jerboa-sinatra

A Sinatra-style web framework ported to Jerboa.

Status: experimental Lane B web framework. Do not use it for a public production application until the remaining release gates in SECURITY.md and docs/threat-model.md are closed for the application that embeds it.

Build

make build

Test

make test

The Makefile derives JERBOA_HOME from the selected jerbuild when possible. Override with JERBOA_HOME=/path/to/jerboa or JERBUILD=/path/to/jerbuild if needed.

Security Verification

make verify
make target-evidence
make release-evidence

make verify runs the static security gate, test suite, public module import check, web security smoke tests, deterministic web security corpus, bounded handler soak evidence, example binary build, and local dependency/toolchain audit. make target-evidence records the production-only hosted load, proxy/TLS, fuzzing, deployment, and external-review gates. make release-evidence adds SBOM/toolchain provenance and repeated clean-build reproducibility evidence under dist/release-evidence/.

When ../jerboa/dist/jerboa is present, the Makefile uses it so release checks exercise current Jerboa binary hardening and deterministic-build features. It falls back to jerboa on hosts that do not have an adjacent source checkout.

The framework now HTML-escapes render-string template substitutions by default, rejects CR/LF in generated headers and cookies, signs sessions with constant-work comparison, uses secure session cookies by default, bounds static file reads through descriptor-relative no-follow opens, rejects static traversal and link escapes, binds loopback by default, enforces finite connection, per-source, idle, header, and body budgets, hides exception details by default, rejects Transfer-Encoding plus Content-Length, rejects unsupported method overrides, and records a 512-case route/cookie/template/static security corpus plus a 2048-request local bounded handler soak.

Plain HTTP request bodies default to 4 MiB. Applications may choose a bounded per-server ceiling before startup with (set-option! "max-body-size" bytes); the underlying Jerboa HTTP server validates values from zero through 1 GiB.

CI deliberately fails closed at the Jerbuild installation step until the Jerboa producer publishes a signed release manifest and this repository provisions the matching signer and digest in support/jerbuild-bootstrap.lock.

Example Binary

make binary
JERBOA_SINATRA_SESSION_SECRET="$(openssl rand -hex 32)" ./dist/jerboa-sinatra-example

For a fully static Linux amd64 example binary:

make static-binary