wasmtime / PR #14219 Vendor the cap-primitives crate with... · git-wasmtime

Stream: git-wasmtime

Topic: wasmtime / PR #14219 Vendor the cap-primitives crate with...

Wasmtime GitHub notifications bot (Aug 27 2026 at 21:46):

alexcrichton opened PR #14219 from alexcrichton:vendor-cap-primitives to bytecodealliance:main:

This PR is a series of commits which vendors the cap-primitives crate, or what Wasmtime needs, within the wasmtime-wasi crate. This is done as an acknowledgement of the current maintenance and state of the cap-std repository and project where having a security-critical dependency external of Wasmtime itself is becoming more and more of a burden. This was discussed in today's Wasmtime meeting and had unanimous agreement about this transition. The Bytecode Alliance TSC will, I believe, ask if anyone would like to end up maintaining the cap-std crates in parallel to this but our decision was that regardless of that outcome it's still best to vendor the code here within Wasmtime itself.

This PR is structured as a sequential list of commits which tell a story of sorts of how this was vendored. This is a very large change so the intention is to be as methodical and "obviously correct" as possible. The cap-primitives crate contains quite a bit of functionality which Wasmtime doesn't need and can thus be deleted. Additionally the tests for cap-primitives are all written against the cap-std layer which has a differently-shaped API surface area. To that end the major adjustments from cap-primitives are:

Only the fs, rustix, and windows submodules are vendored here.

All dead code and dead #[cfg]-related code has been deleted.

Tests were copied verbatim from cap-std, and then adjusted/deleted as necessary. Due to the scale of the change this step was primarily done with LLM assistance and manual review.

A minor debug-only bug was fixed for me to run tests locally.

All dependencies of cap-primitives, added to wasmtime-wasi, were subsequently removed as they were pretty light dependencies.

The end result is intended to be a source-wise pretty much line-for-line vendor of cap-primitives. The tests are spiritually all ported over but greatly differ at the source level due to API differences. This PR is intended to be proactively backported to supported release branches of Wasmtime to avoid the need to patch external code should future security issues arise with the wasi:filesystem implementation. This includes Wasmtime 36, 47, and 48. To this end the switch-over here was audited to ensure that the public API of the wasmtime-wasi crate does not change as a result of this commit and is thus semver-compatible to backport. This means that there's a single remaining vestigal use of the cap-primitives crate to simply reexport the SystemTimeSpec type at the root of the wasmtime-wasi crate. This isn't actually used anywhere, though, so the only purpose is its reexport. This reexport will be deleted on main after this PR, but will not be deleted in backports.

The backport situation for Wasmtime 36 and 47 is going to be more complicated because they do not contain https://github.com/bytecodealliance/wasmtime/pull/13872. Despite that I think we'll still be able to basically pull it off, but I've not yet proven this out.

Wasmtime GitHub notifications bot (Aug 27 2026 at 21:46):

alexcrichton requested pchickey for a review on PR #14219.

Wasmtime GitHub notifications bot (Aug 27 2026 at 21:46):

alexcrichton requested wasmtime-wasi-reviewers for a review on PR #14219.

Wasmtime GitHub notifications bot (Aug 27 2026 at 21:46):

alexcrichton requested fitzgen for a review on PR #14219.

Wasmtime GitHub notifications bot (Aug 27 2026 at 21:46):

alexcrichton requested wasmtime-default-reviewers for a review on PR #14219.