Skip to content

Commit e4042ae

Browse files
PiotrSikoraPiotrSikora
authored
Add support for loading and verifying signed Wasm modules. (#147)
Signed-off-by: Piotr Sikora <[email protected]>
1 parent deb0aea commit e4042ae

27 files changed

+1151
-7
lines changed

‎.github/workflows/cpp.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,3 +75,6 @@ jobs:
7575
run: |
7676
bazel test --define runtime=${{ matrix.runtime }} //...
7777
78+
- name: Test (signed Wasm module)
79+
run: |
80+
bazel test --define runtime=${{ matrix.runtime }} --cxxopt=-DPROXY_WASM_VERIFY_WITH_ED25519_PUBKEY=\"$(xxd -p -c 256 test/test_data/signature_key1.pub | cut -b9-)\" //test:signature_util_test

‎bazel/cargo/BUILD.bazel

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,26 @@ alias(
3939
],
4040
)
4141

42+
alias(
43+
name = "wasmsign",
44+
actual = "@proxy_wasm_cpp_host__wasmsign__0_1_2//:wasmsign",
45+
tags = [
46+
"cargo-raze",
47+
"manual",
48+
],
49+
)
50+
51+
alias(
52+
# Extra aliased target, from raze configuration
53+
# N.B.: The exact form of this is subject to change.
54+
name = "cargo_bin_wasmsign",
55+
actual = "@proxy_wasm_cpp_host__wasmsign__0_1_2//:cargo_bin_wasmsign",
56+
tags = [
57+
"cargo-raze",
58+
"manual",
59+
],
60+
)
61+
4262
alias(
4363
name = "wasmtime",
4464
actual = "@proxy_wasm_cpp_host__wasmtime__0_26_0//:wasmtime",

‎bazel/cargo/Cargo.raze.lock

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,15 @@ dependencies = [
3333
"memchr",
3434
]
3535

36+
[[package]]
37+
name = "ansi_term"
38+
version = "0.11.0"
39+
source = "registry+https://github.com/rust-lang/crates.io-index"
40+
checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
41+
dependencies = [
42+
"winapi",
43+
]
44+
3645
[[package]]
3746
name = "anyhow"
3847
version = "1.0.40"
@@ -104,6 +113,21 @@ version = "1.0.0"
104113
source = "registry+https://github.com/rust-lang/crates.io-index"
105114
checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
106115

116+
[[package]]
117+
name = "clap"
118+
version = "2.33.3"
119+
source = "registry+https://github.com/rust-lang/crates.io-index"
120+
checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
121+
dependencies = [
122+
"ansi_term",
123+
"atty",
124+
"bitflags",
125+
"strsim",
126+
"textwrap",
127+
"unicode-width",
128+
"vec_map",
129+
]
130+
107131
[[package]]
108132
name = "cpp_demangle"
109133
version = "0.3.2"
@@ -219,6 +243,15 @@ dependencies = [
219243
"cfg-if",
220244
]
221245

246+
[[package]]
247+
name = "ed25519-compact"
248+
version = "0.1.9"
249+
source = "registry+https://github.com/rust-lang/crates.io-index"
250+
checksum = "aaf396058cc7285b342f9a10ed7a377f088942396c46c4c9a7eb4f0782cb1171"
251+
dependencies = [
252+
"getrandom",
253+
]
254+
222255
[[package]]
223256
name = "either"
224257
version = "1.6.1"
@@ -293,6 +326,12 @@ dependencies = [
293326
"libc",
294327
]
295328

329+
[[package]]
330+
name = "hmac-sha512"
331+
version = "0.1.9"
332+
source = "registry+https://github.com/rust-lang/crates.io-index"
333+
checksum = "77e806677ce663d0a199541030c816847b36e8dc095f70dae4a4f4ad63da5383"
334+
296335
[[package]]
297336
name = "humantime"
298337
version = "2.1.0"
@@ -402,6 +441,12 @@ version = "1.7.2"
402441
source = "registry+https://github.com/rust-lang/crates.io-index"
403442
checksum = "af8b08b04175473088b46763e51ee54da5f9a164bc162f615b91bc179dbf15a3"
404443

444+
[[package]]
445+
name = "parity-wasm"
446+
version = "0.42.2"
447+
source = "registry+https://github.com/rust-lang/crates.io-index"
448+
checksum = "be5e13c266502aadf83426d87d81a0f5d1ef45b8027f5a471c360abfe4bfae92"
449+
405450
[[package]]
406451
name = "paste"
407452
version = "1.0.5"
@@ -566,6 +611,12 @@ version = "1.2.0"
566611
source = "registry+https://github.com/rust-lang/crates.io-index"
567612
checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
568613

614+
[[package]]
615+
name = "strsim"
616+
version = "0.8.0"
617+
source = "registry+https://github.com/rust-lang/crates.io-index"
618+
checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
619+
569620
[[package]]
570621
name = "syn"
571622
version = "1.0.72"
@@ -592,6 +643,15 @@ dependencies = [
592643
"winapi-util",
593644
]
594645

646+
[[package]]
647+
name = "textwrap"
648+
version = "0.11.0"
649+
source = "registry+https://github.com/rust-lang/crates.io-index"
650+
checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
651+
dependencies = [
652+
"unicode-width",
653+
]
654+
595655
[[package]]
596656
name = "thiserror"
597657
version = "1.0.24"
@@ -612,12 +672,24 @@ dependencies = [
612672
"syn",
613673
]
614674

675+
[[package]]
676+
name = "unicode-width"
677+
version = "0.1.8"
678+
source = "registry+https://github.com/rust-lang/crates.io-index"
679+
checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
680+
615681
[[package]]
616682
name = "unicode-xid"
617683
version = "0.2.2"
618684
source = "registry+https://github.com/rust-lang/crates.io-index"
619685
checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
620686

687+
[[package]]
688+
name = "vec_map"
689+
version = "0.8.2"
690+
source = "registry+https://github.com/rust-lang/crates.io-index"
691+
checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
692+
621693
[[package]]
622694
name = "wasi"
623695
version = "0.10.2+wasi-snapshot-preview1"
@@ -630,6 +702,20 @@ version = "0.77.0"
630702
source = "registry+https://github.com/rust-lang/crates.io-index"
631703
checksum = "b35c86d22e720a07d954ebbed772d01180501afe7d03d464f413bb5f8914a8d6"
632704

705+
[[package]]
706+
name = "wasmsign"
707+
version = "0.1.2"
708+
source = "git+https://github.com/jedisct1/wasmsign#fa4d5598f778390df09be94232972b5b865a56b8"
709+
dependencies = [
710+
"anyhow",
711+
"byteorder",
712+
"clap",
713+
"ed25519-compact",
714+
"hmac-sha512",
715+
"parity-wasm",
716+
"thiserror",
717+
]
718+
633719
[[package]]
634720
name = "wasmtime"
635721
version = "0.26.0"
@@ -667,6 +753,7 @@ dependencies = [
667753
"anyhow",
668754
"env_logger",
669755
"once_cell",
756+
"wasmsign",
670757
"wasmtime",
671758
"wasmtime-c-api-macros",
672759
]

‎bazel/cargo/Cargo.toml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,14 @@ anyhow = "1.0"
1212
once_cell = "1.3"
1313
wasmtime = {version = "0.26.0", default-features = false}
1414
wasmtime-c-api-macros = {git = "https://github.com/bytecodealliance/wasmtime", tag = "v0.26.0", path = "crates/c-api/macros"}
15+
wasmsign = {git = "https://github.com/jedisct1/wasmsign", revision = "fa4d5598f778390df09be94232972b5b865a56b8"}
1516

1617
[package.metadata.raze]
1718
rust_rules_workspace_name = "rules_rust"
1819
gen_workspace_prefix = "proxy_wasm_cpp_host"
1920
genmode = "Remote"
2021
package_aliases_dir = "."
2122
workspace_path = "//bazel/cargo"
23+
24+
[package.metadata.raze.crates.wasmsign.'*']
25+
extra_aliased_targets = ["cargo_bin_wasmsign"]

