Skip to content

wasm-pkg-client: validate semver compliance on publish#213

Open
ryan-surname-p wants to merge 1 commit into
bytecodealliance:mainfrom
ryan-surname-p:oci-client-publish-128
Open

wasm-pkg-client: validate semver compliance on publish#213
ryan-surname-p wants to merge 1 commit into
bytecodealliance:mainfrom
ryan-surname-p:oci-client-publish-128

Conversation

@ryan-surname-p

Copy link
Copy Markdown
Contributor

closes #128

Summary

By default publish:

  • rejects duplicate registrations
  • ensures component is compatible with it's nearest server series neighbors using wit_component::check_semver

The changeset is fairly large I know though a material amount of the new code are tests and moving functions around to keep things readable.

@ryan-surname-p ryan-surname-p marked this pull request as ready for review June 3, 2026 16:37
})
})
.ok_or_else(|| {
crate::Error::InvalidComponent(anyhow::anyhow!("component package not found"))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we add the id as part of the error message?

@vados-cosmonic

Copy link
Copy Markdown
Contributor

Hey @ryan-surname-p it looks like some conflicts creeped in -- apologies for the inconvenience but would you mind resolving those? Then we can get this merged.

@ryan-surname-p

Copy link
Copy Markdown
Contributor Author

No problem at all.

@mkatychev actually reached out to me about this and some work they have in flight as well.

#215

If I understood their request correctly we'd like for that to land first and then work some version of this onto that.

This request seemed reasonable enough to me so the current plan is to monitor the progress of 215 and then adjust accordingly.

@mkatychev

mkatychev commented Jun 26, 2026

Copy link
Copy Markdown
Member

I'd like to hear @vados-cosmonic's thoughts on which should land first.

I suppose one of us will be handling gnarly merge conflicts regardless so it may be fairer for @ryan-surname-p's changes to land first.

@ryan-surname-p ryan-surname-p force-pushed the oci-client-publish-128 branch from cbca048 to 77a1e3e Compare June 26, 2026 13:35
@ryan-surname-p

Copy link
Copy Markdown
Contributor Author

FWIW I'm happy enough to handle either approach I just wanted to make sure everyone was working with the same set of assumptions.

Comment on lines +145 to +146
#[tokio::test]
async fn list_matching_versions_filters_by_version_req_table_driven() {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
#[tokio::test]
async fn list_matching_versions_filters_by_version_req_table_driven() {
#[test]
fn list_matching_versions_filters_by_version_req_table_driven() {

Comment on lines +149 to +156
let cases = [
Case {
name: "target 0.0.0 -> 0.0.*",
req: "~0.0.*",
sort: VersionSort::Ascending,
history: &["0.0.0", "0.0.1", "0.1.0", "1.0.0"],
expected: &["0.0.0", "0.0.1"],
},

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These tests look very go inspired, pretty nice.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment thread crates/wkg/src/main.rs

/// Disable semver compatibility checks.
#[arg(long)]
no_verify: bool,

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

skip_semver_check is better than no_verify as an unambiguous flag IMO.

Suggested change
no_verify: bool,
skip_semver_check: bool,

let matching: Vec<VersionInfo> = versions
.into_iter()
.filter(|v| predicate.matches(&v.version))
.collect();

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we move the filter before the sort_by calls so there is less to sort?

Comment on lines +138 to +140
/// `list_matching_versions` is a generic `VersionReq` filter; this test
/// exercises it with the cargo-`^` shaped series masks that the publish
/// gate constructs in `fetch_semver_series` (see `lib.rs`):

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason we have doc comments here?

Comment on lines +114 to +123
{
tokio::task::spawn_blocking(move || {
let mut reader = reader;
let decoded_wasm =
wit_component::decode_reader(&mut reader).map_err(Error::InvalidComponent)?;
Ok::<_, Error>((reader, decoded_wasm))
})
.await
.map_err(|e| Error::IoError(std::io::Error::other(e)))?
}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this function need to produce a future? If we removed the outer spawn_blocking, would we be able to remove the async?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Package publishing should check semver compat

3 participants