Rajat Jindal (Jul 08 2024 at 09:16): Rajat Jindal (Jul 08 2024 at 09:16):Hello folks,
I am working on a POC of a system (wasmtime backed GitHub actions) that involves downloading files and setting them up on the host.
The idea is to have a wasmtime(or Spin) based runtime that runs wasm guest components as CLI commands, which perform some of the GitHub action steps. e.g., fetching token from Vault/Tailscale, downloading tools, etc. The advantage is that we can statically define (and audit) the permissions (e.g., outbound hosts, filesystem paths, etc) GitHub actions have, which helps to make them secure.
While implementing the POC, I was able to download the file, but I couldn't find a function to change that to executable in wasip2. Is that something considered and rejected or something we can discuss and see the viability of adding it to the filesystem WIT in a future release?
(Also happy to discuss if folks think this is a bad idea).
Lann Martin (Jul 08 2024 at 12:44):Execute permissions aren't universal, e.g. Windows doesn't have an exact equivalent afaik
Rajat Jindal (Jul 08 2024 at 16:10):in that case maybe we can just ignore this for windows, and implement for other platform which support it? what would be the right way to collect feedback on such a proposal?
Lann Martin (Jul 08 2024 at 16:15):I think that might be somewhat at odds with the design philosophy of wasi-filesystem, though @Dan Gohman would be the one to speak to that. In the near term I would suggest adding your own host import, which could be relatively high-level like make-executable.
bjorn3 (Jul 08 2024 at 17:35):What would be the point of being able to make a file executable from wasi considering that wasi doesn't allow spawning subprocesses anyway?
Lann Martin (Jul 08 2024 at 17:40):@bjorn3 presumably this would be one step in a CI pipeline where later steps wouldn't (necessarily) use WASI
Rajat Jindal (Jul 08 2024 at 18:20):yeah, the use case is to implement secure CI actions, where author of actions specify required permissions, and the runtime enforces those permissions. With that we can have the required permissions more visible and auditable.
Notification Bot (Jul 09 2024 at 06:56):Rajat Jindal has marked this topic as resolved.
Last updated: Dec 23 2024 at 12:05 UTC