Repository navigation
Wasmtime 48.0.7, zip 9, rustls 0.23.46: the published advisories, and main's nightly failures - #53
Open
incyashraj wants to merge 5 commits into
Open
incyashraj wants to merge 5 commits into
incyashraj wants to merge 5 commits into
Conversation
Wasmtime 48, the release that carries this month's security fixes, needs
Rust 1.95. The pin moves from 1.94.1 to 1.95.0 in rust-toolchain.toml and
in every CI, release and pages job (dtolnay/rust-toolchain pinned to the
1.95.0 branch head, 035fceb3c).
Clippy 1.95 adds collapsible_match and a sort_by_key suggestion. Five
places in the CLI, the Linux and Windows window loops and Studio are
rewritten as match guards or sort_by_key; behaviour is the same (the arm
that no longer matches falls to the existing `_ => {}`).
The guest SDK's floor stays at 1.91 and the workspace rust-version stays
1.94: apps people build are not asked for a newer Rust. The build box
image (cloud/builder) builds apps, not the engine, so it is unchanged.
…K-1127) Main's nightly audit failed on 22 advisories. After this, `cargo deny check advisories` says "advisories ok" for the root workspace, and Studio has no vulnerabilities left (only the unmaintained Tauri crates it already tolerated, plus zbus_names/zvariant, new this week, with no fix). Wasmtime 46.0.3 -> 48.0.7 (the 48 LTS line; 49 needs Rust 1.96, 48 needs 1.95). Krate IS exposed: every .krate is untrusted guest code, and the component-model-async feature is compiled in and on by default, so a crafted component reaches the async paths. That covers RUSTSEC-2026-0327 (an unvalidated async callback result count overflows a native stack buffer: memory corruption in the host), 0353-0358, 0361 (host panics; a release build aborts on panic, so a crafted app kills the process), 0362 (async entrypoint not enforced), 0359 (stack overflow dropping a long chain of recursive types), 0363 (component handle tables charged to no limit) and 0316 (record lifting past the hostcall fuel limit). 48.0.7 also fixes a Cranelift aarch64 br_table jump to the wrong target, which is the code every Apple Silicon Mac runs. The wasi-http fixes in it do not touch Krate, which does not use wasmtime-wasi. No wasmtime API Krate calls changed. One default did: 47 turned the GC and typed function-references proposals on. Krate turns them back off in the engine settings, so what a .krate may contain is exactly what it was on 46, and a test pins that (GC and typed function references refused, exception handling still on for IC-908). Turning them on is its own decision. crates/runtime declares rust-version 1.95; the pulley probe's own lock and the fuzz lock move with it. zip 2.4.2 and 8.6.0 (via calamine 0.36) -> zip 9.0.5, calamine 0.37. RUSTSEC-2026-0367/0368/0369 are all in ZipArchive::extract and ZipStreamReader::extract (symlinks pointing out, SUID/SGID kept, permissions applied through symlinks). Krate never calls either: bundles are read entry by entry by exact name, through safe_asset_relative_path, into File::create, so no symlink is made and no mode is applied. Not exposed; patched anyway. API changes: ZipFile::name() now returns a Result (names are decoded on demand), so every caller propagates or handles it; FileOptions has two lifetimes; InvalidArchive takes a Cow. zip 9 also refuses an entry that holds more than its header declares. The forged-size tests now accept that refusal as well as Krate's own byte count, which stays for any reader that does not check. Copying an entry out now tells a failed READ (a damaged or forged file: "this is not a Krate app, or the file is damaged") from a failed WRITE (the disk, named); before, both said "could not open <a temp path>". Bundle bytes are unchanged: the packer has its own deterministic writer (K-335), and the committed repack digests still match. rustls 0.23.45 -> 0.23.46 in both locks. Not exposed: Krate uses the ring provider without the brotli feature, sets no ECH mode, keeps no custom session store, and ring offers no X25519MLKEM768 to be downgraded from (RUSTSEC-2026-0346..0349).
…ne (K-1128) None of the six was a product fault; each test asked its machine the wrong question. Reproduced on this Mac where the machine allows it. macOS, an_app_plays_a_video_from_its_assets: the probe plays for three seconds after the clip loads, 4.4 s end to end here, against the 5 s headless budget. On a loaded runner the budget ran out first, the runtime closed the window, and the app was gone before it printed -- an empty stdout and exit 0, exactly the CI log. KRATE_HEADLESS_SECS=2 reproduces it here. The test now gives the run a 30 s ceiling; the probe bounds itself. Ubuntu, an_app_draws_and_computes_on_the_gpu...: the runner has no GPU and the test meant to stand down, but it looked for "adapter=Unsupported" while the probe prints the bindings' Debug form, "adapter=GpuError::Unsupported(...)". It now accepts both. Ubuntu, a_linux_wrap_is_one_file... and a_linux_gift_installs_the_player: a Linux gift carries the engine that made it, and in the test that is the debug build -- with its debug info, hundreds of MB on Linux. gzip -9 and a SHA-256 over that outran the full lane's 90 s watchdog. Here (macOS keeps debug info outside the binary, 220 MB) the same wrap takes 21 s. On Linux the tests now wrap with a copy stripped of debug info, the size a person ships; without `strip` they fall back to the whole binary. Windows (also red in that run): the fleet contract example uses /var/log/krate/opens.jsonl, which is not a full path on Windows, and the wasi-sdk test expected "clang" where Windows has "clang.exe" and a backslash sysroot. Both now ask in the system's own terms.
python3 scripts/licence-map.py, unedited. It was already stale on main before the upgrade (the org work's crates -- krate-http, krate-orgkeys, hpke and the AEAD crates it brings -- were never added), so the audit lane's licence step would have failed even with the advisories fixed. Now also wasmtime 48.0.7, cranelift 0.135.7, zip 9.0.5, calamine 0.37 and rustls 0.23.46. Every licence is still on the allow list.
scripts/record-advisory-evidence.sh at 6553367: cargo-deny 0.19.4 says "advisories ok" for the root workspace (K-1127).
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main's dependency audit has been red since 2026-10-17 on published advisories, and the nightly full tests failed on six tests that misread their machine. This fixes both.
Advisories
br_tablewrong jump.ZipArchive::extract; bundles are read entry by entry by exact name.Wasmtime 47 turned the GC and typed function-references proposals on by default. They are turned back off in
engine_settings, so a .krate may contain exactly what it could before; a new test pins it (sabotaged: setting GC on fails it).K-1128, the nightly failures
adapter=Unsupportedwhere the probe printsadapter=GpuError::Unsupported.clangwhere Windows hasclang.exe.The Linux and Windows fixes are read from the CI log and not run on those systems; this PR's CI is their proof.
Checked locally
cargo deny check advisories: advisories ok.--all-targets --all-features -D warnings: clean.cargo test --workspace --no-fail-fast: 2,047 passed, 0 failed.check-bindings-fresh.shpasses.Not built here: iOS, Android and the browser Player on wasmtime 48.