (file "lib/std/os/aproc.ss") (line 154)))) + (export (symbol "jerboa_aproc_set_nonblock") (file "jerboa-native-rs/src/aproc.rs") (line 588) (scheme-callers 1 (caller (file "lib/std/os/aproc.ss") (line 150)))) + (export (symbol "jerboa_aproc_spawn") (file "jerboa-native-rs/src/aproc.rs") (line 132) (scheme-callers 2 (caller (file "lib/std/os/aproc.ss") (line 126)) (caller (file "lib/std/os/aproc.ss") (line 141)))) + (export (symbol "jerboa_aproc_spawn_pty") (file "jerboa-native-rs/src/aproc.rs") (line 340) (scheme-callers 1 (caller (file "lib/std/os/aproc.ss") (line 141)))) + (export (symbol "jerboa_aproc_wait4") (file "jerboa-native-rs/src/aproc.rs") (line 630) (scheme-callers 1 (caller (file "lib/std/os/aproc.ss") (line 158)))) + (export (symbol "jerboa_argon2id_hash") (file "jerboa-native-rs/src/crypto.rs") (line 714) (scheme-callers 2 (caller (file "lib/std/crypto/native-rust.ss") (line 276)) (caller (file "lib/std/crypto/password.ss") (line 35)))) + (export (symbol "jerboa_argon2id_verify") (file "jerboa-native-rs/src/crypto.rs") (line 763) (scheme-callers 2 (caller (file "lib/std/crypto/native-rust.ss") (line 296)) (caller (file "lib/std/crypto/password.ss") (line 42)))) + (export (symbol "jerboa_chacha20_open") (file "jerboa-native-rs/src/crypto.rs") (line 531) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 204)))) + (export (symbol "jerboa_chacha20_seal") (file "jerboa-native-rs/src/crypto.rs") (line 462) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 182)))) + (export (symbol "jerboa_deflate") (file "jerboa-native-rs/src/compress.rs") (line 9) (scheme-callers 1 (caller (file "lib/std/compress/native-rust.ss") (line 30)))) + (export (symbol "jerboa_duckdb_bind_blob") (file "jerboa-native-rs/src/duckdb_native.rs") (line 334) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 62)))) + (export (symbol "jerboa_duckdb_bind_bool") (file "jerboa-native-rs/src/duckdb_native.rs") (line 386) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 66)))) + (export (symbol "jerboa_duckdb_bind_double") (file "jerboa-native-rs/src/duckdb_native.rs") (line 272) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 58)))) + (export (symbol "jerboa_duckdb_bind_int") (file "jerboa-native-rs/src/duckdb_native.rs") (line 251) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 56)))) + (export (symbol "jerboa_duckdb_bind_null") (file "jerboa-native-rs/src/duckdb_native.rs") (line 365) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 64)))) + (export (symbol "jerboa_duckdb_bind_text") (file "jerboa-native-rs/src/duckdb_native.rs") (line 293) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 60)))) + (export (symbol "jerboa_duckdb_close") (file "jerboa-native-rs/src/duckdb_native.rs") (line 125) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 45)))) + (export (symbol "jerboa_duckdb_column_name") (file "jerboa-native-rs/src/duckdb_native.rs") (line 673) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 76)))) + (export (symbol "jerboa_duckdb_column_type") (file "jerboa-native-rs/src/duckdb_native.rs") (line 710) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 79)))) + (export (symbol "jerboa_duckdb_exec") (file "jerboa-native-rs/src/duckdb_native.rs") (line 154) (scheme-callers 2 (caller (file "lib/std/db/duckdb-native.ss") (line 47)) (caller (file "lib/std/db/duckdb-native.ss") (line 69)))) + (export (symbol "jerboa_duckdb_execute") (file "jerboa-native-rs/src/duckdb_native.rs") (line 433) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 69)))) + (export (symbol "jerboa_duckdb_finalize") (file "jerboa-native-rs/src/duckdb_native.rs") (line 968) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 51)))) + (export (symbol "jerboa_duckdb_free_result") (file "jerboa-native-rs/src/duckdb_native.rs") (line 955) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 96)))) + (export (symbol "jerboa_duckdb_ncols") (file "jerboa-native-rs/src/duckdb_native.rs") (line 664) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 74)))) + (export (symbol "jerboa_duckdb_nrows") (file "jerboa-native-rs/src/duckdb_native.rs") (line 655) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 72)))) + (export (symbol "jerboa_duckdb_open") (file "jerboa-native-rs/src/duckdb_native.rs") (line 85) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 43)))) + (export (symbol "jerboa_duckdb_prepare") (file "jerboa-native-rs/src/duckdb_native.rs") (line 190) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 49)))) + (export (symbol "jerboa_duckdb_reset") (file "jerboa-native-rs/src/duckdb_native.rs") (line 980) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 53)))) + (export (symbol "jerboa_duckdb_value_blob") (file "jerboa-native-rs/src/duckdb_native.rs") (line 903) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 92)))) + (export (symbol "jerboa_duckdb_value_bool") (file "jerboa-native-rs/src/duckdb_native.rs") (line 790) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 87)))) + (export (symbol "jerboa_duckdb_value_double") (file "jerboa-native-rs/src/duckdb_native.rs") (line 770) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 85)))) + (export (symbol "jerboa_duckdb_value_int") (file "jerboa-native-rs/src/duckdb_native.rs") (line 744) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 83)))) + (export (symbol "jerboa_duckdb_value_is_null") (file "jerboa-native-rs/src/duckdb_native.rs") (line 725) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 81)))) + (export (symbol "jerboa_duckdb_value_text") (file "jerboa-native-rs/src/duckdb_native.rs") (line 822) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 89)))) + (export (symbol "jerboa_duckdb_version") (file "jerboa-native-rs/src/duckdb_native.rs") (line 1002) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 98)))) + (export (symbol "jerboa_epoll_close") (file "jerboa-native-rs/src/epoll.rs") (line 81) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 59)))) + (export (symbol "jerboa_epoll_create") (file "jerboa-native-rs/src/epoll.rs") (line 6) (scheme-callers 2 (caller (file "lib/std/os/epoll-native.ss") (line 30)) (caller (file "lib/std/os/epoll-native.ss") (line 50)))) + (export (symbol "jerboa_epoll_ctl") (file "jerboa-native-rs/src/epoll.rs") (line 22) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 53)))) + (export (symbol "jerboa_epoll_wait") (file "jerboa-native-rs/src/epoll.rs") (line 42) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 56)))) + (export (symbol "jerboa_eventfd_create") (file "jerboa-native-rs/src/epoll.rs") (line 94) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 293)))) + (export (symbol "jerboa_eventfd_drain") (file "jerboa-native-rs/src/epoll.rs") (line 120) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 299)))) + (export (symbol "jerboa_eventfd_signal") (file "jerboa-native-rs/src/epoll.rs") (line 106) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 296)))) + (export (symbol "jerboa_freebsd_is_traced") (file "jerboa-native-rs/src/process_ctl.rs") (line 98) (scheme-callers 0 (none))) + (export (symbol "jerboa_freebsd_process_count") (file "jerboa-native-rs/src/process_ctl.rs") (line 139) (scheme-callers 0 (none))) + (export (symbol "jerboa_gunzip") (file "jerboa-native-rs/src/compress.rs") (line 137) (scheme-callers 1 (caller (file "lib/std/compress/native-rust.ss") (line 39)))) + (export (symbol "jerboa_gzip") (file "jerboa-native-rs/src/compress.rs") (line 97) (scheme-callers 1 (caller (file "lib/std/compress/native-rust.ss") (line 36)))) + (export (symbol "jerboa_hkdf_sha256") (file "jerboa-native-rs/src/x25519.rs") (line 101) (scheme-callers 0 (none))) + (export (symbol "jerboa_hmac_sha256") (file "jerboa-native-rs/src/crypto.rs") (line 201) (scheme-callers 2 (caller (file "lib/std/crypto/native-rust.ss") (line 109)) (caller (file "lib/std/crypto/native-rust.ss") (line 120)))) + (export (symbol "jerboa_hmac_sha256_verify") (file "jerboa-native-rs/src/crypto.rs") (line 232) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 120)))) + (export (symbol "jerboa_http_parse") (file "jerboa-native-rs/src/http_parse.rs") (line 25) (scheme-callers 4 (caller (file "lib/std/net/fiber-httpd.ss") (line 78)) (caller (file "lib/std/net/fiber-httpd.ss") (line 81)) (caller (file "lib/std/net/httpsd.ss") (line 28)) (caller (file "lib/std/net/httpsd.ss") (line 71)))) + (export (symbol "jerboa_inflate") (file "jerboa-native-rs/src/compress.rs") (line 49) (scheme-callers 1 (caller (file "lib/std/compress/native-rust.ss") (line 33)))) + (export (symbol "jerboa_inotify_add_watch") (file "jerboa-native-rs/src/inotify_native.rs") (line 22) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 65)))) + (export (symbol "jerboa_inotify_close") (file "jerboa-native-rs/src/inotify_native.rs") (line 158) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 71)))) + (export (symbol "jerboa_inotify_init") (file "jerboa-native-rs/src/inotify_native.rs") (line 6) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 63)))) + (export (symbol "jerboa_inotify_read") (file "jerboa-native-rs/src/inotify_native.rs") (line 68) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 69)))) + (export (symbol "jerboa_inotify_rm_watch") (file "jerboa-native-rs/src/inotify_native.rs") (line 49) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 67)))) + (export (symbol "jerboa_integrity_hash_file") (file "jerboa-native-rs/src/integrity.rs") (line 272) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 63)))) + (export (symbol "jerboa_integrity_hash_region") (file "jerboa-native-rs/src/integrity.rs") (line 194) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 60)))) + (export (symbol "jerboa_integrity_hash_self") (file "jerboa-native-rs/src/integrity.rs") (line 65) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 53)))) + (export (symbol "jerboa_integrity_sign_verify") (file "jerboa-native-rs/src/integrity.rs") (line 134) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 57)))) + (export (symbol "jerboa_integrity_verify_hash") (file "jerboa-native-rs/src/integrity.rs") (line 96) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 55)))) + (export (symbol "jerboa_kill_probe") (file "jerboa-native-rs/src/process_ctl.rs") (line 59) (scheme-callers 0 (none))) + (export (symbol "jerboa_landlock_abi_version") (file "jerboa-native-rs/src/landlock.rs") (line 65) (scheme-callers 6 (caller (file "lib/std/os/landlock-native.ss") (line 78)) (caller (file "lib/std/os/landlock.ss") (line 12)) (caller (file "lib/std/os/landlock.ss") (line 56)) (caller (file "lib/std/os/landlock.ss") (line 57)) (caller (file "lib/std/os/limits/sandbox.ss") (line 455)) (caller (file "lib/std/os/sandbox.ss") (line 75)))) + (export (symbol "jerboa_landlock_add_net_rule") (file "jerboa-native-rs/src/landlock.rs") (line 201) (scheme-callers 1 (caller (file "lib/std/os/landlock-native.ss") (line 86)))) + (export (symbol "jerboa_landlock_add_path_rule") (file "jerboa-native-rs/src/landlock.rs") (line 120) (scheme-callers 1 (caller (file "lib/std/os/landlock-native.ss") (line 83)))) + (export (symbol "jerboa_landlock_create_ruleset") (file "jerboa-native-rs/src/landlock.rs") (line 91) (scheme-callers 1 (caller (file "lib/std/os/landlock-native.ss") (line 80)))) + (export (symbol "jerboa_landlock_enforce") (file "jerboa-native-rs/src/landlock.rs") (line 234) (scheme-callers 1 (caller (file "lib/std/os/landlock-native.ss") (line 89)))) + (export (symbol "jerboa_last_error") (file "jerboa-native-rs/src/panic.rs") (line 9) (scheme-callers 11 (caller (file "lib/std/compress/native-rust.ss") (line 42)) (caller (file "lib/std/crypto/native-rust.ss") (line 48)) (caller (file "lib/std/crypto/x509.ss") (line 24)) (caller (file "lib/std/native.ss") (line 56)) (caller (file "lib/std/net/tls-rustls.ss") (line 167)) (caller (file "lib/std/os/aproc.ss") (line 163)) (caller (file "lib/std/os/integrity.ss") (line 42)) (caller (file "lib/std/os/secure-output.ss") (line 47)) (caller (file "lib/std/pcap.ss") (line 66)) (caller (file "lib/std/regex-native.ss") (line 51)) (caller (file "lib/std/wasm/sandbox.ss") (line 196)))) + (export (symbol "jerboa_md5") (file "jerboa-native-rs/src/crypto.rs") (line 53) (scheme-callers 0 (none))) + (export (symbol "jerboa_mlockall") (file "jerboa-native-rs/src/process_ctl.rs") (line 37) (scheme-callers 0 (none))) + (export (symbol "jerboa_pbkdf2_derive") (file "jerboa-native-rs/src/crypto.rs") (line 647) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 246)))) + (export (symbol "jerboa_pbkdf2_verify") (file "jerboa-native-rs/src/crypto.rs") (line 676) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 261)))) + (export (symbol "jerboa_pcap_close") (file "jerboa-native-rs/src/pcap_capture.rs") (line 324) (scheme-callers 1 (caller (file "lib/std/pcap.ss") (line 58)))) + (export (symbol "jerboa_pcap_list_interfaces") (file "jerboa-native-rs/src/pcap_capture.rs") (line 350) (scheme-callers 1 (caller (file "lib/std/pcap.ss") (line 62)))) + (export (symbol "jerboa_pcap_next") (file "jerboa-native-rs/src/pcap_capture.rs") (line 260) (scheme-callers 1 (caller (file "lib/std/pcap.ss") (line 53)))) + (export (symbol "jerboa_pcap_open") (file "jerboa-native-rs/src/pcap_capture.rs") (line 195) (scheme-callers 1 (caller (file "lib/std/pcap.ss") (line 49)))) + (export (symbol "jerboa_pg_column_name") (file "jerboa-native-rs/src/postgres_native.rs") (line 310) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 41)))) + (export (symbol "jerboa_pg_connect") (file "jerboa-native-rs/src/postgres_native.rs") (line 83) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 24)))) + (export (symbol "jerboa_pg_disconnect") (file "jerboa-native-rs/src/postgres_native.rs") (line 132) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 26)))) + (export (symbol "jerboa_pg_exec") (file "jerboa-native-rs/src/postgres_native.rs") (line 145) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 28)))) + (export (symbol "jerboa_pg_free_result") (file "jerboa-native-rs/src/postgres_native.rs") (line 346) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 44)))) + (export (symbol "jerboa_pg_get_value") (file "jerboa-native-rs/src/postgres_native.rs") (line 237) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 36)))) + (export (symbol "jerboa_pg_is_null") (file "jerboa-native-rs/src/postgres_native.rs") (line 286) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 39)))) + (export (symbol "jerboa_pg_ncols") (file "jerboa-native-rs/src/postgres_native.rs") (line 223) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 34)))) + (export (symbol "jerboa_pg_nrows") (file "jerboa-native-rs/src/postgres_native.rs") (line 215) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 32)))) + (export (symbol "jerboa_pg_query") (file "jerboa-native-rs/src/postgres_native.rs") (line 172) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 30)))) + (export (symbol "jerboa_prctl_set_name") (file "jerboa-native-rs/src/process_ctl.rs") (line 6) (scheme-callers 0 (none))) + (export (symbol "jerboa_proc_self_exe") (file "jerboa-native-rs/src/process_ctl.rs") (line 218) (scheme-callers 0 (none))) + (export (symbol "jerboa_random_bytes") (file "jerboa-native-rs/src/crypto.rs") (line 265) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 98)))) + (export (symbol "jerboa_regex_captures") (file "jerboa-native-rs/src/regex_native.rs") (line 275) (scheme-callers 2 (caller (file "lib/std/regex-native.ss") (line 40)) (caller (file "lib/std/regex.ss") (line 106)))) + (export (symbol "jerboa_regex_compile") (file "jerboa-native-rs/src/regex_native.rs") (line 14) (scheme-callers 3 (caller (file "lib/std/regex-native.ss") (line 27)) (caller (file "lib/std/regex.ss") (line 81)) (caller (file "lib/std/regex.ss") (line 85)))) + (export (symbol "jerboa_regex_compile_ex") (file "jerboa-native-rs/src/regex_native.rs") (line 170) (scheme-callers 0 (none))) + (export (symbol "jerboa_regex_find") (file "jerboa-native-rs/src/regex_native.rs") (line 75) (scheme-callers 4 (caller (file "lib/std/regex-native.ss") (line 33)) (caller (file "lib/std/regex.ss") (line 89)) (caller (file "lib/std/regex.ss") (line 97)) (caller (file "lib/std/regex.ss") (line 657)))) + (export (symbol "jerboa_regex_find_at") (file "jerboa-native-rs/src/regex_native.rs") (line 229) (scheme-callers 3 (caller (file "lib/std/regex-native.ss") (line 33)) (caller (file "lib/std/regex.ss") (line 97)) (caller (file "lib/std/regex.ss") (line 657)))) + (export (symbol "jerboa_regex_free") (file "jerboa-native-rs/src/regex_native.rs") (line 157) (scheme-callers 2 (caller (file "lib/std/regex-native.ss") (line 48)) (caller (file "lib/std/regex.ss") (line 93)))) + (export (symbol "jerboa_regex_group_count") (file "jerboa-native-rs/src/regex_native.rs") (line 328) (scheme-callers 2 (caller (file "lib/std/regex-native.ss") (line 37)) (caller (file "lib/std/regex.ss") (line 102)))) + (export (symbol "jerboa_regex_is_match") (file "jerboa-native-rs/src/regex_native.rs") (line 49) (scheme-callers 1 (caller (file "lib/std/regex-native.ss") (line 30)))) + (export (symbol "jerboa_regex_replace_all") (file "jerboa-native-rs/src/regex_native.rs") (line 112) (scheme-callers 1 (caller (file "lib/std/regex-native.ss") (line 44)))) + (export (symbol "jerboa_scrypt") (file "jerboa-native-rs/src/crypto.rs") (line 605) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 226)))) + (export (symbol "jerboa_seccomp_available") (file "jerboa-native-rs/src/seccomp.rs") (line 283) (scheme-callers 1 (caller (file "lib/std/os/seccomp.ss") (line 32)))) + (export (symbol "jerboa_seccomp_lock") (file "jerboa-native-rs/src/seccomp.rs") (line 125) (scheme-callers 2 (caller (file "lib/std/os/seccomp.ss") (line 34)) (caller (file "lib/std/os/seccomp.ss") (line 36)))) + (export (symbol "jerboa_seccomp_lock_strict") (file "jerboa-native-rs/src/seccomp.rs") (line 197) (scheme-callers 1 (caller (file "lib/std/os/seccomp.ss") (line 36)))) + (export (symbol "jerboa_secure_alloc") (file "jerboa-native-rs/src/secure_mem.rs") (line 28) (scheme-callers 1 (caller (file "lib/std/crypto/secure-mem.ss") (line 35)))) + (export (symbol "jerboa_secure_dir_close") (file "jerboa-native-rs/src/secure_fs.rs") (line 463) (scheme-callers 2 (caller (file "lib/std/os/secure-output.ss") (line 33)) (caller (file "lib/std/os/secure-output.ss") (line 53)))) + (export (symbol "jerboa_secure_dir_list") (file "jerboa-native-rs/src/secure_fs.rs") (line 633) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 62)))) + (export (symbol "jerboa_secure_dir_mkdirs") (file "jerboa-native-rs/src/secure_fs.rs") (line 472) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 56)))) + (export (symbol "jerboa_secure_dir_open") (file "jerboa-native-rs/src/secure_fs.rs") (line 400) (scheme-callers 2 (caller (file "lib/std/os/secure-output.ss") (line 49)) (caller (file "lib/std/os/secure-output.ss") (line 51)))) + (export (symbol "jerboa_secure_dir_open_strict") (file "jerboa-native-rs/src/secure_fs.rs") (line 432) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 51)))) + (export (symbol "jerboa_secure_entry_info") (file "jerboa-native-rs/src/secure_fs.rs") (line 502) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 59)))) + (export (symbol "jerboa_secure_fd_close") (file "jerboa-native-rs/src/secure_fs.rs") (line 916) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 77)))) + (export (symbol "jerboa_secure_free") (file "jerboa-native-rs/src/secure_mem.rs") (line 113) (scheme-callers 1 (caller (file "lib/std/crypto/secure-mem.ss") (line 38)))) + (export (symbol "jerboa_secure_output_abort") (file "jerboa-native-rs/src/secure_fs.rs") (line 907) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 75)))) + (export (symbol "jerboa_secure_output_begin") (file "jerboa-native-rs/src/secure_fs.rs") (line 760) (scheme-callers 2 (caller (file "lib/std/os/secure-output.ss") (line 68)) (caller (file "lib/std/os/secure-output.ss") (line 71)))) + (export (symbol "jerboa_secure_output_begin_checked") (file "jerboa-native-rs/src/secure_fs.rs") (line 816) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 71)))) + (export (symbol "jerboa_secure_output_commit") (file "jerboa-native-rs/src/secure_fs.rs") (line 867) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 73)))) + (export (symbol "jerboa_secure_random_fill") (file "jerboa-native-rs/src/secure_mem.rs") (line 169) (scheme-callers 1 (caller (file "lib/std/crypto/secure-mem.ss") (line 44)))) + (export (symbol "jerboa_secure_read_file") (file "jerboa-native-rs/src/secure_fs.rs") (line 673) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 65)))) + (export (symbol "jerboa_secure_wipe") (file "jerboa-native-rs/src/secure_mem.rs") (line 156) (scheme-callers 1 (caller (file "lib/std/crypto/secure-mem.ss") (line 41)))) + (export (symbol "jerboa_setproctitle") (file "jerboa-native-rs/src/process_ctl.rs") (line 179) (scheme-callers 0 (none))) + (export (symbol "jerboa_sha1") (file "jerboa-native-rs/src/crypto.rs") (line 66) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 60)))) + (export (symbol "jerboa_sha256") (file "jerboa-native-rs/src/crypto.rs") (line 82) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 69)))) + (export (symbol "jerboa_sha256_ctx_final") (file "jerboa-native-rs/src/crypto.rs") (line 151) (scheme-callers 0 (none))) + (export (symbol "jerboa_sha256_ctx_free") (file "jerboa-native-rs/src/crypto.rs") (line 174) (scheme-callers 0 (none))) + (export (symbol "jerboa_sha256_ctx_new") (file "jerboa-native-rs/src/crypto.rs") (line 112) (scheme-callers 0 (none))) + (export (symbol "jerboa_sha256_ctx_update") (file "jerboa-native-rs/src/crypto.rs") (line 128) (scheme-callers 0 (none))) + (export (symbol "jerboa_sha384") (file "jerboa-native-rs/src/crypto.rs") (line 179) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 78)))) + (export (symbol "jerboa_sha512") (file "jerboa-native-rs/src/crypto.rs") (line 189) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 87)))) + (export (symbol "jerboa_sm_add_fuel") (file "jerboa-native-rs/src/wasm_sm.rs") (line 967) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 186)))) + (export (symbol "jerboa_sm_call") (file "jerboa-native-rs/src/wasm_sm.rs") (line 837) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 168)))) + (export (symbol "jerboa_sm_fuel_remaining") (file "jerboa-native-rs/src/wasm_sm.rs") (line 972) (scheme-callers 0 (none))) + (export (symbol "jerboa_sm_get_log") (file "jerboa-native-rs/src/wasm_sm.rs") (line 981) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 180)))) + (export (symbol "jerboa_sm_instance_free") (file "jerboa-native-rs/src/wasm_sm.rs") (line 828) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 162)))) + (export (symbol "jerboa_sm_instance_new") (file "jerboa-native-rs/src/wasm_sm.rs") (line 818) (scheme-callers 2 (caller (file "lib/std/wasm/sandbox.ss") (line 156)) (caller (file "lib/std/wasm/sandbox.ss") (line 174)))) + (export (symbol "jerboa_sm_instance_new_hosted") (file "jerboa-native-rs/src/wasm_sm.rs") (line 823) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 174)))) + (export (symbol "jerboa_sm_memory_read") (file "jerboa-native-rs/src/wasm_sm.rs") (line 938) (scheme-callers 0 (none))) + (export (symbol "jerboa_sm_memory_size") (file "jerboa-native-rs/src/wasm_sm.rs") (line 958) (scheme-callers 0 (none))) + (export (symbol "jerboa_sm_memory_write") (file "jerboa-native-rs/src/wasm_sm.rs") (line 948) (scheme-callers 0 (none))) + (export (symbol "jerboa_sm_module_free") (file "jerboa-native-rs/src/wasm_sm.rs") (line 777) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 150)))) + (export (symbol "jerboa_sm_module_new") (file "jerboa-native-rs/src/wasm_sm.rs") (line 697) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 144)))) + (export (symbol "jerboa_socks5_server_port") (file "jerboa-native-rs/src/socks5_server.rs") (line 250) (scheme-callers 0 (none))) + (export (symbol "jerboa_socks5_server_start") (file "jerboa-native-rs/src/socks5_server.rs") (line 111) (scheme-callers 0 (none))) + (export (symbol "jerboa_socks5_server_stats") (file "jerboa-native-rs/src/socks5_server.rs") (line 270) (scheme-callers 0 (none))) + (export (symbol "jerboa_socks5_server_stop") (file "jerboa-native-rs/src/socks5_server.rs") (line 223) (scheme-callers 0 (none))) + (export (symbol "jerboa_sqlite_bind_blob") (file "jerboa-native-rs/src/sqlite.rs") (line 318) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 63)))) + (export (symbol "jerboa_sqlite_bind_double") (file "jerboa-native-rs/src/sqlite.rs") (line 247) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 59)))) + (export (symbol "jerboa_sqlite_bind_int") (file "jerboa-native-rs/src/sqlite.rs") (line 227) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 57)))) + (export (symbol "jerboa_sqlite_bind_null") (file "jerboa-native-rs/src/sqlite.rs") (line 362) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 65)))) + (export (symbol "jerboa_sqlite_bind_text") (file "jerboa-native-rs/src/sqlite.rs") (line 267) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 61)))) + (export (symbol "jerboa_sqlite_changes") (file "jerboa-native-rs/src/sqlite.rs") (line 611) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 91)))) + (export (symbol "jerboa_sqlite_close") (file "jerboa-native-rs/src/sqlite.rs") (line 86) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 46)))) + (export (symbol "jerboa_sqlite_column_blob") (file "jerboa-native-rs/src/sqlite.rs") (line 489) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 82)))) + (export (symbol "jerboa_sqlite_column_count") (file "jerboa-native-rs/src/sqlite.rs") (line 410) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 71)))) + (export (symbol "jerboa_sqlite_column_double") (file "jerboa-native-rs/src/sqlite.rs") (line 442) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 77)))) + (export (symbol "jerboa_sqlite_column_int") (file "jerboa-native-rs/src/sqlite.rs") (line 433) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 75)))) + (export (symbol "jerboa_sqlite_column_name") (file "jerboa-native-rs/src/sqlite.rs") (line 526) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 85)))) + (export (symbol "jerboa_sqlite_column_text") (file "jerboa-native-rs/src/sqlite.rs") (line 452) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 79)))) + (export (symbol "jerboa_sqlite_column_type") (file "jerboa-native-rs/src/sqlite.rs") (line 422) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 73)))) + (export (symbol "jerboa_sqlite_errmsg") (file "jerboa-native-rs/src/sqlite.rs") (line 620) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 93)))) + (export (symbol "jerboa_sqlite_exec") (file "jerboa-native-rs/src/sqlite.rs") (line 117) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 48)))) + (export (symbol "jerboa_sqlite_finalize") (file "jerboa-native-rs/src/sqlite.rs") (line 584) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 52)))) + (export (symbol "jerboa_sqlite_last_insert_rowid") (file "jerboa-native-rs/src/sqlite.rs") (line 602) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 89)))) + (export (symbol "jerboa_sqlite_open") (file "jerboa-native-rs/src/sqlite.rs") (line 46) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 44)))) + (export (symbol "jerboa_sqlite_prepare") (file "jerboa-native-rs/src/sqlite.rs") (line 152) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 50)))) + (export (symbol "jerboa_sqlite_reset") (file "jerboa-native-rs/src/sqlite.rs") (line 564) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 54)))) + (export (symbol "jerboa_sqlite_step") (file "jerboa-native-rs/src/sqlite.rs") (line 385) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 68)))) + (export (symbol "jerboa_timing_safe_equal") (file "jerboa-native-rs/src/crypto.rs") (line 288) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 131)))) + (export (symbol "jerboa_tls_accept") (file "jerboa-native-rs/src/tls.rs") (line 808) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 86)))) + (export (symbol "jerboa_tls_close") (file "jerboa-native-rs/src/tls.rs") (line 1679) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 144)))) + (export (symbol "jerboa_tls_connect") (file "jerboa-native-rs/src/tls.rs") (line 154) (scheme-callers 5 (caller (file "lib/std/net/tls-rustls.ss") (line 92)) (caller (file "lib/std/net/tls-rustls.ss") (line 98)) (caller (file "lib/std/net/tls-rustls.ss") (line 107)) (caller (file "lib/std/net/tls-rustls.ss") (line 114)) (caller (file "lib/std/net/tls-rustls.ss") (line 121)))) + (export (symbol "jerboa_tls_connect_addr_timeout") (file "jerboa-native-rs/src/tls.rs") (line 293) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 107)))) + (export (symbol "jerboa_tls_connect_mtls") (file "jerboa-native-rs/src/tls.rs") (line 1137) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 121)))) + (export (symbol "jerboa_tls_connect_mtls_mem") (file "jerboa-native-rs/src/tls.rs") (line 