[Caml-list] Attn: Development Editor, Latest OCaml Weekly News

Alan Schmitt
2026-01-13T08:27:38Z

[-- Attachment #1: Type: text/plain, Size: 14331 bytes --]

Hello

Here is the latest OCaml Weekly News, for the week of January 06 to 13,
2026.

Table of Contents
─────────────────

camlid: A library for building C stub generators
restricted 1.1 - Restrict possible system operations and filesystem view of your program
OCaml Security Team 2025 End-Of-Year Report
Lwt.6.0.0 release (direct-style, tracing)
Other OCaml News
Old CWN

camlid: A library for building C stub generators
════════════════════════════════════════════════

Archive:
<https://discuss.ocaml.org/t/ann-camlid-a-library-for-building-c-stub-generators/17679/1>

François Bobot announced
────────────────────────

Dear all,

I'm happy to announce the first release of [camlid] ([documentation]).

While there are many C stub generators for OCaml, **camlid** takes a
different approach: it is an OCaml library designed to help you build
custom C stub generators.

*Key Comparisons*:

• Vs. *Ctypes*: Manipulation of C structures stays in C. You don't
need to replicate C type descriptions in OCaml, keeping the
compilation and maintenance simple.
• Vs. *Camlidl/SWIG*: The generator is written in pure OCaml. This
makes it easier to factorize and customize your bindings without
resorting to `m4', `sed', or complex external DSLs.

*Highlighted Features*:

• *Library-specific initialization*: Easily handle data structure
setup.
• *Native Optimization*: supports `unboxed~/~untagged' parameters in
native mode.
• *Automated Definitions*: Automatically generates the C/OCaml
definitions your generated code uses. Referencing a generated C
function name in your generated OCaml code automatically triggers
its generation in the C file.
• *Free Variables*: Generated functions can contain free variables
that are automatically added as formal parameters. This allows you
to easily pass a global "context" or "handle" through a generic
function without manual boilerplate.

*Example Usage*: Using the built-in helpers, a generator is as simple
as:

┌────
│ open Camlid
│ open Helper
│
│ let () = Generate.to_file
│ (* Indicates the basename used for the generated files *)
│ "mylib"
│ (* Indicates header to include *)
│ ~headers:["alib.h"]
│ [
│ func "f_input" [ input int_trunc];
│ func "f_output" [ output (ptr_ref int_trunc)];
│ func "f_with_res" [] ~result:int_trunc;
│ func "f_no_arg_no_result" [];
│ ]
└────

Only the `mli' of the generated module remains to be written with the
documentation. For the first function above, the parameter is
correctly marked as `untagged' (for OCaml versions that support it):

┌────
│ external f_input: (int [@untagged]) -> unit = "camlid_stub_f_input_byte" "camlid_stub_f_input"
└────

A more complex example (converting the `flint' binding from Ctypes)
can be found [here].

The API is still experimental, and I would love to hear your feedback
on the organization and naming! The package is already in the opam
repository.

(The [modern-ocaml] template is awesome!)

[camlid] <https://github.com/bobot/camlid>

[documentation] <https://bobot.github.io/camlid/camlid/index.html>

[here]
<https://github.com/bobot/ocaml-flint/pull/10/files#diff-ac9bf61dc6c9a2b5edccd9dbf8e06b5ba1d095773061b4f0318addca4e46a59e>

[modern-ocaml] <https://github.com/Khady/modern-ocaml/>

restricted 1.1 - Restrict possible system operations and filesystem view of your program
════════════════════════════════════════════════════════════════════════════════════════

Archive:
<https://discuss.ocaml.org/t/ann-restricted-1-1-restrict-possible-system-operations-and-filesystem-view-of-your-program/17681/1>

removewingman announced
───────────────────────

Hello,

I would like to announce a new package [restricted].

