PHPackages                             twarimitswe-aaron/gatekeeper-cdr - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Image & Media](/categories/media)
4. /
5. twarimitswe-aaron/gatekeeper-cdr

ActiveLibrary[Image & Media](/categories/media)

twarimitswe-aaron/gatekeeper-cdr
================================

A zero-trust Content Disarm and Reconstruction (CDR) engine for multi-format file sanitisation.

v0.4.8(1mo ago)112AGPL-3.0-onlyRustPHP >=8.1CI passing

Since Jun 23Pushed 1mo agoCompare

[ Source](https://github.com/Twarimitswe-Aaron/gatekeeper-cdr)[ Packagist](https://packagist.org/packages/twarimitswe-aaron/gatekeeper-cdr)[ RSS](/packages/twarimitswe-aaron-gatekeeper-cdr/feed)WikiDiscussions main Synced 2w ago

READMEChangelogDependenciesVersions (10)Used By (0)

🛡️ Gatekeeper
=============

[](#️-gatekeeper)

**A zero-trust Content Disarm and Reconstruction (CDR) engine written in pure, memory-safe Rust.**

[![License: AGPL v3](https://camo.githubusercontent.com/c61341f63648cdd5aba4f7a073b513106a63778c27b15f96c56157642bc943b4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4147504c25323076332d626c75652e737667)](https://www.gnu.org/licenses/agpl-3.0)[![Rust Edition](https://camo.githubusercontent.com/3615d24ebb451c51247290357ecb4ec34c08a19a40e905376364a20232702a59/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5275737425323045646974696f6e2d323032342d6f72616e6765)](https://doc.rust-lang.org/edition-guide/rust-2024/)[![Build](https://camo.githubusercontent.com/b0c6c6845a74cb65a7f0a32bdcfd8fbf80eeb40026c4029af424ab371c94b8bd/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6275696c642d70617373696e672d627269676874677265656e)](#)[![PRs Welcome](https://camo.githubusercontent.com/dd0b24c1e6776719edb2c273548a510d6490d8d25269a043dfabbd38419905da/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5052732d77656c636f6d652d627269676874677265656e2e737667)](CONTRIBUTING.md)

> Strip every byte of hidden metadata, embedded exploits, steganographic payloads, and trailing attachments from incoming file streams — and reconstruct a mathematically clean output from raw pixel data up.

---

Table of Contents
-----------------

[](#table-of-contents)

- [What is Gatekeeper?](#what-is-gatekeeper)
- [Why CDR?](#why-cdr)
- [Architecture](#architecture)
    - [Memory Model](#memory-model)
    - [Typestate Pipeline](#typestate-pipeline)
    - [Error Model](#error-model)
- [Supported Formats](#supported-formats)
- [Project Structure](#project-structure)
- [Getting Started](#getting-started)
    - [Prerequisites](#prerequisites)
    - [Build](#build)
    - [Run Tests](#run-tests)
    - [Run the CLI Example](#run-the-cli-example)
- [Using Gatekeeper as a Library](#using-gatekeeper-as-a-library)
    - [As a Rust Dependency](#as-a-rust-dependency)
    - [API Reference](#api-reference)
- [FFI Bindings (Planned)](#ffi-bindings-planned)
- [Roadmap](#roadmap)
- [Contributing](#contributing)

- [License](#license)

---

What is Gatekeeper?
-------------------

[](#what-is-gatekeeper)

Gatekeeper is a **static library** that accepts multi-format file byte streams, surgically removes all non-pixel content, and reconstructs an immaculate output binary from the raw colour matrix upward. It is designed to be embedded directly into application source repositories via native FFI bindings — no infrastructure changes required.

**It does not scrub files in place.** The entire philosophy is:

> *Decode to naked pixels. Re-encode from zero. Share nothing with the original.*

---

Why CDR?
--------

[](#why-cdr)

A file that "looks" clean to a human viewer can carry:

Threat VectorExampleSteganographic payloadsData hidden in JPEG DCT coefficient LSBsExploit shellcodeEmbedded in APP0–APP15 markersPersonal data leakageEXIF GPS coordinates, device serial numbersTracking fingerprintsICC profile unique identifiersPolyglot containersExecutable bytes after the EOI/IEND markerC2 callbacksURLs encoded inside COM/XMP marker blocksClassic AV scanning **misses all of these**. CDR eliminates the attack surface entirely by making it structurally impossible for the output to contain anything other than colour values.

---

Architecture
------------

[](#architecture)

### Memory Model

[](#memory-model)

Gatekeeper enforces a strict **zero-copy architecture** at the format-detection layer:

```
caller buffer (&[u8])
       │
       ▼
 sniff_format()   ← direct slice equality payload[..N] == MAGIC, zero heap
       │
       ▼
 disarm()         ← ZCursor borrows the slice; no copy until decode
       │
       ▼
 sanitizer        ← one heap allocation for the decoded pixel buffer
       │
       ▼
SanitizedOutput   ← one heap allocation for the re-encoded PNG output

```

The sniffer compares magic bytes using **direct subslice equality** (`payload[..2] == JPEG_SOI`). No intermediate buffers or `Vec` are constructed during format detection — the comparison resolves in a single register-level load.

### Typestate Pipeline

[](#typestate-pipeline)

Every sanitizer enforces its stage transitions at **compile time** using Rust's typestate pattern with **newtype tuple structs**. Calling stages out of order is a **compile error**, not a runtime panic. Passing raw bytes to a save routine is also a **compile error** — only `SanitizedOutput` is accepted.

```
RawPayload