1452) (scheme-callers 0 (none))) + (export (symbol "jerboa_tls_connect_mtls_pem_ca") (file "jerboa-native-rs/src/tls.rs") (line 1319) (scheme-callers 0 (none))) + (export (symbol "jerboa_tls_connect_pinned") (file "jerboa-native-rs/src/tls.rs") (line 407) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 114)))) + (export (symbol "jerboa_tls_connect_timeout") (file "jerboa-native-rs/src/tls.rs") (line 161) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 98)))) + (export (symbol "jerboa_tls_flush") (file "jerboa-native-rs/src/tls.rs") (line 1644) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 139)))) + (export (symbol "jerboa_tls_get_fd") (file "jerboa-native-rs/src/tls.rs") (line 1772) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 161)))) + (export (symbol "jerboa_tls_read") (file "jerboa-native-rs/src/tls.rs") (line 1580) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 129)))) + (export (symbol "jerboa_tls_server_free") (file "jerboa-native-rs/src/tls.rs") (line 1696) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 80)))) + (export (symbol "jerboa_tls_server_new") (file "jerboa-native-rs/src/tls.rs") (line 635) (scheme-callers 2 (caller (file "lib/std/net/tls-rustls.ss") (line 67)) (caller (file "lib/std/net/tls-rustls.ss") (line 74)))) + (export (symbol "jerboa_tls_server_new_mtls") (file "jerboa-native-rs/src/tls.rs") (line 977) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 74)))) + (export (symbol "jerboa_tls_server_new_mtls_pem") (file "jerboa-native-rs/src/tls.rs") (line 863) (scheme-callers 0 (none))) + (export (symbol "jerboa_tls_server_new_pem") (file "jerboa-native-rs/src/tls.rs") (line 737) (scheme-callers 0 (none))) + (export (symbol "jerboa_tls_set_nonblock") (file "jerboa-native-rs/src/tls.rs") (line 1703) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 150)))) + (export (symbol "jerboa_tls_set_timeout") (file "jerboa-native-rs/src/tls.rs") (line 1728) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 155)))) + (export (symbol "jerboa_tls_write") (file "jerboa-native-rs/src/tls.rs") (line 1613) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 134)))) + (export (symbol "jerboa_wasm_add_fuel") (file "jerboa-native-rs/src/wasm.rs") (line 295) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 118)))) + (export (symbol "jerboa_wasm_allow_cdb_dir") (file "jerboa-native-rs/src/wasm.rs") (line 253) (scheme-callers 0 (none))) + (export (symbol "jerboa_wasm_call") (file "jerboa-native-rs/src/wasm.rs") (line 343) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 94)))) + (export (symbol "jerboa_wasm_fuel_remaining") (file "jerboa-native-rs/src/wasm.rs") (line 318) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 124)))) + (export (symbol "jerboa_wasm_get_log") (file "jerboa-native-rs/src/wasm.rs") (line 585) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 136)))) + (export (symbol "jerboa_wasm_instance_free") (file "jerboa-native-rs/src/wasm.rs") (line 208) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 88)))) + (export (symbol "jerboa_wasm_instance_new") (file "jerboa-native-rs/src/wasm.rs") (line 154) (scheme-callers 3 (caller (file "lib/std/wasm/sandbox.ss") (line 82)) (caller (file "lib/std/wasm/sandbox.ss") (line 130)) (caller (file "tests/test-wasm-sandbox.ss") (line 500)))) + (export (symbol "jerboa_wasm_instance_new_hosted") (file "jerboa-native-rs/src/wasm.rs") (line 1124) (scheme-callers 2 (caller (file "lib/std/wasm/sandbox.ss") (line 130)) (caller (file "tests/test-wasm-sandbox.ss") (line 500)))) + (export (symbol "jerboa_wasm_memory_read") (file "jerboa-native-rs/src/wasm.rs") (line 468) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 100)))) + (export (symbol "jerboa_wasm_memory_size") (file "jerboa-native-rs/src/wasm.rs") (line 563) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 112)))) + (export (symbol "jerboa_wasm_memory_write") (file "jerboa-native-rs/src/wasm.rs") (line 513) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 106)))) + (export (symbol "jerboa_wasm_module_free") (file "jerboa-native-rs/src/wasm.rs") (line 142) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 76)))) + (export (symbol "jerboa_wasm_module_new") (file "jerboa-native-rs/src/wasm.rs") (line 104) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 70)))) + (export (symbol "jerboa_wasm_set_socket") (file "jerboa-native-rs/src/wasm.rs") (line 220) (scheme-callers 0 (none))) + (export (symbol "jerboa_writev2") (file "jerboa-native-rs/src/http_parse.rs") (line 99) (scheme-callers 1 (caller (file "lib/std/net/io.ss") (line 81)))) + (export (symbol "jerboa_x25519_diffie_hellman") (file "jerboa-native-rs/src/x25519.rs") (line 62) (scheme-callers 0 (none))) + (export (symbol "jerboa_x25519_generate_keypair") (file "jerboa-native-rs/src/x25519.rs") (line 10) (scheme-callers 