‎bazel/cargo/crates.bzl

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
5151
build_file = Label("//bazel/cargo/remote:BUILD.aho-corasick-0.7.18.bazel"),
5252
)
5353

54+
maybe(
55+
http_archive,
56+
name = "proxy_wasm_cpp_host__ansi_term__0_11_0",
57+
url = "https://crates.io/api/v1/crates/ansi_term/0.11.0/download",
58+
type = "tar.gz",
59+
sha256 = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b",
60+
strip_prefix = "ansi_term-0.11.0",
61+
build_file = Label("//bazel/cargo/remote:BUILD.ansi_term-0.11.0.bazel"),
62+
)
63+
5464
maybe(
5565
http_archive,
5666
name = "proxy_wasm_cpp_host__anyhow__1_0_40",
@@ -141,6 +151,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
141151
build_file = Label("//bazel/cargo/remote:BUILD.cfg-if-1.0.0.bazel"),
142152
)
143153

154+
maybe(
155+
http_archive,
156+
name = "proxy_wasm_cpp_host__clap__2_33_3",
157+
url = "https://crates.io/api/v1/crates/clap/2.33.3/download",
158+
type = "tar.gz",
159+
sha256 = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002",
160+
strip_prefix = "clap-2.33.3",
161+
build_file = Label("//bazel/cargo/remote:BUILD.clap-2.33.3.bazel"),
162+
)
163+
144164
maybe(
145165
http_archive,
146166
name = "proxy_wasm_cpp_host__cpp_demangle__0_3_2",
@@ -241,6 +261,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
241261
build_file = Label("//bazel/cargo/remote:BUILD.crc32fast-1.2.1.bazel"),
242262
)
243263

264+
maybe(
265+
http_archive,
266+
name = "proxy_wasm_cpp_host__ed25519_compact__0_1_9",
267+
url = "https://crates.io/api/v1/crates/ed25519-compact/0.1.9/download",
268+
type = "tar.gz",
269+
sha256 = "aaf396058cc7285b342f9a10ed7a377f088942396c46c4c9a7eb4f0782cb1171",
270+
strip_prefix = "ed25519-compact-0.1.9",
271+
build_file = Label("//bazel/cargo/remote:BUILD.ed25519-compact-0.1.9.bazel"),
272+
)
273+
244274
maybe(
245275
http_archive,
246276
name = "proxy_wasm_cpp_host__either__1_6_1",
@@ -331,6 +361,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
331361
build_file = Label("//bazel/cargo/remote:BUILD.hermit-abi-0.1.18.bazel"),
332362
)
333363

364+
maybe(
365+
http_archive,
366+
name = "proxy_wasm_cpp_host__hmac_sha512__0_1_9",
367+
url = "https://crates.io/api/v1/crates/hmac-sha512/0.1.9/download",
368+
type = "tar.gz",
369+
sha256 = "77e806677ce663d0a199541030c816847b36e8dc095f70dae4a4f4ad63da5383",
370+
strip_prefix = "hmac-sha512-0.1.9",
371+
build_file = Label("//bazel/cargo/remote:BUILD.hmac-sha512-0.1.9.bazel"),
372+
)
373+
334374
maybe(
335375
http_archive,
336376
name = "proxy_wasm_cpp_host__humantime__2_1_0",
@@ -471,6 +511,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
471511
build_file = Label("//bazel/cargo/remote:BUILD.once_cell-1.7.2.bazel"),
472512
)
473513

514+
maybe(
515+
http_archive,
516+
name = "proxy_wasm_cpp_host__parity_wasm__0_42_2",
517+
url = "https://crates.io/api/v1/crates/parity-wasm/0.42.2/download",
518+
type = "tar.gz",
519+
sha256 = "be5e13c266502aadf83426d87d81a0f5d1ef45b8027f5a471c360abfe4bfae92",
520+
strip_prefix = "parity-wasm-0.42.2",
521+
build_file = Label("//bazel/cargo/remote:BUILD.parity-wasm-0.42.2.bazel"),
522+
)
523+
474524
maybe(
475525
http_archive,
476526
name = "proxy_wasm_cpp_host__paste__1_0_5",
@@ -661,6 +711,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
661711
build_file = Label("//bazel/cargo/remote:BUILD.stable_deref_trait-1.2.0.bazel"),
662712
)
663713

714+
maybe(
715+
http_archive,
716+
name = "proxy_wasm_cpp_host__strsim__0_8_0",
717+
url = "https://crates.io/api/v1/crates/strsim/0.8.0/download",
718+
type = "tar.gz",
719+
sha256 = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a",
720+
strip_prefix = "strsim-0.8.0",
721+
build_file = Label("//bazel/cargo/remote:BUILD.strsim-0.8.0.bazel"),
722+
)
723+
664724
maybe(
665725
http_archive,
666726
name = "proxy_wasm_cpp_host__syn__1_0_72",
@@ -691,6 +751,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
691751
build_file = Label("//bazel/cargo/remote:BUILD.termcolor-1.1.2.bazel"),
692752
)
693753

754+
maybe(
755+
http_archive,
756+
name = "proxy_wasm_cpp_host__textwrap__0_11_0",
757+
url = "https://crates.io/api/v1/crates/textwrap/0.11.0/download",
758+
type = "tar.gz",
759+
sha256 = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060",
760+
strip_prefix = "textwrap-0.11.0",
761+
build_file = Label("//bazel/cargo/remote:BUILD.textwrap-0.11.0.bazel"),
762+
)
763+
694764
maybe(
695765
http_archive,
696766
name = "proxy_wasm_cpp_host__thiserror__1_0_24",
@@ -711,6 +781,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
711781
build_file = Label("//bazel/cargo/remote:BUILD.thiserror-impl-1.0.24.bazel"),
712782
)
713783

784+
maybe(
785+
http_archive,
786+
name = "proxy_wasm_cpp_host__unicode_width__0_1_8",
787+
url = "https://crates.io/api/v1/crates/unicode-width/0.1.8/download",
788+
type = "tar.gz",
789+
sha256 = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3",
790+
strip_prefix = "unicode-width-0.1.8",
791+
build_file = Label("//bazel/cargo/remote:BUILD.unicode-width-0.1.8.bazel"),
792+
)
793+
714794
maybe(
715795
http_archive,
716796
name = "proxy_wasm_cpp_host__unicode_xid__0_2_2",
@@ -721,6 +801,16 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
721801
build_file = Label("//bazel/cargo/remote:BUILD.unicode-xid-0.2.2.bazel"),
722802
)
723803

804+
maybe(
805+
http_archive,
806+
name = "proxy_wasm_cpp_host__vec_map__0_8_2",
807+
url = "https://crates.io/api/v1/crates/vec_map/0.8.2/download",
808+
type = "tar.gz",
809+
sha256 = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191",
810+
strip_prefix = "vec_map-0.8.2",
811+
build_file = Label("//bazel/cargo/remote:BUILD.vec_map-0.8.2.bazel"),
812+
)
813+
724814
maybe(
725815
http_archive,
726816
name = "proxy_wasm_cpp_host__wasi__0_10_2_wasi_snapshot_preview1",
@@ -741,6 +831,15 @@ def proxy_wasm_cpp_host_fetch_remote_crates():
741831
build_file = Label("//bazel/cargo/remote:BUILD.wasmparser-0.77.0.bazel"),
742832
)
743833

834+
maybe(
835+
new_git_repository,
836+
name = "proxy_wasm_cpp_host__wasmsign__0_1_2",
837+
remote = "https://github.com/jedisct1/wasmsign",
838+
commit = "fa4d5598f778390df09be94232972b5b865a56b8",
839+
build_file = Label("//bazel/cargo/remote:BUILD.wasmsign-0.1.2.bazel"),
840+
init_submodules = True,
841+
)
842+
744843
maybe(
745844
http_archive,
746845
name = "proxy_wasm_cpp_host__wasmtime__0_26_0",

0 commit comments

Comments
 (0)