Why CHERI
CHERI and existing software
CHERI is designed to work with established C and C++ ecosystems through adapted compilers, operating systems and ABIs.
Why it matters
This creates a migration path for valuable software that cannot be rewritten all at once.
In brief
CHERI is designed to work with established C and C++ ecosystems through adapted compilers, operating systems and ABIs. Existing source can often be recompiled and ported incrementally, with diagnostics and faults exposing assumptions that need correction.
Key considerations
1. Assess
Inventory source, binary-only dependencies, assembly, libraries, build systems and platform interfaces.
2. Choose a mode
Use hybrid support for selected capability use or a pure-capability ABI for broad pointer protection, according to the platform.
3. Port deliberately
Fix pointer and layout assumptions, run tests and measure compatibility and authority rather than hiding warnings.
Evidence and caveats
CHERI compatibility is not zero-work and does not make unmodified binaries capability safe. Porting effort varies with code quality and dependencies.
Use evidence from a named system or source and keep claims proportionate. CHERI is one layer in a broader secure-design strategy.