Update hardening metadata and Chez provenance docs
ober
4ea7d5197b7d0e62092dae394a274f21bd821ff7
--- a/data/changelog.sexp +++ b/data/changelog.sexp @@ -2,7 +2,20 @@ . "Machine-readable changelog of Jerboa API drift. Consumers (LLM tooling, lints, jerboa_verify) use this to invalidate stale recommendations and to suggest migrations when a symbol is renamed or relocated.") ("entries" - (("added" "sqlite-open-v2" "sqlite-open-bytevector" + (("added" "*sandbox-max-memory-size*" + "sandbox-config-max-memory-size") + ("date" . "2026-06-25") + ("modules_added") + ("moved") + ("notes" + . + "(std security sandbox) now accepts 'max-memory-size in make-sandbox-config and installs the corresponding child-process memory limit before running the sandbox thunk. The result channel already uses pipe(2), so stale temp-file race documentation was retired. (std async) run-async/workers now enforces its worker count with a semaphore for spawned async tasks. Vendored Chez --enable-harden now compiler-probes optional register-clearing, stack-auto-init, format-security, and static -fPIE flags. WASM, safety, hardening, Chez-fork, bundling, and API metadata docs were updated to match current implementation state.") + ("removed") + ("renamed") + ("tier_changes") + ("tools_added") + ("version" . "v0.2.3")) + (("added" "sqlite-open-v2" "sqlite-open-bytevector" "sqlite-db->bytevector" "sqlite-db?" "sqlite-execute" "sqlite-stmt?" "sqlite-bind-int!" "sqlite-bind-real!" "sqlite-bind-text!" "sqlite-bind-blob!" --- a/data/cookbooks.sexp +++ b/data/cookbooks.sexp @@ -6483,4 +6483,16 @@ "vendoring") ("title" . - "Compile static C shims without OpenSSL crypto sections"))) + "Compile static C shims without OpenSSL crypto sections")) + (("code" + . + "(import (std security sandbox))\n\n(define sandbox-cfg\n (make-sandbox-config\n 'timeout 2\n 'seccomp #f\n 'landlock #f\n 'seatbelt #f\n 'capsicum #f\n 'max-memory-size (* 256 1024 1024)))\n\n(run-safe\n (lambda ()\n ;; Untrusted or adversarial work runs in the forked child.\n (+ 20 22))\n sandbox-cfg)") ("id" . "run-safe-child-memory-limit") + ("imports" "(std security sandbox)") + ("notes" + . + "max-memory-size installs a child-process memory limit after fork and before the thunk runs. The default is #f because RLIMIT_AS behavior and Chez heap layout vary by platform. If the requested limit cannot be installed, run-safe raises a sandbox error instead of silently continuing. Use OS cgroups/containers when you need process-tree memory enforcement.") + ("tags" "run-safe" "sandbox" "memory-limit" "setrlimit" + "std-security-sandbox" "rlimit") + ("title" + . + "Cap run-safe Child Memory with max-memory-size"))) --- a/docs/Chez-changes.md +++ b/docs/Chez-changes.md @@ -10,8 +10,10 @@ maintainer narrative (themes, motivations, provenance) see [`chez-fork.md`](chez-fork.md); for the exact line-level diffs see the `.patch`-per-change series in [`../vendor/ChezScheme-patches/`](../vendor/ChezScheme-patches/). -**Scope:** 24 source-affecting changes (the rest of the divergence is the -internal logs in §6). Net diff vs. the cisco base: **63 files, +5498 / −243**. +**Scope:** source-affecting changes are tracked by the patch series in +`vendor/ChezScheme-patches/` plus the live diff command in +[Re-deriving the divergence](#re-deriving-the-divergence). The internal logs in +§6 are Jerboa-maintainer files, not Chez changes. --- @@ -38,7 +40,9 @@ FASL/data; stock Chez assumes a trusted build env. (`c/fasl.c`, `c/vfasl.c`, `c/ffi.c`, `c/foreign.c`, `c/main.c`). - **`--static` / `--foreign-libs`** configure options — hermetic static binaries (the musl-static pipeline depends on these). -- **`--enable-harden`** configure flag — opt-in hardening switch. +- **`--enable-harden`** configure flag — opt-in hardening switch, including + compiler-probed register clearing, stack auto-initialization, format-string + hardening, and static-build `-fPIE` when supported. - **Intel CET/IBT** — `ENDBR64` emission at function entries (`s/x86_64.ss`). - **ARM64 BTI** — branch-target-identification landing pads (`s/arm64.ss`). @@ -66,10 +70,12 @@ Performance only — semantics unchanged, each guarded by a regression mat. - **`sync-upstream` / `sync-upstream-status`** make targets — helpers for rebasing a Chez git checkout onto cisco upstream (`makefiles/Makefile.in`). -## 5. Routine fix not yet upstreamed +## 5. Routine fix now upstreamed -- **ppc32 + logtest repairs** (cisco PR #1045) — carried in-tree until it lands - upstream (`s/ppc32.ss`). +- **ppc32 + logtest repairs** (cisco PR #1045) — originally carried in-tree at + snapshot import time; merged into `cisco/ChezScheme` on May 11, 2026. This + divergence should collapse on the next upstream-base refresh that includes + cisco merge commit `0f1d0d8`. ## 6. Internal logs riding inside the Chez tree — NOT Chez changes --- a/docs/api-index.md +++ b/docs/api-index.md @@ -12728,7 +12728,7 @@ All 626 modules sorted by name. Export count in parentheses. | `(jerboa lock)` | 19 | `lib/jerboa/lock.sls` | | `(jerboa pkg)` | 25 | `lib/jerboa/pkg.sls` | | `(jerboa prelude clean)` | 116 | `lib/jerboa/prelude/clean.sls` | -| `(jerboa