Skip to content

fix(extensions): keep build machine paths out of the WASM guests - #327

Merged
DamianReeves merged 2 commits into
mainfrom
DamianReeves/wasm-path-independent
Nov 2, 2026
Merged

DamianReeves merged 2 commits into
mainfrom
DamianReeves/wasm-path-independent

Conversation

@DamianReeves

Copy link
Copy Markdown
Member

Summary

Extension WASM guests recorded where they were built. This PR removes those paths. Bead morphir-0xtc.5.

The WASM of extension/rust/v0.4.0 built on macOS differed from the release job's build. A rebuild of 0716e22 showed exactly why: with the release job's paths remapped and its host: line reported to cargo, the macOS build is byte-identical to the published WASM (3b3ce74b…). So there are exactly two causes:

  1. Absolute paths. The Cargo home, and the toolchain directory when rust-src is installed. A local build recorded the builder's home path. This PR fixes this.
  2. The host triple. Cargo hashes the host: line of rustc -vV for build scripts and proc macros, and that hash reaches every crate that depends on them, so mangled symbols change. This PR does not change this.

Changes

  • extension:artifact:rust and extension:artifact:elm-native build the guest with --remap-path-prefix: the Cargo home becomes /cargo, and the rust-src directory becomes /rustc/<commit>, the path rustc records when that component is absent.
  • The flags apply only to the guest build, through CARGO_ENCODED_RUSTFLAGS (a path with spaces stays whole). With --target, they do not reach build scripts or proc macros, and the native test builds do not see them.
  • The task fails if a guest still contains either directory, and if it cannot read the toolchain's sysroot and commit.
  • docs/extensions/capability-claims.md gets "Build paths and digests": a local run on another host triple checks the release steps, but does not predict the published digest.

The next release of each extension gets a new digest from this change. Published releases do not change.

Not in this PR: the host triple

Making macOS and Linux builds byte-identical needs cargo to see one fixed host: line. The experiment did that with a wrapper that gives cargo a false rustc -vV, and that needs its own decision before it goes into a release pipeline. The alternative is to run the task in an x86_64-unknown-linux-gnu environment.

Tests

Written first, in tests/ci/test_package_extension_task.py: the exact flags, with a Cargo home that has a space and with the default home; no flags on native builds; refusal of a guest that embeds either directory; refusal of an unknown toolchain; and both tasks having the same rules.

The WASM of extension/rust/v0.4.0 built on macOS differed from the release
job's build. Exactly two things caused that, which a rebuild of 0716e22 here
proved: with the release job's paths and its host line reported to cargo,
the bytes equal the published WASM. This fixes the first cause.

Guests embedded the Cargo home and, with rust-src installed, the toolchain
directory, so a local build recorded the builder's home path. The rust and
elm-native artifact tasks now remap both, for the guest build only, and fail
if a guest still contains either directory.

The second cause stays: cargo hashes the host triple into crate metadata
through build scripts and proc macros, so different host triples still give
different bytes. Document this, so a local digest is not mistaken for a
prediction of the published one. Bead morphir-0xtc.5.
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-02T01:15:17.290361Z a1fea29 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a1fea29e62

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .mise/tasks/extension/artifact/rust Resolved
With CARGO_HOME=/cargo the remap changes nothing, so a correctly mapped
/cargo/registry path matched the guard and packaging refused a valid guest.
Skip the Cargo home check in that case; the toolchain check still runs.

A trailing slash on CARGO_HOME had the opposite effect: the remap gave
/cargoregistry paths and the guard searched for a double slash that never
matches, so it could not fail. Normalize the home before both. Found by the
Codex review; the trailing slash was found while checking it.
@DamianReeves
DamianReeves merged commit 99c0b67 into main Nov 2, 2026
21 checks passed
@DamianReeves
DamianReeves deleted the DamianReeves/wasm-path-independent branch November 2, 2026 01:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant