Docs overview

Build & integrate

Hook Frontera into your build.

Protect rewrite, static link, and post-link stamp are one pipeline—not optional extras.

Pipeline

  1. Build libfrontera.a (and optionally libphomo.a).
  2. Run sources through frontera-protect (attribute → RKVM stubs).
  3. Link with libfrontera.a, D runtime, and system libraries.
  4. Run frontera-stamp on the linked binary.

cxx-frontera.sh

Preferred driver for hand-rolled builds. It rewrites each .cpp, compiles with your flags, pulls in phomo when available, and stamps -o output:

shellbash
/path/to/frontera/scripts/cxx-frontera.sh g++ main.cpp \
  -std=c++20 -I. -O2 ./libfrontera.a \
  -L"$HOME/dlang/ldc-1.42.0/lib" -lphobos2-ldc -ldruntime-ldc \
  -lpthread -ldl -lm -o myapp

Link requirements

ArtifactRole
libfrontera.aAntitamper + RKVM runtime (D)
libphomo.aOptional eBPF ptrace watcher
-lphobos2-ldc -ldruntime-ldcLDC D runtime
-lpthread -ldl -lmSystem deps
-lelf -lzRequired with phomo

CMake

Include cmake/Frontera.cmake and use frontera_add_executable (orfrontera_protect_sources, frontera_link_target,frontera_stamp_target). From the Frontera tree:

shellbash
cmake -S examples/cmake-app -B examples/cmake-app/build \
  -DFRONTERA_ROOT="$(pwd)"
cmake --build examples/cmake-app/build
./examples/cmake-app/build/frontera_example

Set FRONTERA_ROOT and, if needed, FRONTERA_LDC_LIB to your LDC library directory.

What frontera_at_start does

Whether you call it from C or a protected stub injects it:

main.cC · GNU/Linux
#include "frontera_at.h"

int main(void) {
    if (frontera_at_start() != FRONTERA_AT_OK)
        return 1;
    /* application */
    return 0;
}
  1. frontera_check_self_integrity() — on-disk digest + memory baseline.
  2. frontera_vm_guard() — may hard-exit on high VM score.
  3. phomo_at_start() — soft-fail without CAP_BPF / root.

Inspect failures with frontera_at_last_error(). WithFRONTERA_HARD_ABORT (default under strong mode), C++runtime_init() may _Exit(1) on AT failure.

Platform notes