fix(wasmsign2_wrapper): pass wasmtime + wasm paths from rules, not runfiles (#501) - #503
Merged
Merged
Conversation
…nfiles (#501) wasmsign2_wrapper located wasmtime and wasmsign2.wasm via hardcoded canonical runfiles Rlocations (`+wasmtime+wasmtime_toolchain/wasmtime`, `+_repo_rules+wasmsign2_cli_wasm/file/wasmsign2.wasm`). Those canonical names are correct only when rules_wasm_component is the root module; consumed as a dependency they gain a `rules_wasm_component+` prefix, so the lookups fail at runtime and wasm_sign/verify/keygen break for downstream consumers. This is the same bug confirmed and fixed for loom_wrapper in #490/#497. Fix (mirrors #497): the wasm_sign/wasm_verify/wasm_keygen rules now pass the wasmtime binary and the wasmsign2 component as `--bazel-wasmtime=` / `--bazel-wasm-component=` arguments (and stage them as action inputs via the wasmtime toolchain + a `_wasmsign2_wasm` attr). The wrapper consumes those and no longer touches runfiles, so it is root/dependency-agnostic. Verified in-repo: keygen + sign + verify build end-to-end and //examples/wasm_signing:verify_embedded reports "Signature is valid." Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
CI caught that wsc_attestation.bzl has three more wasmsign2_wrapper callers (wasm_attest / wasm_verify_chain / wasm_show_chain) that the first commit missed — making --bazel-wasmtime/--bazel-wasm-component mandatory broke them (e.g. //examples/wasm_signing:signed_component_chain_json, WasmShowChain). Extract the helper into wasm/private/wasmsign2_tools.bzl (WASMTIME_TOOLCHAIN, WASMSIGN2_WASM_ATTR, add_wrapper_tools) and load it from both wasm_signing.bzl and wsc_attestation.bzl. All six wrapper callers now pass wasmtime + the wasm component as action inputs/args; none use runfiles. Verified: `bazel build //examples/wasm_signing/...` (28 targets, incl. the show-chain target that failed CI) builds; verify targets report "Signature is valid." Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #501. Same class of bug as #490/#497, in the signing wrapper.
Problem
wasmsign2_wrapperlocates wasmtime and wasmsign2.wasm via hardcoded canonical runfiles Rlocations:Those canonical names are correct only when rules_wasm_component is the root module. Consumed as a dependency, bzlmod prefixes them with
rules_wasm_component+, so the lookups fail at runtime andwasm_sign/wasm_verify/wasm_keygenbreak for every downstream consumer. (In-repo CI doesn't catch it because there rules_wasm_component is root.)Fix (mirrors #497)
wasm_sign/wasm_verify/wasm_keygennow pass the wasmtime binary and wasmsign2 component as--bazel-wasmtime=/--bazel-wasm-component=arguments (staged as action inputs via the wasmtime toolchain + a new_wasmsign2_wasmattr). The wrapper consumes those and no longer touches runfiles — so it's root/dependency-agnostic by construction.Verification
✅
bazel build //examples/wasm_signing:{all_keys,signed_component_embedded,verify_embedded}— keygen + sign + verify build end-to-end;verify_embeddedreports "Signature is valid."🤖 Generated with Claude Code