prelude safe)` | 200 | `lib/jerboa/prelude/safe.sls` | +| `(jerboa prelude safe)` | 202 | `lib/jerboa/prelude/safe.sls` | | `(jerboa prelude)` | 438 | `lib/jerboa/prelude.sls` | | `(jerboa reader)` | 21 | `lib/jerboa/reader.sls` | | `(jerboa registry)` | 9 | `lib/jerboa/registry.sls` | --- a/docs/bundling-chez.md +++ b/docs/bundling-chez.md @@ -19,9 +19,9 @@ part of the normal build. This doc records how that works and what's left. | Cross-compilation | **Done** — `make chez-cross` for Linux/FreeBSD/macOS-x86 targets | | Docker | **Done** — image builds the same `vendor/ChezScheme` (glibc + a `--static` musl variant) | | `--static` musl | **Done** — `support/musl-chez-build*.sh`, Docker musl stage | -| `--static` everywhere | **Partial** — a hermetic-build knob beyond musl/Linux isn't generalized | +| `--static` everywhere | **Partial** — Linux musl and FreeBSD release paths are wired; a single native `STATIC=1` knob is still not generalized | | Licensing / attribution | **Done** — `LICENSE-CHEZ` + README + `--version`; all bundled deps permissive; lz4 reduced to BSD `lib/` + LICENSE (zero GPL) | -| Distribution story | **Open** — release-engineering decision | +| Distribution story | **Done** — `jerboa-portable`, `release-artifact(s)`, signing, SBOM, and release evidence targets exist | ## How it works today @@ -118,13 +118,16 @@ dirs; supports multiple independent instances. divergence to re-apply on any lz4 re-vendor. 2. **Generalize `--static` (partial).** Static, hermetic Chez is wired for - musl/Linux (`musl-chez-build*.sh`, the Docker musl stage). A single - cross-platform knob (e.g. `make chez STATIC=1`, including a non-dlopen macOS - build) doesn't exist yet. - -3. **Distribution story (open).** Decide what ships: a source tarball with - `vendor/ChezScheme/` (à la Gerbil), pre-built per-arch tarballs, or both. - Release-engineering, not code. + Linux/musl (`musl-chez-build*.sh`, Docker musl, `jerboa-linux-*`) and the + FreeBSD release path uses the system static toolchain. A single native knob + (e.g. `make chez STATIC=1`, including macOS behavior that does not depend on + `dlopen`) still does not exist. + +3. **Distribution story (done).** `make jerboa-portable` stages the supported + target directories, `make release-artifact` packages one target, and + `make release-artifacts` packages the supported target set. Signing, SBOM, + reproducibility, and release-evidence targets are part of the same release + pipeline. ## Risks and non-goals --- a/docs/chez-fork.md +++ b/docs/chez-fork.md @@ -26,10 +26,9 @@ drill into the patches for specifics. `10.5.0-pre-release.1`) - **Lives in:** `vendor/ChezScheme/` (in-tree; snapshot originally imported at `a4be658a` — see `vendor/ChezScheme/UPSTREAM.md`) -- **Divergence:** 63 files, +5498 / −243 vs. the cisco base -- **Source-affecting changes:** 24, recorded one-per-file in - `vendor/ChezScheme-patches/`; the rest of the divergence is the internal - logs in "Logs that ride along" below. +- **Divergence:** re-derived with the diff command below; source-affecting + changes are recorded one-per-file in `vendor/ChezScheme-patches/`, plus live + in-tree updates made after the snapshot import. To re-derive the divergence yourself: @@ -56,7 +55,9 @@ FASL/data; stock Chez defaults assume a trusted build env. - harden FASL deserialization, FFI, and build scripts against malformed input - vfasl bounds checks + `path_append` hardening + HPUX typo - ENDBR64 emission at function entries (Intel CET/IBT) -- `--enable-harden` configure flag + ARM64 BTI landing pads +- `--enable-harden` configure flag + ARM64 BTI landing pads + optional probed + compiler mitigations (`-fzero-call-used-regs`, stack auto-init, + format-security, static `-fPIE`) Touches: `c/fasl.c`, `c/vfasl.c`, `c/main.c`, `s/x86_64.ss`, `s/arm64.ss`, `configure`, `c/build.zuo`. @@ -115,9 +116,12 @@ source. They ride along for editing convenience but are **not upstream-relevant* - `CLAUDE.md` — Claude instructions for work *inside* the Chez tree - `bench/jerboa-bench.ss` — jerboa-specific benchmark suite -### Routine fixes not yet upstreamed +### Routine fixes now upstreamed -- ppc32 + logtest repairs (cisco PR #1045) — carried until it lands upstream +- ppc32 + logtest repairs (cisco PR #1045) — carried in the imported snapshot; + merged into `cisco/ChezScheme` on May 11, 2026. This divergence should drop + out on the next upstream-base refresh that includes cisco merge commit + `0f1d0d8`. ## Keeping this doc current --- a/vendor/ChezScheme/UPSTREAM.md +++ b/vendor/ChezScheme/UPSTREAM.md @@ -21,6 +21,9 @@ This file (UPSTREAM.md) records *provenance* only. 10.5.0-pre-release.1) - **Snapshot imported:** 2026-05-14, at fork commit `a4be658a9ff07fcbc3b578aad28aec317422862c` ("ppc32 and logtest repairs (#1045)") +- **Upstream status of snapshot head:** cisco/ChezScheme PR #1045 was merged on + 2026-05-11 as merge commit `0f1d0d8`; the next upstream-base refresh can + collapse that local routine-fix divergence. - **Method:** flat snapshot — `.git/` stripped, no history preserved here; now maintained in-tree as ordinary files