This library lets you limit which system operations and which parts of
the filesystem your program can access. Call it as early as possible
in your program so that the rest of the code runs with reduced
privileges. Currently, actual enforced restrictions are implemented
for these operating systems:

• OpenBSD

Even on other operating systems, you can still use `restricted' to
document which privileges your program needs. Users can then test that
your program respects these promises with tools such as [pledge on
Linux]. Enjoy ;)

• opam: <https://opam.ocaml.org/packages/restricted/>
• homepage: <https://codeberg.org/removewingman/restricted>
• Documented Interface and Examples:
<https://codeberg.org/removewingman/restricted#usage-and-examples>
• License: [AGPL]

This is my first ocaml library so feel free to give feedback.

[restricted] <https://opam.ocaml.org/packages/restricted/>

[pledge on Linux] <https://justine.lol/pledge/>

[AGPL] <https://en.wikipedia.org/wiki/GNU_Affero_General_Public_License>

OCaml Security Team 2025 End-Of-Year Report
═══════════════════════════════════════════

Archive:
<https://discuss.ocaml.org/t/ocaml-security-team-2025-end-of-year-report/17689/1>

Hannes Mehnert announced
────────────────────────

OCaml Security Team 2025 End-Of-Year Report
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

In May of 2025, the OCaml Software Foundation encouraged the formation
of an OCaml Security Team, which would handle issues and provide
guidance for improving software security in the OCaml
ecosystem. Throughout 2025, the team has been building structure and
procedures to accomplish these goals. A regular public update on the
team's activity is among many good ideas taken from the Haskell
Security Response Team, and we hope the community will find this first
public update useful.

The team consists of:

• Hannes Mehnert - @hannesm - individual, robur.coop
• Mindy Preston - @yomimono - individual
• Joe - @cfcs - individual
• Edwin Török - @edwintorok - individual
• Nicolás Ojeda Bär - @nojb - LexiFi
• Louis Roché - @Khady - ahrefs
• Boning Dong - Bloomberg

Until December 2025:
• Maxim Grankin - @maxim092001 - Bloomberg

The newly created website [ocaml.org/security] gives some guidelines
for people finding security issues.

[ocaml.org/security] <https://ocaml.org/security>

Contact and Disclosure Process
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

The team established a procedure for reporting security issues as one
of its first activities. The security disclosure process is available
at
<https://github.com/ocaml/security-advisories?tab=readme-ov-file#reporting-vulnerabilities>
. The OCaml Security Team can also be contacted at security@ocaml.org
for matters besides vulnerability disclosure. Mails to
security@ocaml.org are not public.

The public, announce-only mailing list
<https://sympa.inria.fr/sympa/info/ocsf-ocaml-security-announcements>
will broadcast information on security advisories.

These procedures were [announced in July 2025].

[announced in July 2025]
<https://discuss.ocaml.org/t/ann-ocaml-security-team>

Vulnerability Database
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

A public vulnerability database for OCaml software is another of the
Security Team's goals. We indend to accomplish this by publishing
information from the existing, but empty
<https://github.com/ocaml/security-advisories> to the public [osv.dev]
database (again borrowing a good idea from the Haskell SRT). Some work
on a pipeline for publishing advisories there and backporting existing
advisories is ongoing.

[osv.dev] <https://osv.dev>

Tool development
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

An OCaml library that supports the [package URL] "purl" was developed
and released to the opam-repository
(<https://github.com/hannesm/purl>,
<https://ocaml.org/p/purl/latest>). In the process, we propose to make
the policy for opam-repository more strict to have immutable packages
(where the source is not modified):
<https://github.com/ocaml/opam-repository/pull/29072>. We also propose
to integrate opam into the package URL specification
<https://github.com/package-url/purl-spec/pull/763>.

The vulnerability database mentioned above hosts advisories in
markdown (with some opam-file-format metadata header). We developed
[tooling] to convert these into json (following the json schema from
osv.dev). We also made OCaml/opam known for the schema
<https://github.com/ossf/osv-schema/pull/473>.

[package URL] <https://github.com/package-url/purl-spec>

[tooling] <https://github.com/hannesm/advisories>

Public Meetings and Presentations
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

On September 15, Hannes Mehnert gave an introduction to the OCaml
Security Team at [FUN OCaml] in Warsaw.

Maxim Grankin gave a talk ["Towards a More Secure OCaml Ecosystem"] at
the OCaml Users and Developers Workshop in October of 2025, which is
available at <https://www.youtube.com/watch?v=PekeGxGlc3Q> .

