jerboa-mail

Reusable email parsing and MIME helpers for Jerboa.

The initial scope is read-oriented:

• RFC 5322 header/body splitting.
• Header unfolding and lookup.
• RFC 2047 encoded-word decoding for common UTF-8/ASCII cases.
• Base64 and quoted-printable content-transfer decoding.
• Simple MIME parsing for text and multipart messages.
• Best-effort body selection for CLI mail readers.

Sending helpers can be added later, but this first version is intentionally small and fixture-driven.

Security posture

jerboa-mail parses hostile mail input and remains private/experimental until the release gates in SECURITY.md, docs/threat-model.md, and docs/release-evidence.md are complete.

The parser library is capability-free by design: it does not open files, call the shell, use the network, load dynamic libraries, use FFI, or handle credentials. The local security gate enforces that parser and test source keep that shape.

Default parser limits are exported as parameters for callers that need tighter deployment budgets:

Decoded HTML and MIME metadata are still hostile data. Callers that display mail must follow docs/rendering-policy.md; this library does not sanitize HTML or make body text safe for browser rendering.

• mail-max-message-chars: 25 MiB.
• mail-max-header-chars: 256 KiB.
• mail-max-header-lines: 4096.
• mail-max-line-chars: 64 KiB.
• mail-max-transfer-encoded-chars: 25 MiB.
• mail-max-encoded-word-chars: 64 KiB.
• mail-max-mime-depth: 16.
• mail-max-mime-parts: 1024 total nodes across the complete message tree, including the root, multipart containers, and leaves.
• mail-max-mime-header-chars: 4 MiB total across all MIME nodes.
• mail-max-mime-decoded-chars: 25 MiB total retained decoded/body text across all MIME leaves.
• mail-max-boundary-chars: 200.

Development

make test
make corpus-smoke
make fuzz-evidence
make verify
make release-evidence