Repository navigation
The Pledge
Two rules, in this order.
1. The bar. Every feature is at least what the shipping browsers offer, and better where it can be. The standard is the floor, not the goal. Where Sashfold is short of it today — Not written yet lists where — the work is not done; nothing on that list was decided against, and nothing below this line is a reason to leave a feature short.
2. From scratch, wherever that is possible. The code that ships in a Sashfold binary is written in the Sashfold repository. Where a thing cannot be written here — the graphics card's driver, the operating system's own TLS on Windows and macOS — Sashfold uses what the platform provides, as every browser does, and this page says so.
| Sashfold calls it platform | Because |
|---|---|
| OS system interfaces — Win32; AppKit through the Objective-C runtime; the Linux kernel and the display server's wire protocols | On each OS that interface is the machine. On Linux Sashfold links no GTK, Qt, SDL, libwayland or X libraries: Wayland is a protocol over a socket, spoken directly, the way HTTP is |
| The language runtime — libc, libstdc++ | Every program on the OS links it; below it is kernel ABI |
| OS-shipped TLS on Windows and macOS (SChannel, Network.framework) | It ships with, and is patched by, the OS. Linux has no OS TLS; there the TLS client is Sashfold's own |
Everything above that line is Sashfold's to write: HTML and CSS parsing, layout, text (font parsing and rasterization), the image, sound and compression codecs, HTTP and cookies, TLS on Linux, storage, devtools, the shells, and the JavaScript engine with its compiler.
| Sashfold uses | Because |
|---|---|
| The graphics card's driver, through Vulkan and VA-API, loaded when a video is played (Linux) | A video's pictures are decoded on the card, as every browser decodes them; a driver is not a thing a browser can write. The binary does not link them: they are opened at run time where the machine has them |
| The desktop's services, by their protocols — the compositor, the sound server, the session bus and its notification service | Spoken over their sockets by code in this repository; nothing of theirs is linked |
When the bar asks for something only the platform can give, it goes in this table. A feature is never left out to keep the table short.
- Build tools. The compiler, CMake and Ninja never ship.
- Data is not code. Unicode tables, conformance-test fixtures, your installed fonts and your root-certificate store are inputs that Sashfold's own code parses. Parsing the world's data is the job.
tools/pledge-check.sh reads the built binary's import table and fails the build when anything outside the per-OS allowlist appears. The allowlists are tools/pledge-allowlist-windows.txt, -linux.txt and -macos.txt; on Windows the list is six OS libraries (kernel32, msvcrt, ws2_32, secur32, user32, gdi32), each of which arrived with the platform work that needs it. The language runtime is linked statically, so it never appears.
A companion check, tools/egress-check.sh, keeps the network primitives behind one choke point: sockets are opened in one place, and every request goes through fetch().
Both checks run in CI on every push, and bash tools/buildall.sh runs them locally after the two compiler lanes.
Writing it here is also a security posture: there is no supply chain to compromise, no vendored library to fall behind, no ABI to drift. It also shapes the language choice — see Why C++.
Getting started
What works today
Measured
Design decisions
Testing and tools