On October 22 2025, the Security Team held a public meeting, for which
the notes are available at
<https://pad.data.coop/7-Ic5rG6ToynsW02hJsndg?both> .

[FUN OCaml] <https://fun-ocaml.com/>

["Towards a More Secure OCaml Ecosystem"]
<https://conf.researchr.org/details/icfp-splash-2025/ocaml-2025-papers/9/Toward-a-More-Secure-OCaml-Ecosystem>

Advisories
╌╌╌╌╌╌╌╌╌╌

A potential clickjacking issue with ocurrent's web interface was
reported to the Security Team by Kunal Mhaske was fixed by Mark Elvers
in <https://github.com/ocurrent/ocurrent/pull/465> .

No other communications with the security team have resulted in
publicly available remediation information or advisories.

Future Plans
╌╌╌╌╌╌╌╌╌╌╌╌

The Security Team has received a lot of interest in the advisory
database mentioned above, and this work is a high priority for the
team.

The Security Team also hopes to publish security guides for OCaml
programmers and project maintainers.

The OCaml Software Foundation has indicated that some funding may be
available for projects that make OCaml more secure. The Security Team
is actively developing a process for soliciting and evaluating
proposals, as discussed in the October public meeting.

Acknowledgements
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

The Security Team is an initiative of the OCaml Software Foundation
and is grateful to the OCSF and its sponsors for their support.

Lwt.6.0.0 release (direct-style, tracing)
═════════════════════════════════════════

Archive:
<https://discuss.ocaml.org/t/ann-lwt-6-0-0-release-direct-style-tracing/17690/1>

Raphaël Proust announced
────────────────────────

Version 6.0.0 of Lwt has been [released] through opam! This new
version of Lwt brings the following notable additions:

• Lwt_direct: a package/library for using Lwt in
direct-style. (Contribution from @c-cube)
• Lwt_runtime_events: a package/library for emmitting runtime-events.

Check the [release notes] for a full changelog), including removal of
some deprecated values.

[released] <https://github.com/ocsigen/lwt/releases/tag/6.0.0>

[release notes] <https://github.com/ocsigen/lwt/releases/tag/6.0.0>

Other OCaml News
════════════════

>From the ocaml.org blog
───────────────────────

Here are links from many OCaml blogs aggregated at [the ocaml.org
blog].

• [OCaml Roundup: December 2025]
• [Opam 104: Sharing Your Code]
• [Devcontainer for using O(x)Caml and Claude in your projects]
• [What would make OCaml serverless ready?]
• [Fun with Algebraic Effects - from Toy Examples to Hardcaml
Simulations]

[the ocaml.org blog] <https://ocaml.org/blog/>

[OCaml Roundup: December 2025]
<https://patrick.sirref.org/ocaml-roundup-december-2025/>

[Opam 104: Sharing Your Code]
<https://ocamlpro.com/blog/2026_01_08_opam_104_sharing_your_code>

[Devcontainer for using O(x)Caml and Claude in your projects]
<https://anil.recoil.org/notes/ocaml-claude-dev>

[What would make OCaml serverless ready?]
<https://www.chrisarmstrong.dev/posts/what-would-make-ocaml-serverless-ready>

[Fun with Algebraic Effects - from Toy Examples to Hardcaml Simulations]
<https://blog.janestreet.com/fun-with-algebraic-effects-hardcaml/>

Old CWN
═══════

If you happen to miss a CWN, you can [send me a message] and I'll mail
it to you, or go take a look at [the archive] or the [RSS feed of the
archives].

If you also wish to receive it every week by mail, you may subscribe
to the [caml-list].

[Alan Schmitt]

[send me a message] <mailto:alan.schmitt@polytechnique.org>

[the archive] <https://alan.petitepomme.net/cwn/>

[RSS feed of the archives] <https://alan.petitepomme.net/cwn/cwn.rss>

[caml-list] <https://sympa.inria.fr/sympa/info/caml-list>

[Alan Schmitt] <https://alan.petitepomme.net/>

[-- Attachment #2: Type: text/html, Size: 26751 bytes --]