From b22dfa232cb5c3df4327ee8525292bbdf78114ed Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sun, 24 May 2026 21:01:57 +0200 Subject: [PATCH] chore(deps): bump PulseEngine toolchains (meld, spar, synth, wsc) Bumps four of the six PulseEngine tools to their latest releases. Each version pin is updated everywhere it appears (JSON registry, module-extension defaults, repository-rule defaults, MODULE.bazel call sites) so the resolved version matches `latest_version` in the registry. * meld 0.1.0 -> 0.10.0 (canonical-ABI sweep + multi-memory warning) * spar 0.9.3 -> 0.10.0 (mermaid emitter, EMV2 traversal, Lean 4 proofs) * synth 0.3.1 -> 0.6.0 (cosign-signed sums, SBOM, SLSA provenance) * wsc 0.7.0 -> 0.9.0 (TPM2 variant; registry entry only -- the MODULE.bazel call site stays at 0.7.0 because v0.9.0 dropped the wsc-cli.wasm asset our wasmsign2_wrapper consumes, tracked upstream as pulseengine/sigil#132) Not bumped: * loom pinned at 0.3.0 -- every release from v0.6.0 through v1.1.1 ships zero binary assets upstream (pulseengine/loom#142) * witness already at v0.22.0 (latest) Validated locally: bazel build //examples/{spar,witness,synth}_example/... green on darwin_arm64; spar generates WIT, synth compiles to Cortex-M ELF, meld toolchain resolves. A companion brief was filed on the five non-synth repos asking them to adopt synth's release-artifact pattern (single SHA256SUMS.txt signed keyless with cosign + SBOM + SLSA build provenance), to unify the three different checksum/signing conventions currently in use across the PulseEngine toolset. Co-Authored-By: Claude Opus 4.7 --- MODULE.bazel | 6 ++--- MODULE.bazel.lock | 36 ++++++++++++++--------------- checksums/tools/meld.json | 27 +++++++++++++++++++++- checksums/tools/spar.json | 29 +++++++++++++++++++++-- checksums/tools/synth.json | 25 ++++++++++++++++++-- checksums/tools/wsc.json | 42 ++++++++++++++++++++++------------ toolchains/meld_toolchain.bzl | 2 +- toolchains/spar_toolchain.bzl | 2 +- toolchains/synth_toolchain.bzl | 2 +- toolchains/tool_versions.bzl | 2 +- wasm/extensions.bzl | 12 +++++----- 11 files changed, 134 insertions(+), 51 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index 8946c955..f4f48d7e 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -254,7 +254,7 @@ register_toolchains("@binaryen_toolchain//:binaryen_toolchain") meld = use_extension("//wasm:extensions.bzl", "meld") meld.register( name = "meld", - version = "0.1.0", + version = "0.10.0", ) use_repo(meld, "meld_toolchain") @@ -264,7 +264,7 @@ register_toolchains("@meld_toolchain//:meld_toolchain") spar = use_extension("//wasm:extensions.bzl", "spar") spar.register( name = "spar", - version = "0.9.3", + version = "0.10.0", ) use_repo(spar, "spar_toolchain") @@ -284,7 +284,7 @@ register_toolchains("@witness_toolchain//:witness_toolchain") synth = use_extension("//wasm:extensions.bzl", "synth") synth.register( name = "synth", - version = "0.3.1", + version = "0.6.0", ) use_repo(synth, "synth_toolchain") diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock index f2d7f810..9b973b1d 100644 --- a/MODULE.bazel.lock +++ b/MODULE.bazel.lock @@ -284,7 +284,7 @@ }, "//wasm:extensions.bzl%binaryen": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "c5GClIZ+xfHSKFn9WL/02Ag7wuihInOMqTGH5CxR/U8=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, @@ -308,7 +308,7 @@ }, "//wasm:extensions.bzl%cpp_component": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "ZtIrdMAeTaET/8t3kmG14kQp8U4FKMqhGB1+JS825Do=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, @@ -333,7 +333,7 @@ }, "//wasm:extensions.bzl%jco": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "MRHYkIS73wv1wYllXhdZBYX6dRIp7VySTL4edmOH2/M=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, @@ -358,8 +358,8 @@ }, "//wasm:extensions.bzl%meld": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", - "usagesDigest": "BnGoVHC5IiwLNc8XvxkOniYvo+CFiIGA27V/CaLd4Gw=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", + "usagesDigest": "Nc45Hq7pjpIzzA1UXlHsAEAgQHpg1jE3/IUlCJYcFgU=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, "envVariables": {}, @@ -367,7 +367,7 @@ "meld_toolchain": { "repoRuleId": "@@//toolchains:meld_toolchain.bzl%meld_repository", "attributes": { - "version": "0.1.0" + "version": "0.10.0" } } }, @@ -382,8 +382,8 @@ }, "//wasm:extensions.bzl%spar": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", - "usagesDigest": "mOtiPROZSFmtouSVXHtDGjJNUiB1I315FvLubt4AxCo=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", + "usagesDigest": "HteVAnfZ8Jv2xAL/oX+kiaSB6HLWRIt9g2CRFKUEz9k=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, "envVariables": {}, @@ -391,7 +391,7 @@ "spar_toolchain": { "repoRuleId": "@@//toolchains:spar_toolchain.bzl%spar_repository", "attributes": { - "version": "0.9.3" + "version": "0.10.0" } } }, @@ -406,8 +406,8 @@ }, "//wasm:extensions.bzl%synth": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", - "usagesDigest": "eXuFY1lYMxkRiJiqviUHAStVodluY02BJpodlh+aNQ8=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", + "usagesDigest": "XTIJ1SQ/Se7btOFYHYJX2DjviC7xWk2ugwNS0Q3Icho=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, "envVariables": {}, @@ -415,7 +415,7 @@ "synth_toolchain": { "repoRuleId": "@@//toolchains:synth_toolchain.bzl%synth_repository", "attributes": { - "version": "0.3.1" + "version": "0.6.0" } } }, @@ -430,7 +430,7 @@ }, "//wasm:extensions.bzl%tinygo": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "esnFdrH+qxI9awhZ/uW4dIkm843wWmTCzO4b1pdmifs=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, @@ -454,7 +454,7 @@ }, "//wasm:extensions.bzl%wasi_sdk": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "4CDKvALAslODuYVBSBBBKgDbmaqWRdwJJ4yfDrzWeYg=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, @@ -828,7 +828,7 @@ }, "//wasm:extensions.bzl%wasm_toolchain": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "Keg+j4249N8787+5NDDpsnW8S0P3hp9HSaC26H2SeJg=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, @@ -862,7 +862,7 @@ }, "//wasm:extensions.bzl%wasmtime": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "W3m1ohl2c96vXpGAao2C6XIl3CGB+kZYZN2+bagGv0M=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, @@ -887,7 +887,7 @@ }, "//wasm:extensions.bzl%witness": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "vz4JVaRGcdcwU0XOHYN0kb54nuI69CDjEu/MXFK6r/g=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, @@ -911,7 +911,7 @@ }, "//wasm:extensions.bzl%wkg": { "general": { - "bzlTransitiveDigest": "8mvNFsd+OgwKwH39+OUS+IRxspZYjyviLWm+jNYQTXQ=", + "bzlTransitiveDigest": "ZUOnFoKoiyj/ZGS4bF11GxWRosVDPsXBQ/5i1O8V4j0=", "usagesDigest": "ks+Q/IL0nntNP6PabzUcF0ruF4X9hTKhbmck/ueoPTg=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, diff --git a/checksums/tools/meld.json b/checksums/tools/meld.json index 0db772ba..2ac5f1c6 100644 --- a/checksums/tools/meld.json +++ b/checksums/tools/meld.json @@ -2,9 +2,34 @@ "tool_name": "meld", "github_repo": "pulseengine/meld", "description": "Static WebAssembly component fusion - merges multiple components into a single core module", - "latest_version": "0.1.0", + "latest_version": "0.10.0", "supported_platforms": ["darwin_amd64", "darwin_arm64", "linux_amd64", "linux_arm64"], "versions": { + "0.10.0": { + "release_date": "2026-05-24", + "platforms": { + "darwin_amd64": { + "sha256": "05e57938efead0719f379c113b1b9e8b393c66af35f21ec5bb62afae49760d12", + "url_suffix": "meld-x86_64-apple-darwin", + "binary": true + }, + "darwin_arm64": { + "sha256": "4ba9ba8132fd100ddeed92845f97af86cdf4f7fb223c569bb350b5d410bc2bad", + "url_suffix": "meld-aarch64-apple-darwin", + "binary": true + }, + "linux_amd64": { + "sha256": "9aeedaced6003775f887fa080e273a237bcffcf5c2eba37f98b6fda2214141a3", + "url_suffix": "meld-x86_64-unknown-linux-gnu", + "binary": true + }, + "linux_arm64": { + "sha256": "402266af3729626d8fd2cb46844c4d880fbadb4812e82971fc9666f2e00a05dd", + "url_suffix": "meld-aarch64-unknown-linux-gnu", + "binary": true + } + } + }, "0.1.0": { "release_date": "2026-03-02", "platforms": { diff --git a/checksums/tools/spar.json b/checksums/tools/spar.json index 7e7ba58a..f8e03341 100644 --- a/checksums/tools/spar.json +++ b/checksums/tools/spar.json @@ -2,10 +2,35 @@ "tool_name": "spar", "github_repo": "pulseengine/spar", "description": "AADL v2.3 architecture toolchain — generates WIT interfaces from AADL models", - "latest_version": "0.9.3", - "last_checked": "2026-05-20T00:00:00Z", + "latest_version": "0.10.0", + "last_checked": "2026-05-24T00:00:00Z", "supported_platforms": ["darwin_amd64", "darwin_arm64", "linux_amd64", "linux_arm64", "windows_amd64"], "versions": { + "0.10.0": { + "release_date": "2026-05-20", + "platforms": { + "darwin_amd64": { + "sha256": "02fd1b321ce80955fe1f831e14a052ff16982548c0b0ef7ea78317ac36672f78", + "url_suffix": "x86_64-apple-darwin.tar.gz" + }, + "darwin_arm64": { + "sha256": "848aac54ac68295ebefd99f2361f772043e633cf6b5aa3fd29c38c1fbe225533", + "url_suffix": "aarch64-apple-darwin.tar.gz" + }, + "linux_amd64": { + "sha256": "1661885ae315f8f54467a163658749e069b47ff55ecfa532c091aaf7949f95a4", + "url_suffix": "x86_64-unknown-linux-gnu.tar.gz" + }, + "linux_arm64": { + "sha256": "5a1ed3abbb9ae829e589c0f35d4baa3921d15b010e1f61e6077e89742f595b6b", + "url_suffix": "aarch64-unknown-linux-gnu.tar.gz" + }, + "windows_amd64": { + "sha256": "ab205f669b0b8f2d2b5920a32eb6c19e8a042a99beeba83addaaef14818cd144", + "url_suffix": "x86_64-pc-windows-msvc.zip" + } + } + }, "0.9.3": { "release_date": "2026-05-11", "platforms": { diff --git a/checksums/tools/synth.json b/checksums/tools/synth.json index f199be8d..51927449 100644 --- a/checksums/tools/synth.json +++ b/checksums/tools/synth.json @@ -2,10 +2,31 @@ "tool_name": "synth", "github_repo": "pulseengine/synth", "description": "WebAssembly-to-ARM ahead-of-time compiler (WASM core module -> Cortex-M ELF)", - "latest_version": "0.3.1", - "last_checked": "2026-05-21T00:00:00Z", + "latest_version": "0.6.0", + "last_checked": "2026-05-24T00:00:00Z", "supported_platforms": ["darwin_amd64", "darwin_arm64", "linux_amd64", "linux_arm64"], "versions": { + "0.6.0": { + "release_date": "2026-05-24", + "platforms": { + "darwin_amd64": { + "sha256": "094d1f0160643c141014ce5fdfcc622b672ef1e711ec8a050d835c69f929dbaa", + "url_suffix": "x86_64-apple-darwin.tar.gz" + }, + "darwin_arm64": { + "sha256": "3833cbbbfc64892c755ae4bd5ad592d389002361af07c1e4cc933b21876c029c", + "url_suffix": "aarch64-apple-darwin.tar.gz" + }, + "linux_amd64": { + "sha256": "e6374c0772a07a597a64309cdfb46363633c4e8e058056b59c798278cf6a6c87", + "url_suffix": "x86_64-unknown-linux-gnu.tar.gz" + }, + "linux_arm64": { + "sha256": "0d23878fb2f53cb5b25d34cab590c2b9e43c177fbaa614bcd0bcf97c7879a22d", + "url_suffix": "aarch64-unknown-linux-gnu.tar.gz" + } + } + }, "0.3.1": { "release_date": "2026-05-21", "platforms": { diff --git a/checksums/tools/wsc.json b/checksums/tools/wsc.json index 5c0bf842..b2411553 100644 --- a/checksums/tools/wsc.json +++ b/checksums/tools/wsc.json @@ -2,9 +2,34 @@ "tool_name": "wsc", "github_repo": "pulseengine/sigil", "description": "WebAssembly Signature Component - signing, verification, and attestation toolkit", - "latest_version": "0.7.0", - "supported_platforms": ["darwin_amd64", "darwin_arm64", "linux_amd64", "linux_arm64", "windows_amd64", "wasm"], + "latest_version": "0.9.0", + "supported_platforms": ["darwin_amd64", "darwin_arm64", "linux_amd64", "linux_arm64", "windows_amd64"], "versions": { + "0.9.0": { + "release_date": "2026-05-21", + "platforms": { + "darwin_amd64": { + "sha256": "390182be41aeda8165d40103ab10487ea84f9f52b6d3a336d8a59ead9c88da3b", + "url_suffix": "wsc-macos-x86_64" + }, + "darwin_arm64": { + "sha256": "c7e4fddceed68512400d3f4bdc9a3741a5d7221d9afb0a9e1b8302755764ffd8", + "url_suffix": "wsc-macos-aarch64" + }, + "linux_amd64": { + "sha256": "9054b4b066e2b0a954110851a43266ff0e9ef12b4e1ecc03c333943fd52cecb6", + "url_suffix": "wsc-linux-x86_64" + }, + "linux_arm64": { + "sha256": "e927eb4ea14a55909b84bc4714a7273fbedb83a95e05cd1eb41c0e582d8f45ea", + "url_suffix": "wsc-linux-aarch64" + }, + "windows_amd64": { + "sha256": "eed9d52f027007b55ee6db756c31b02e232a89ab95c53229dc7f733c809cb33c", + "url_suffix": "wsc-windows-x86_64.exe" + } + } + }, "0.7.0": { "release_date": "2026-03-28", "platforms": { @@ -27,19 +52,6 @@ "windows_amd64": { "sha256": "698a8b15388fedf34752ce3e283be47e64fd2afa65a424a42e711778060ac527", "url_suffix": "wsc-windows-x86_64.exe" - }, - "wasm": { - "sha256": "a57139921f87e91282f22f788155177eadf2085e21a7f2f8ceb8d9fac1c761ef", - "url_suffix": "wsc-cli.wasm" - } - } - }, - "0.4.0": { - "release_date": "2025-01-04", - "platforms": { - "wasm": { - "sha256": "44f15aa50787bf27f64623458b680ba0d49b3d56863737dad00909ba21fbe854", - "url_suffix": "wsc-cli.wasm" } } } diff --git a/toolchains/meld_toolchain.bzl b/toolchains/meld_toolchain.bzl index a6ef7112..24d4e7c6 100644 --- a/toolchains/meld_toolchain.bzl +++ b/toolchains/meld_toolchain.bzl @@ -127,7 +127,7 @@ meld_repository = repository_rule( implementation = _meld_repository_impl, attrs = { "version": attr.string( - default = "0.1.0", + default = "0.10.0", doc = "Meld version to download", ), }, diff --git a/toolchains/spar_toolchain.bzl b/toolchains/spar_toolchain.bzl index 349b8a58..4980d560 100644 --- a/toolchains/spar_toolchain.bzl +++ b/toolchains/spar_toolchain.bzl @@ -123,7 +123,7 @@ spar_repository = repository_rule( implementation = _spar_repository_impl, attrs = { "version": attr.string( - default = "0.9.3", + default = "0.10.0", doc = "spar version to download", ), }, diff --git a/toolchains/synth_toolchain.bzl b/toolchains/synth_toolchain.bzl index 6c579f3a..449c51a4 100644 --- a/toolchains/synth_toolchain.bzl +++ b/toolchains/synth_toolchain.bzl @@ -121,7 +121,7 @@ synth_repository = repository_rule( implementation = _synth_repository_impl, attrs = { "version": attr.string( - default = "0.3.1", + default = "0.6.0", doc = "synth version to download", ), }, diff --git a/toolchains/tool_versions.bzl b/toolchains/tool_versions.bzl index 862ef91a..87afa1fb 100644 --- a/toolchains/tool_versions.bzl +++ b/toolchains/tool_versions.bzl @@ -41,7 +41,7 @@ TOOL_VERSIONS = { # PulseEngine pipeline tools "loom": "0.3.0", # WebAssembly optimizer with Z3 formal verification - "meld": "0.1.0", # Static WebAssembly component fusion + "meld": "0.10.0", # Static WebAssembly component fusion # WRPC (WebAssembly Component RPC) "wrpc": "0.16.0", # wrpc-wasmtime runtime for component RPC diff --git a/wasm/extensions.bzl b/wasm/extensions.bzl index da822b51..da8acec1 100644 --- a/wasm/extensions.bzl +++ b/wasm/extensions.bzl @@ -680,7 +680,7 @@ def _meld_extension_impl(module_ctx): if not registrations: meld_repository( name = "meld_toolchain", - version = "0.1.0", + version = "0.10.0", ) # Module extension for Meld (static component fusion) @@ -695,7 +695,7 @@ meld = module_extension( ), "version": attr.string( doc = "Meld version to use", - default = "0.1.0", + default = "0.10.0", ), }, ), @@ -719,7 +719,7 @@ def _spar_extension_impl(module_ctx): if not registrations: spar_repository( name = "spar_toolchain", - version = "0.9.3", + version = "0.10.0", ) # Module extension for spar (AADL architecture model -> WIT generation) @@ -734,7 +734,7 @@ spar = module_extension( ), "version": attr.string( doc = "spar version to use", - default = "0.9.3", + default = "0.10.0", ), }, ), @@ -797,7 +797,7 @@ def _synth_extension_impl(module_ctx): if not registrations: synth_repository( name = "synth_toolchain", - version = "0.3.1", + version = "0.6.0", ) # Module extension for synth (WebAssembly-to-ARM ahead-of-time compiler) @@ -812,7 +812,7 @@ synth = module_extension( ), "version": attr.string( doc = "synth version to use", - default = "0.3.1", + default = "0.6.0", ), }, ),