OCaml Weekly News

Semgrep is an application security company focused on detecting and remediating vulnerabilities. The static analysis engine is primarily written in OCaml. We're looking for a senior or staff software engineer to help us enhance our third-party vulnerability detection capabilities. The ideal candidate has owned a critical tool, has worked on an OCaml project, has experience leading development teams and mentoring, and has some experience with supply chain security.

If this sounds interesting to you, see our job posting at Senior/Staff Program Analysis Engineer, Supply Chain! Let me know if you have any questions!

An OCaml library with documentation!?

Yes. I realize it's unorthodox, but I thought I'd give it a shot.

I began my programming journey a bit later than most, and I began it with Bash. Over the years I've grown apart from Bash and even written some semi-popular anti-Bash propaganda.

However, while I'm not particularly a fan of shell programming languages, I've maintained a long-term interest in the types of automation tasks which the shell lends itself to, and I have a soft spot in my heart for languages which make this type of programming a priority—languages such as AWK, Perl and Ruby.

Since learning OCaml, I always felt that it could be a good language for these kinds of jobs with its light syntax, extensive Unix interface and great regex libraries (I'm talking about Re and friends, not Str).

However, I always felt the provided interfaces for working with processes were… not quite what I was looking for. Sys.command (combined with Filename.quote_command, of course) is OK for what it does, but it doesn't do much. The more extensive set of process handling commands in the Unix library make just about anything possible, but they don't feel good to me.

So I set out to create a library for working with Unix commands which feels right to me. Subprocess focuses on safety and ease of use—in that order. I hope someone besides myself will feel the same about it.

Note that this is the first release (and my first public OCaml library) and I welcome feedback and criticism.

• Github: https://github.com/ninjaaron/ocaml-subprocess
• Opam: https://ocaml.org/p/subprocess/latest
• Odoc docs: https://ninjaaron.github.io/ocaml-subprocess/subprocess/index.html

cudajit 0.7.0 is now available in the opam repository. It is now split into separate libraries covering NVRTC bindings and CUDA bindings, so that Nvrtc doesn't need CUDA drivers to run.

Version 0.7.0 brings full native Windows compatibility.

Version 0.6.0 improves memory safety and debuggability.

cudajit.0.7.0 can be used with OCANNL neural_nets_lib.0.5.2 also in the opam repository. Enjoy!

Version 0.8 of qcheck-lin, qcheck-stm, and qcheck-multicoretests-util was just merged on the opam repository: https://github.com/ocaml-multicore/multicoretests/releases/tag/0.8

The 0.8 release improves the error finding ability of the Lin_thread and STM_thread modes:

• #540: Significantly increase the probability of context switching in Lin_thread and STM_thread by utilizing Gc.Memprof callbacks. Avoid on 5.0-5.2 without Gc.Memprof support.
• #546: Speed up Lin's default string and bytes shrinkers.
• #547: Add Util.Pp.{cst4,cst5}

Happy testing! :smiley:

The opam-repository needs your help! :camel::heart:

tl;dr: Want to grow your OCaml connections and expertise while supporting a pillar of the ecosystem? Then join us as an opam-repository maintainer by commenting on the issue Volunteer to Maintain the opam Repository :raised_hand_with_fingers_splayed:!

The opam-repository is the official store of package descriptions for the extended OCaml ecosystem. It serves more than 4400 packages thru the opam package manager and index, and it is approaching 200 new packages and releases per month. The opam system is unique among widely used programming language packaging systems in offering the following:

• It supports system dependencies to abstract over the packaging complexities of most commonly used platforms.
• It is tested by an extensive CI matrix to ensure packages are working, installable, and interoperable.
• It is curated to cultivate an ecosystem of high quality, useful packages.

This all takes a lot of work and it presents a wide field of interesting socio-technical problems and exciting opportunities.

Here are two of the projects we've tackled recently:

• Organizing and executing the archiving initiative, led by @hannes, and presented in "Pushing the opam-repository into a sustainable repository"
• Work to Improve the CI systems and maintain the infrastructure

The opam-repository maintainers needs the help of curious and motivated volunteers, like you!

Hi fellow camel-wranglers,

It has been a bit quiet with updates lately with regards to the Dune package management feature, but it doesn't mean that the work has stalled. We're still continuing and got to a point where the code is mature enough to test it on all packages in OPAM-repository.

Some of you might be aware of OPAM-health-check: a tool/service that monitors how much of the OPAM ecosystem can be built successfully. We extended it to build packages with Dune.

It's a bit of a longer read, with all the explanations and thoughts that went into this, but I am sure it'll be interesting for you what challenges we had, what progress happened in the last few months and most importantly, where we currently are:

https://tarides.com/blog/2025-04-11-expanding-dune-package-management-to-the-rest-of-the-ecosystem/

We're of course not done yet. So expect more update posts as we try to get as many projects working as possible in the future. If you have questions, ideas, suggestions, feel free to drop in in this thread :-)

Thanks go out to my coworkers involved in this effort (@gridbugs @maiste @art-w @ElectreAAS @shym @mtelvers).

Thank you for the attendance! This was a very dense meeting :) The minutes of the meeting are available here

Hi everyone,

after we added the OCaml Cookbook on OCaml.org, we got into a position where we

1. had contributions sitting around for a while because we did not have the capacity to review and moderate these additions, and
2. felt we do not have a good enough understanding of the ecosystem in general to assess whether the chosen libraries are reasonable, or whether there's other options that need to be mentioned.

To make the cookbook really useful, we need to build a better process around maintaining it and adding to it.

I propose:

1. We appoint a handful of moderators / maintainers for the OCaml Cookbook, drawing from volunteers.
2. I create a Telegram group to stay in contact with you all to ask for help on cookbook PRs. (This could a group focused precisely on the OCaml Cookbook.)

So, if you're up for helping with the cookbook, have any questions, or other remarks, please reach out to sabine@tarides.com, or reply here! :orange_heart:

Hey everyone!

To learn a bit of networking and eio, I wrote an scgi library with eio support. It aims to just implement the scgi protocol and a few helpers for writing HTTP responses. It's still very new, and I am looking for feedback on the interface and implementation before I publish it to opam.

Here's a simple ping/pong example to get started:

open Scgi_eio

let handler (request : Request.t) =
  match Request.path request with
  | ["ping"] ->
      Http_response.body_string `Ok "pong"
  | _ ->
      Http_response.body_status `Not_found

let () : unit =
  let port = 3000 in
  Eio_main.run
  @@ fun env ->
  let addr = `Tcp (Eio.Net.Ipaddr.V4.loopback, port) in
  let net = Eio.Stdenv.net env in
  Eio.Switch.run
  @@ fun sw ->
  let conn = Eio.Net.listen net ~sw ~reuse_addr:true ~backlog:5 addr in
  Eio.traceln "Listening to connections on port %s" (string_of_int port) ;
  Eio.Net.run_server conn
    (Scgi_eio.http_server ~settings:Scgi_eio.default_settings handler)
    ~on_error:(Eio.traceln "Error handling connection: %a" Fmt.exn)

Here are links from many OCaml blogs aggregated at the ocaml.org blog.

• Expanding Dune Package Management to the Rest of the Ecosystem
• DNSvizor - run your own DHCP and DNS MirageOS unikernel - gets some testing