Skip to content

feat(flake): explicit URL+sha256 pins for wasm-tools + wasmtime (W50 PR-A)#80

Merged
chaploud merged 1 commit intomainfrom
develop/flake-pin-wasm-tools-wasmtime
Apr 29, 2026
Merged

feat(flake): explicit URL+sha256 pins for wasm-tools + wasmtime (W50 PR-A)#80
chaploud merged 1 commit intomainfrom
develop/flake-pin-wasm-tools-wasmtime

Conversation

@chaploud
Copy link
Copy Markdown
Contributor

First step toward W50 / Plan B sub-3 (CI Nix-ify). Makes `.github/versions.lock` the single source of truth not just textually but structurally — instead of the Nix devshell pulling whatever wasm-tools / wasmtime nixpkgs-unstable happens to ship today, fetch the exact pinned releases that `versions.lock` declares.

Pattern mirrors the existing Zig + WASI SDK entries: per-architecture URL + sha256 (base32, derived via `nix-prefetch-url --type sha256 --unpack`), then a tiny `pkgs.runCommand` wrapper that links the binary into `$out/bin`. Covers all four platforms (`aarch64-darwin` / `x86_64-darwin` / `aarch64-linux` / `x86_64-linux`); falls through to `throw` for anything else.

Why now

PR-B / PR-C / PR-D will switch `ci.yml` test jobs to use this devshell via `DeterminateSystems/nix-installer-action`. Until the flake itself produces version-stable outputs, the CI move would just shift the drift surface from "per-tool install steps in YAML" to "per-flake-revision drift in nixpkgs". This PR closes that loop first; CI is not touched.

What changed

  • `flake.nix`: added `wasmToolsArchInfo` / `wasmToolsBin` (1.246.1) and `wasmTimeArchInfo` / `wasmTimeBin` (42.0.1); `buildInputs` swapped from `pkgs.wasm-tools` / `pkgs.wasmtime` to the new wrappers. `hyperfine` kept on nixpkgs because upstream has no `aarch64-darwin` prebuilt asset (single-arch gap; tracked as a non-blocker — hyperfine is a measurement tool, version drift doesn't change spec/realworld outcomes).
  • `scripts/sync-versions.sh`: header note refreshed (4 pins now live in flake.nix); added two new `check()` entries that grep wasm-tools / wasmtime release URLs out of flake.nix and compare against `WASM_TOOLS_VERSION` / `WASMTIME_VERSION`. The `versions-lock-sync` CI job (ci: enforce versions.lock ↔ flake.nix consistency #62) automatically picks these up.
  • `.gitignore`: added `result` and `result-*` (the default `nix build` output symlinks; shouldn't be tracked).

Verified locally

```
$ nix flake check --all-systems --no-build
✅ devShells.aarch64-darwin.default
✅ devShells.x86_64-darwin.default
✅ devShells.aarch64-linux.default
✅ devShells.x86_64-linux.default

$ wasm-tools --version → wasm-tools 1.246.1 (b960a8735 2026-03-31)
$ wasmtime --version → wasmtime 42.0.1 (6844a83b5 2026-02-25)

$ bash scripts/sync-versions.sh
[OK] ZIG_VERSION 0.16.0
[OK] WASI_SDK_VERSION 30
[OK] WASM_TOOLS_VERSION 1.246.1
[OK] WASMTIME_VERSION 42.0.1
sync-versions: OK
```

Test plan

  • `nix flake check --all-systems --no-build` ✅ all 4 systems
  • Local `wasm-tools --version` / `wasmtime --version` confirm correct binaries
  • `scripts/sync-versions.sh` ✅ 4 pins matched
  • CI green on this branch (`versions-lock-sync` job in particular)

…PR-A)

Step toward W50 / Plan B sub-3 (CI Nix-ify): make versions.lock the
single source of truth not just textually but structurally — instead
of the Nix devshell pulling whatever wasm-tools / wasmtime nixpkgs-
unstable happens to ship today, fetch the exact pinned releases that
versions.lock declares.

Pattern mirrors the existing Zig + WASI SDK entries: per-architecture
URL + sha256 (base32, derived via `nix-prefetch-url --type sha256
--unpack`), then a tiny pkgs.runCommand wrapper that links the binary
into $out/bin. Covers all four platforms (aarch64-darwin, x86_64-darwin,
aarch64-linux, x86_64-linux); falls through to a `throw` for anything
else.