0 (none))) + (export (symbol "jerboa_x25519_public_from_private") (file "jerboa-native-rs/src/x25519.rs") (line 36) (scheme-callers 0 (none))) + (export (symbol "jerboa_x509_cert_fingerprint") (file "jerboa-native-rs/src/x509.rs") (line 564) (scheme-callers 1 (caller (file "lib/std/crypto/x509.ss") (line 31)))) + (export (symbol "jerboa_x509_generate_self_signed") (file "jerboa-native-rs/src/x509.rs") (line 124) (scheme-callers 1 (caller (file "lib/std/crypto/x509.ss") (line 27)))) + (export (symbol "jerboa_x509_generate_self_signed_mem") (file "jerboa-native-rs/src/x509.rs") (line 263) (scheme-callers 0 (none))) + (export (symbol "jerboa_x509_generate_signed_by_ca_mem") (file "jerboa-native-rs/src/x509.rs") (line 388) (scheme-callers 0 (none))) + ) +) new file mode 100755 --- /dev/null +++ b/support/check-native-export-review.sh @@ -0,0 +1,139 @@ +#!/bin/sh +set -eu + +mode="${1:---check}" +report="${2:-docs/reviews/2026-07-27-native-export-review.sexp}" + +case "$mode" in + --check|--write) ;; + *) + echo "usage: check-native-export-review.sh [--check|--write] [REPORT]" >&2 + exit 2 + ;; +esac + +python3 - "$mode" "$report" <<'PY' +import pathlib +import re +import subprocess +import sys + +mode = sys.argv[1] +report_path = pathlib.Path(sys.argv[2]) +repo = pathlib.Path(".") + +def fail(msg): + print(f"native-export-review: {msg}", file=sys.stderr) + sys.exit(1) + +def tracked_files(): + out = subprocess.check_output(["git", "ls-files"], text=True) + return [pathlib.Path(line) for line in out.splitlines() if line] + +def sexp_string(value): + escaped = ( + value.replace("\\", "\\\\") + .replace('"', '\\"') + .replace("\n", "\\n") + ) + return f'"{escaped}"' + +def collect_exports(paths): + exports = [] + for path in paths: + if not str(path).startswith("jerboa-native-rs/src/") or path.suffix != ".rs": + continue + lines = path.read_text(encoding="utf-8").splitlines() + for idx, line in enumerate(lines): + if "no_mangle" not in line: + continue + for fn_idx in range(idx + 1, min(idx + 8, len(lines))): + match = re.search( + r"\bpub\s+(?:unsafe\s+)?extern\s+\"C\"\s+fn\s+([A-Za-z_][A-Za-z0-9_]*)\b", + lines[fn_idx], + ) + if match: + exports.append( + { + "symbol": match.group(1), + "file": str(path), + "line": fn_idx + 1, + } + ) + break + exports.sort(key=lambda item: (item["symbol"], item["file"], item["line"])) + return exports + +def collect_scheme_sources(paths): + prefixes = ("lib/", "src/", "mcp/", "lsp/", "tools/", "tests/", "support/") + out = [] + for path in paths: + text_path = str(path) + if path.suffix not in (".ss", ".sls"): + continue + if not text_path.startswith(prefixes): + continue + if text_path.startswith("vendor/"): + continue + out.append(path) + return out + +def collect_callers(exports, scheme_paths): + by_symbol = {item["symbol"]: [] for item in exports} + symbols = sorted(by_symbol, key=len, reverse=True) + for path in scheme_paths: + lines = path.read_text(encoding="utf-8").splitlines() + for line_no, line in enumerate(lines, 1): + for symbol in symbols: + if symbol in line: + by_symbol[symbol].append((str(path), line_no)) + return by_symbol + +def render(exports, callers): + total = len(exports) + referenced = sum(1 for item in exports if callers[item["symbol"]]) + unreferenced = total - referenced + lines = [ + "(native-export-review", + ' (schema "jerboa.native-export-review/1")', + ' (generated-by "support/check-native-export-review.sh")', + " (policy scheme-callers-or-documented)", + f" (summary (exports {total}) (scheme-referenced {referenced}) (no-scheme-reference {unreferenced}))", + " (exports", + ] + for item in exports: + symbol = item["symbol"] + refs = callers[symbol] + caller_bits = " ".join( + f"(caller (file {sexp_string(path)}) (line {line_no}))" + for path, line_no in refs + ) + if not caller_bits: + caller_bits = "(none)" + lines.append( + " (export " + f"(symbol {sexp_string(symbol)}) " + f"(file {sexp_string(item['file'])}) " + f"(line {item['line']}) " + f"(scheme-callers {len(refs)} {caller_bits}))" + ) + lines.extend([" )", ")"]) + return "\n".join(lines) + "\n" + +paths = tracked_files() +exports = collect_exports(paths) +callers = collect_callers(exports, collect_scheme_sources(paths)) +current = render(exports, callers) + +if mode == "--write": + report_path.parent.mkdir(parents=True, exist_ok=True) + report_path.write_text(current, encoding="utf-8") + print(f"native-export-review: wrote {report_path} ({len(exports)} exports)") +else: + if not report_path.exists(): + fail(f"missing report {report_path}; run support/check-native-export-review.sh --write") + expected = report_path.read_text(encoding="utf-8") + if expected != current: + fail(f"{report_path} is stale; run support/check-native-export-review.sh --write") + print(f"native-export-review: OK ({len(exports)} exports)") +PY