Stream: git-wasmtime

Topic: wasmtime / PR #13550 Update SMT-based ISLE verifier

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 15:12):

avanhatt edited PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 15:14):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 15:42):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 16:02):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 16:07):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 16:08):

avanhatt requested cfallin for a review on PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 16:38):

cfallin commented on PR #13550:

@avanhatt I'm taking a look at the cargo-vets now and it looks like this PR bumps a bunch of dep versions in ways that I hope are not necessary -- the vet backlog is now

Which is unfortunately probably infeasible for me to do. Could you (i) revert Cargo.lock to its state from your latest merge-from-main, and (ii) run a build again, to see if we can minimize the diff? I suspect that maybe this branch ran a cargo update at some point and did a bunch of incidental upgrades.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 16:38):

cfallin edited a comment on PR #13550:

@avanhatt I'm taking a look at the cargo-vets now and it looks like this PR bumps a bunch of dep versions in ways that I hope are not necessary -- the vet backlog is now

Which is unfortunately probably infeasible for me to do. Could you (i) revert Cargo.lock to its state from your latest merge-from-main, and (ii) run a build again, to see if we can minimize the diff? I suspect that maybe this branch ran a cargo update at some point and did a bunch of incidental upgrades.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 16:58):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 17:03):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 17:13):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 17:13):

cfallin commented on PR #13550:

Thanks for your last commit -- looks like the dep bumps and vet burden are real; still 425163 LoC.

Digging into one particular bump (tracing 0.1.41 -> 0.1.44, which alone is 61kLoC of diff), it looks like the aslp crate depends on tracing too, and probably pulled in a newer version somehow?

Would you mind doing a little dep gardening to see if we can get the diff to our deps a bit smaller? cargo vet should work locally for anyone to check the audit backlog size, too. Thanks!

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 22:41):

mmcloughlin updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 22:50):

mmcloughlin commented on PR #13550:

Would you mind doing a little dep gardening

Done and pushed. I see 7 unvetted dependencies in cargo vet now. Some appear to be partially covered already trusted authors. The biggest remaining one is pest, which I think may fall under the "10,000 downloads a day" policy.

Let us know if you see the same, and the backlog is manageable.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 23:09):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 15 2026 at 23:11):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 16 2026 at 17:18):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 16 2026 at 17:38):

alexcrichton commented on PR #13550:

A note on the vets here -- we already exempt dependencies exclusively related to fuzzing from vetting and I think it would be reasonable to take a similar stance here. Specifically if you apply this diff:

diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index 16d0abfb19..925447fe98 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -64,6 +64,12 @@ audit-as-crates-io = true
 [policy.cranelift-isle]
 audit-as-crates-io = true

+[policy.cranelift-isle-veri]
+criteria = []
+
+[policy.cranelift-isle-veri-aslp]
+criteria = []
+
 [policy.cranelift-jit]
 audit-as-crates-io = true

the cargo vet command succeeds and nothing else is necessary.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 17 2026 at 00:07):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 17 2026 at 17:38):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 17 2026 at 17:41):

avanhatt updated PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 17 2026 at 19:00):

:thumbs_up: cfallin submitted PR review:

With all of the tweaks and now a green CI run, this looks ready to merge.

Thanks again @avanhatt, @mmcloughlin and others for all the work on this! Looking forward to followup work to get this in CI by default (I have some tasks for this). It's a great addition to our correctness story.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 17 2026 at 19:00):

cfallin added PR #13550 Update SMT-based ISLE verifier to the merge queue.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 17 2026 at 20:14):

:check: cfallin merged PR #13550.

view this post on Zulip Wasmtime GitHub notifications bot (Jun 17 2026 at 20:14):

cfallin removed PR #13550 Update SMT-based ISLE verifier from the merge queue.

Last updated: Jul 29 2026 at 05:03 UTC