- flake.nix: added wasmToolsArchInfo / wasmToolsBin (1.246.1) and
  wasmTimeArchInfo / wasmTimeBin (42.0.1); buildInputs swapped from
  pkgs.wasm-tools / pkgs.wasmtime to the new wrappers. Hyperfine kept
  on nixpkgs because upstream has no aarch64-darwin prebuilt asset
  (single-arch gap; tracked separately, non-blocking for spec /
  realworld since hyperfine is a measurement tool).
- scripts/sync-versions.sh: header note refreshed (4 pins now live in
  flake.nix); added two new check() entries that grep wasm-tools /
  wasmtime release URLs out of flake.nix and compare against
  WASM_TOOLS_VERSION / WASMTIME_VERSION.

Verified locally:
  $ nix flake check --all-systems --no-build  # ✅ 4 systems
  $ wasm-tools --version  → wasm-tools 1.246.1
  $ wasmtime --version    → wasmtime 42.0.1
  $ bash scripts/sync-versions.sh
    [OK] ZIG_VERSION       0.16.0
    [OK] WASI_SDK_VERSION  30
    [OK] WASM_TOOLS_VERSION 1.246.1
    [OK] WASMTIME_VERSION   42.0.1

CI not touched. The next W50 PR-B / PR-C / PR-D will switch ci.yml
test jobs to use this devshell via DeterminateSystems/nix-installer.
@chaploud chaploud merged commit 5768928 into main Apr 29, 2026
8 checks passed
@chaploud chaploud deleted the develop/flake-pin-wasm-tools-wasmtime branch April 29, 2026 07:14
chaploud added a commit that referenced this pull request Apr 29, 2026
chaploud added a commit that referenced this pull request Apr 29, 2026
* docs: post-W50 cleanup — drop resume-guide, refocus memo on W53/C-g/W47

Plan B sub-3 (W50) and Plan C (W49) shipped via PRs #80..#83 in the
2026-04-29 PM autonomous session, plus the W47 investigation note in #84.
The .dev/resume-guide.md handover doc is now stale: its "Plan B sub-3 is
the next big lift" framing no longer matches reality, and the per-PR plan
items are all marked complete.

- Delete .dev/resume-guide.md; .dev/memo.md `## Current Task` is the
  single handover surface going forward.
- memo.md: refresh the active-work section to W53 → C-g → W47, with
  the per-item plan inlined (was previously split between memo and
  resume-guide).
- checklist.md: mark W50 done with the four-PR breakdown, refocus
  W49 on the C-g residual (3-platform bench baseline reset), open W53.
- environment.md: explain that the only Windows-skipped CI step left is
  `benchmark` and link to C-g for the rationale.
- roadmap.md: Windows CI guard removal flipped Done; W53 surfaced as
  the next active item.

* fix(w53): route rustup-init stdout through Out-Host to keep return scalar

PowerShell folds every native command's stdout into the enclosing
function's pipeline output. Inside `Install-Rustup`, that meant
rustup-init's `info: downloading component rust-std` (and the
similar lines from `rustup target add wasm32-wasip1`) were piling
up alongside the trailing `return $stampedDir`, so the caller's
`$rustRoot = Install-Rustup ...` was a string array rather than
a single path. The downstream

    $pathsToAdd += (Join-Path (Join-Path $paths['rust'] 'cargo') 'bin')

then exploded on the empty leading element with

    Cannot bind argument to parameter 'Path' because it is an empty string.

— matching the W53 symptom on a fresh GitHub-hosted Windows
runner. Local Windows mini-PC was unaffected because rustup's
"already installed" path is silent on stdout, so nothing leaked
into the function's return value there.

Fix: route both native command invocations through `2>&1 | Out-Host`,
which keeps the lines visible in the CI log but pulls them out of
the function's pipeline output. Also added a defensive check in the
caller so any future regression of this shape fails loud rather
than silently producing a malformed PATH.

ci.yml: drop `-SkipRust` and the separate `Setup Rust` step on the
Windows test job. The runner now goes through a single
`install-tools.ps1` path with a self-contained
`%LOCALAPPDATA%\zwasm-tools\rust-stable\` toolchain, the same as
local Windows users get.

* docs(w53): mark resolved with root-cause + fix summary

Updates the four docs that were tracking W53 as open work to
reflect the rustup-init stdout pollution diagnosis and the
`Out-Host` redirect fix in the previous commit.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant