From 007ff2df75e9d6fd0ba0fa53e9969e1dd7d5daa0 Mon Sep 17 00:00:00 2001 From: Lann Martin Date: Mon, 17 Aug 2026 08:34:47 -0400 Subject: [PATCH] releases: caret-honest 0.1.0 regime; polymorph-test, deltic, webcrypto pins to the v0.1.0 releases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The polymorph family now cuts caret-honest releases (deltic's scheme): everything stays 0.x/unstable, but within a minor line releases stay backward-compatible and anything breaking bumps the minor. README "Releases" states the policy; this repo is tagged v0.1.0 at this commit's merge. polymorph-test: pin b402686 -> b4444a25 (the v0.1.0 release commit) via `component-test pins bump` — Cargo.toml, the deltic driver's package.json, the ci.yml action refs, regenerated lockfiles. deltic: JSR pin 0.1.0-pre.g078aa15 -> 0.1.0 (the first non-pre deltic release). Upstream renamed @deltic/wasi-shims -> @deltic/wasi and wasiShims() -> wasi(); the driver and bundle re-exports follow. polymorph-webcrypto: webcrypto-signer .pinned-rev 61fbd02 -> 5bb3d48 (the v0.1.0 release commit); the vendored WIT is unchanged between the revs (only wit/README.md and extension-conditions.json moved upstream, neither vendored). Gates: just check; conformance wasmtime/composed/deltic-deno rows all pass (browser rows + matrix gate in CI); conformance-ct::run-webcrypto over the provider at the new pin: 6 pass, 1 N/A. --- .github/workflows/ci.yml | 4 +- Cargo.lock | 6 +-- Cargo.toml | 2 +- README.md | 8 ++++ .../driver-ct/deltic/browser-bundle-entry.ts | 4 +- conformance/driver-ct/deltic/deno.json | 12 +++--- conformance/driver-ct/deltic/deno.lock | 40 +++++++++---------- .../driver-ct/deltic/package-lock.json | 8 ++-- conformance/driver-ct/deltic/package.json | 2 +- conformance/driver-ct/deltic/run-browser.mjs | 2 +- conformance/driver-ct/deltic/run.ts | 6 +-- .../wit/deps/polymorph-webcrypto/.pinned-rev | 2 +- 12 files changed, 52 insertions(+), 44 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e143c53..8f1a96a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -95,7 +95,7 @@ jobs: # Owns the rev derivation, the rev-keyed tools cache, the # install, and the pins gate; `just conformance`'s _ct-tools # recognizes the stamped install and does not repeat it. - uses: polymorph-components/polymorph-test/actions/setup@b4026866e481ead0738742e3b380601b605e5350 + uses: polymorph-components/polymorph-test/actions/setup@b4444a25a22106ad4128549bdc9e579552e62210 with: js-locks: | conformance/driver-ct/deltic/package-lock.json @@ -122,7 +122,7 @@ jobs: - run: just gha::conformance-checks - name: Publish the conformance matrix if: always() && hashFiles('conformance/driver-ct/results/*.jsonl') != '' - uses: polymorph-components/polymorph-test/actions/aggregate@b4026866e481ead0738742e3b380601b605e5350 + uses: polymorph-components/polymorph-test/actions/aggregate@b4444a25a22106ad4128549bdc9e579552e62210 with: lock: conformance/guest-ct/tests.lock manifest: conformance/driver-ct/targets.toml diff --git a/Cargo.lock b/Cargo.lock index b8b0458..d36115f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -313,7 +313,7 @@ dependencies = [ [[package]] name = "component-test-core" version = "0.1.0" -source = "git+https://github.com/polymorph-components/polymorph-test?rev=b4026866e481ead0738742e3b380601b605e5350#b4026866e481ead0738742e3b380601b605e5350" +source = "git+https://github.com/polymorph-components/polymorph-test?rev=b4444a25a22106ad4128549bdc9e579552e62210#b4444a25a22106ad4128549bdc9e579552e62210" dependencies = [ "arcstr", "serde", @@ -322,7 +322,7 @@ dependencies = [ [[package]] name = "component-test-sdk" version = "0.1.0" -source = "git+https://github.com/polymorph-components/polymorph-test?rev=b4026866e481ead0738742e3b380601b605e5350#b4026866e481ead0738742e3b380601b605e5350" +source = "git+https://github.com/polymorph-components/polymorph-test?rev=b4444a25a22106ad4128549bdc9e579552e62210#b4444a25a22106ad4128549bdc9e579552e62210" dependencies = [ "component-test-core", "component-test-sdk-macro", @@ -334,7 +334,7 @@ dependencies = [ [[package]] name = "component-test-sdk-macro" version = "0.1.0" -source = "git+https://github.com/polymorph-components/polymorph-test?rev=b4026866e481ead0738742e3b380601b605e5350#b4026866e481ead0738742e3b380601b605e5350" +source = "git+https://github.com/polymorph-components/polymorph-test?rev=b4444a25a22106ad4128549bdc9e579552e62210#b4444a25a22106ad4128549bdc9e579552e62210" dependencies = [ "component-test-core", "proc-macro2", diff --git a/Cargo.toml b/Cargo.toml index d71b9d2..4eabb8c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -55,7 +55,7 @@ futures = { version = "0.3", default-features = false, features = ["std", "async # pins bump --cargo-toml Cargo.toml --package-json # conformance/driver-ct/deltic/package.json --workflow # .github/workflows/ci.yml`, then the follow-ups it prints. -component-test-sdk = { git = "https://github.com/polymorph-components/polymorph-test", rev = "b4026866e481ead0738742e3b380601b605e5350" } +component-test-sdk = { git = "https://github.com/polymorph-components/polymorph-test", rev = "b4444a25a22106ad4128549bdc9e579552e62210" } aead = { version = "0.6", default-features = false, features = ["alloc"] } aes = { version = "0.9", features = ["zeroize"] } diff --git a/README.md b/README.md index f6fd768..c61d303 100644 --- a/README.md +++ b/README.md @@ -19,6 +19,14 @@ measured in [`bench/`](bench/README.md). Upstreaming and the tls-virt follow-ons remain — see the [issue tracker](https://github.com/polymorph-components/polymorph-tls/issues). +## Releases + +Everything here is **unstable** (0.x), but [releases](../../releases) are +**caret-honest**: within a minor line they stay backward-compatible, and +anything breaking bumps the minor. Consumption is pinned at a release's +commit — cargo git dependencies, vendored WIT, the release-pinned +deltic/JSR graph — and bumped deliberately. + ## Why pure-wasm TLS 1.3 is plausible Whether an algorithm is safe to run in wasm is a timing-channel question. diff --git a/conformance/driver-ct/deltic/browser-bundle-entry.ts b/conformance/driver-ct/deltic/browser-bundle-entry.ts index c58f8a7..8484cd5 100644 --- a/conformance/driver-ct/deltic/browser-bundle-entry.ts +++ b/conformance/driver-ct/deltic/browser-bundle-entry.ts @@ -6,5 +6,5 @@ export * from "@deltic/runtime/embedder"; export { Translator } from "@deltic/runtime/shim"; export * from "@deltic/ct-runner"; -export { wasiShims } from "@deltic/wasi-shims"; -export type { WasiShims, WasiShimsOptions } from "@deltic/wasi-shims"; +export { wasi } from "@deltic/wasi"; +export type { WasiImports, WasiOptions } from "@deltic/wasi"; diff --git a/conformance/driver-ct/deltic/deno.json b/conformance/driver-ct/deltic/deno.json index 2be034f..db70985 100644 --- a/conformance/driver-ct/deltic/deno.json +++ b/conformance/driver-ct/deltic/deno.json @@ -1,11 +1,11 @@ { - "//": "The deltic pin: every @deltic/* import is an exact-pinned JSR prerelease (0.1.0-pre.g078aa15); the hash names one upstream commit and @deltic/translator ships the translator wasm for that SAME commit. deno.lock carries integrity, --frozen enforced. One version repo-wide is asserted by the pin gate (../justfile).", + "//": "The deltic pin: every @deltic/* import is an exact-pinned JSR release (caret-honest upstream: within a minor line releases stay compatible, breaking bumps the minor; per-commit `-pre.g` prereleases exist between releases — pin exactly); @deltic/translator ships the translator wasm for the SAME commit. deno.lock carries integrity, --frozen enforced. One version repo-wide is asserted by the pin gate (../justfile).", "imports": { - "@deltic/ct-runner": "jsr:@deltic/ct-runner@0.1.0-pre.g078aa15", - "@deltic/runtime/embedder": "jsr:@deltic/runtime@0.1.0-pre.g078aa15/embedder", - "@deltic/runtime/shim": "jsr:@deltic/runtime@0.1.0-pre.g078aa15/shim", - "@deltic/wasi-shims": "jsr:@deltic/wasi-shims@0.1.0-pre.g078aa15", - "@deltic/translator": "jsr:@deltic/translator@0.1.0-pre.g078aa15" + "@deltic/ct-runner": "jsr:@deltic/ct-runner@0.1.0", + "@deltic/runtime/embedder": "jsr:@deltic/runtime@0.1.0/embedder", + "@deltic/runtime/shim": "jsr:@deltic/runtime@0.1.0/shim", + "@deltic/wasi": "jsr:@deltic/wasi@0.1.0", + "@deltic/translator": "jsr:@deltic/translator@0.1.0" }, "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*"] }, "tasks": { diff --git a/conformance/driver-ct/deltic/deno.lock b/conformance/driver-ct/deltic/deno.lock index 998de3a..d4d4405 100644 --- a/conformance/driver-ct/deltic/deno.lock +++ b/conformance/driver-ct/deltic/deno.lock @@ -1,41 +1,41 @@ { "version": "5", "specifiers": { - "jsr:@deltic/ct-runner@0.1.0-pre.g078aa15": "0.1.0-pre.g078aa15", + "jsr:@deltic/ct-runner@0.1.0": "0.1.0", "jsr:@deltic/protocol@0.2": "0.2.0", - "jsr:@deltic/runtime@0.1.0-pre.g078aa15": "0.1.0-pre.g078aa15", - "jsr:@deltic/runtime@~0.1.0-pre.g078aa15": "0.1.0-pre.g078aa15", - "jsr:@deltic/translator@0.1.0-pre.g078aa15": "0.1.0-pre.g078aa15", - "jsr:@deltic/wasi-shims@0.1.0-pre.g078aa15": "0.1.0-pre.g078aa15", + "jsr:@deltic/runtime@0.1": "0.1.0", + "jsr:@deltic/runtime@0.1.0": "0.1.0", + "jsr:@deltic/translator@0.1.0": "0.1.0", + "jsr:@deltic/wasi@0.1.0": "0.1.0", "npm:playwright-core@1.62.1": "1.62.1" }, "jsr": { - "@deltic/ct-runner@0.1.0-pre.g078aa15": { - "integrity": "d777a53e6be337d999a80de030628e1226ae7649ca62e49dd444e58d0973e6be", + "@deltic/ct-runner@0.1.0": { + "integrity": "cf642f22675d6733b6d13117cebdd2de95135884d2a1231764a3f7a4e3314982", "dependencies": [ - "jsr:@deltic/runtime@~0.1.0-pre.g078aa15" + "jsr:@deltic/runtime@0.1" ] }, "@deltic/protocol@0.2.0": { "integrity": "028be6a3623c5e910598aa7a199209b85e8931ae484ac7f6638d610ddb0e19fa" }, - "@deltic/runtime@0.1.0-pre.g078aa15": { - "integrity": "5e64f8dc6d32190ecd394d6ad9881eb0fa97b6598b1e7f2ef1d52cff4674287c", + "@deltic/runtime@0.1.0": { + "integrity": "8d3f52f1a336a2dd9aed28a5c34fd281612a2f55a1582b159be614dd678593b3", "dependencies": [ "jsr:@deltic/protocol" ] }, - "@deltic/translator@0.1.0-pre.g078aa15": { - "integrity": "7125f99ac46af4a69f1c432def2b7ea4be63509c3a7ebae83537357615ec33ef", + "@deltic/translator@0.1.0": { + "integrity": "c447f27a90d7637dd3d5709f3f25378ded0f4b985bedc890c3f6a8cb9ff1eb9f", "dependencies": [ - "jsr:@deltic/runtime@~0.1.0-pre.g078aa15" + "jsr:@deltic/runtime@0.1" ] }, - "@deltic/wasi-shims@0.1.0-pre.g078aa15": { - "integrity": "fba2081f804eaaccf95e31cdd634fd85a2d724f6be7f62578ddc26aef03524a1", + "@deltic/wasi@0.1.0": { + "integrity": "c35a19d139d684dafeca8ba200230a3eb1154627c80db298ae1393e3af938d68", "dependencies": [ "jsr:@deltic/protocol", - "jsr:@deltic/runtime@~0.1.0-pre.g078aa15" + "jsr:@deltic/runtime@0.1" ] } }, @@ -47,10 +47,10 @@ }, "workspace": { "dependencies": [ - "jsr:@deltic/ct-runner@0.1.0-pre.g078aa15", - "jsr:@deltic/runtime@0.1.0-pre.g078aa15", - "jsr:@deltic/translator@0.1.0-pre.g078aa15", - "jsr:@deltic/wasi-shims@0.1.0-pre.g078aa15" + "jsr:@deltic/ct-runner@0.1.0", + "jsr:@deltic/runtime@0.1.0", + "jsr:@deltic/translator@0.1.0", + "jsr:@deltic/wasi@0.1.0" ], "packageJson": { "dependencies": [ diff --git a/conformance/driver-ct/deltic/package-lock.json b/conformance/driver-ct/deltic/package-lock.json index f528859..aa9a554 100644 --- a/conformance/driver-ct/deltic/package-lock.json +++ b/conformance/driver-ct/deltic/package-lock.json @@ -6,14 +6,14 @@ "": { "name": "@polymorph/tls-conformance-deltic-browser", "dependencies": { - "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4026866e481ead0738742e3b380601b605e5350", + "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210", "playwright-core": "1.62.1" } }, "node_modules/@polymorph/component-test-js": { - "version": "0.2.0", - "resolved": "git+ssh://git@github.com/polymorph-components/polymorph-test.git#b4026866e481ead0738742e3b380601b605e5350", - "integrity": "sha512-yjekMTYYvlXG1ZI6LGw+ySuCZqhBHz7WXkyjpPsCZQkz+hxIRNF/kiemakwfCGiD7f4xf64Hb6sKV18K7d7MjQ==", + "version": "0.1.0", + "resolved": "git+ssh://git@github.com/polymorph-components/polymorph-test.git#b4444a25a22106ad4128549bdc9e579552e62210", + "integrity": "sha512-ILkXf8zIytf4r8Z/YlrdwpcBQ+CdBMJ+pImzQzsBoZ9iuCkK3ShtqRBeM/kHXPk9bGS8XQRmDTgkbk2KgGXBFw==", "license": "Apache-2.0 WITH LLVM-exception" }, "node_modules/playwright-core": { diff --git a/conformance/driver-ct/deltic/package.json b/conformance/driver-ct/deltic/package.json index 13d1136..77d290e 100644 --- a/conformance/driver-ct/deltic/package.json +++ b/conformance/driver-ct/deltic/package.json @@ -4,7 +4,7 @@ "type": "module", "description": "Node driver for the deltic-browser conformance rows: the composed artifacts runtime-linked inside headless Chromium through the upstream page driver and deltic worker.", "dependencies": { - "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4026866e481ead0738742e3b380601b605e5350", + "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210", "playwright-core": "1.62.1" } } diff --git a/conformance/driver-ct/deltic/run-browser.mjs b/conformance/driver-ct/deltic/run-browser.mjs index 7c201ac..2a95b15 100644 --- a/conformance/driver-ct/deltic/run-browser.mjs +++ b/conformance/driver-ct/deltic/run-browser.mjs @@ -10,7 +10,7 @@ // // The artifacts import only wasi 0.2 and test-context, so there is no // SUT host module on this leg and the stock upstream worker serves it -// unmodified (wasiShims + test-context are inside the bundle). +// unmodified (wasi() + test-context are inside the bundle). // // Gates in CI (the Actions runner image ships Chrome); locally it runs // under CONFORMANCE_BROWSER=1 (`just conformance-ct::all`) or directly diff --git a/conformance/driver-ct/deltic/run.ts b/conformance/driver-ct/deltic/run.ts index 539cacf..5d2c550 100644 --- a/conformance/driver-ct/deltic/run.ts +++ b/conformance/driver-ct/deltic/run.ts @@ -8,7 +8,7 @@ // run-node.mjs | this runner // --------------------------------------+--------------------------- // jco transpile + loadCoreModules | translator.translate(bytes) -// bindImports (preview2-shim, both | wasiShims() (track-keyed: +// bindImports (preview2-shim, both | wasi() (track-keyed: // wasi minor spellings bound) | one @0.2 provider serves // | every minor) // inventoryLookup(coreBytes) + missing | deltic reads the suite's own @@ -33,7 +33,7 @@ import { Translator } from "@deltic/runtime/shim"; import type { ComponentArtifacts } from "@deltic/runtime/embedder"; import { runSuite } from "@deltic/ct-runner"; -import { wasiShims } from "@deltic/wasi-shims"; +import { wasi } from "@deltic/wasi"; import { defaultTranslator } from "@deltic/translator"; const ROOT = new URL("../../../", import.meta.url); @@ -120,7 +120,7 @@ async function main() { const lines: string[] = []; const counts = await runSuite(artifacts, { - imports: wasiShims(), + imports: wasi(), target: cli.target, suiteName: cli.suiteName, missing: cli.missing, diff --git a/examples/webcrypto-signer/wit/deps/polymorph-webcrypto/.pinned-rev b/examples/webcrypto-signer/wit/deps/polymorph-webcrypto/.pinned-rev index 4cbb742..a70f850 100644 --- a/examples/webcrypto-signer/wit/deps/polymorph-webcrypto/.pinned-rev +++ b/examples/webcrypto-signer/wit/deps/polymorph-webcrypto/.pinned-rev @@ -1 +1 @@ -61fbd02c55141a1c0d76eb524e7af4bb9488fc31 +5bb3d483f30e78b0b029bdedb500956710234c1b