Add support for digital signatures

This adds a new cargo feature flag `digital-signatures` that
brings support for signature verification, using the the current proposal
for WebAssembly modules signatures.
(https://github.com/WebAssembly/tool-conventions/blob/main/Signatures.md)

No behavior changes unless the `--public-keys` option is used with
the `run` command. This options accepts one or more public keys, that
the entire module must be signed with in order to run.

Author: jedisct1

.github/workflows/main.yml

@@ -350,6 +350,21 @@ jobs:
       env:
         RUST_BACKTRACE: 1
 
+  # Build and test digital signatures.
+  test_digital_signatures:
+    name: Test digital signatures
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        submodules: true
+    - run: rustup target add wasm32-wasi
+    - name: Install Rust
+      run: rustup update stable && rustup default stable
+    - run: ./ci/run-digital-signatures-test.sh
+      env:
+        RUST_BACKTRACE: 1
+
   bench:
     name: Run benchmarks
     runs-on: ubuntu-latest

Cargo.lock

@@ -40,6 +40,7 @@ humantime = "2.0.0"
 wasmparser = "0.82.0"
 lazy_static = "1.4.0"
 listenfd = "0.3.5"
+wasmsign2 = { version = "0.1.11", optional = true }
 
 [target.'cfg(unix)'.dependencies]
 rustix = "0.33.0"
@@ -107,6 +108,7 @@ memfd = ["wasmtime/memfd"]
 pooling-allocator = ["wasmtime/pooling-allocator"]
 all-arch = ["wasmtime/all-arch"]
 posix-signals-on-macos = ["wasmtime/posix-signals-on-macos"]
+digital-signatures = ["wasmsign2", "wasmtime/digital-signatures"]
 
 # Stub feature that does nothing, for Cargo-features compatibility: the new
 # backend is the default now.

Cargo.toml

@@ -0,0 +1,34 @@
+#! /bin/bash
+
+set -e
+
+TMP_DIR=$(mktemp -d -t ci-XXXXXXXXXX)
+pushd "$TMP_DIR"
+
+WASMSIGN="${TMP_DIR}/bin/wasmsign2"
+WASM_MODULE="${TMP_DIR}/bin/test-module.wasm"
+PUBLIC_KEY="${TMP_DIR}/public.key"
+SECRET_KEY="${TMP_DIR}/secret.key"
+
+cargo install --version 0.1.4 --root "$TMP_DIR" wasmsign2-cli
+"$WASMSIGN" keygen -K "$PUBLIC_KEY" -k "$SECRET_KEY"
+
+rm -fr test-module
+cargo new test-module
+pushd test-module
+cargo install --root "$TMP_DIR" --path . --target=wasm32-wasi
+popd
+
+popd
+
+cargo run --features digital-signatures -- run "$WASM_MODULE"
+
+if cargo run --features digital-signatures -- run --public-keys "$PUBLIC_KEY" "$WASM_MODULE"; then
+  echo "Module ran even though signature verification failed" >&2
+  exit 1
+fi
+
+"$WASMSIGN" sign -k "$SECRET_KEY" -i "$WASM_MODULE" -o "$WASM_MODULE"
+cargo run --features digital-signatures -- run --public-keys "$PUBLIC_KEY" "$WASM_MODULE"
+
+rm -fr "$TMP_DIR"

ci/run-digital-signatures-test.sh

@@ -38,6 +38,7 @@ rayon = { version = "1.0", optional = true }
 object = { version = "0.27", default-features = false, features = ['read_core', 'elf'] }
 async-trait = { version = "0.1.51", optional = true }
 once_cell = "1.9"
+wasmsign2 = { version = "0.1.11", optional = true }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 winapi = "0.3.7"
@@ -107,3 +108,6 @@ posix-signals-on-macos = ["wasmtime-runtime/posix-signals-on-macos"]
 # Enabling this feature has no effect on non-Linux platforms or when the `uffd`
 # feature is enabled.
 memfd = ["wasmtime-runtime/memfd"]
+
+# Enables support for signatures verification
+digital-signatures = ["wasmsign2"]

crates/wasmtime/Cargo.toml

@@ -105,6 +105,8 @@ pub struct Config {
     pub(crate) parallel_compilation: bool,
     pub(crate) paged_memory_initialization: bool,
     pub(crate) memfd: bool,
+    #[cfg(feature = "digital-signatures")]
+    pub(crate) public_keys: Option<Arc<wasmsign2::PublicKeySet>>,
 }
 
 impl Config {
@@ -131,6 +133,8 @@ impl Config {
             // Default to paged memory initialization when using uffd on linux
             paged_memory_initialization: cfg!(all(target_os = "linux", feature = "uffd")),
             memfd: false,
+            #[cfg(feature = "digital-signatures")]
+            public_keys: None,
         };
         #[cfg(compiler)]
         {
@@ -1063,6 +1067,13 @@ impl Config {
         self
     }
 
+    /// Configure the set of public keys used for digital signatures verification.
+    #[cfg(feature = "digital-signatures")]
+    pub fn public_keys(&mut self, public_keys: wasmsign2::PublicKeySet) -> &mut Self {
+        self.public_keys = Some(Arc::new(public_keys));
+        self
+    }
+
     /// Configures the size, in bytes, of the extra virtual memory space
     /// reserved after a "dynamic" memory for growing into.
     ///
@@ -1269,6 +1280,8 @@ impl Clone for Config {
             parallel_compilation: self.parallel_compilation,
             paged_memory_initialization: self.paged_memory_initialization,
             memfd: self.memfd,
+            #[cfg(feature = "digital-signatures")]
+            public_keys: self.public_keys.clone(),
         }
     }
 }

crates/wasmtime/src/config.rs

@@ -241,10 +241,12 @@ impl Module {
     #[cfg(compiler)]
     #[cfg_attr(nightlydoc, doc(cfg(feature = "cranelift")))] // see build.rs
     pub fn from_file(engine: &Engine, file: impl AsRef<Path>) -> Result<Module> {
-        match Self::new(
-            engine,
-            &fs::read(&file).with_context(|| "failed to read input file")?,
-        ) {
+        let bytes = fs::read(&file).with_context(|| "failed to read input file")?;
+        #[cfg(feature = "digital-signatures")]
+        if let Some(public_key_set) = &engine.config().public_keys {
+            public_key_set.verify(&mut std::io::Cursor::new(&bytes), None)?;
+        }
+        match Self::new(engine, &bytes) {
             Ok(m) => Ok(m),
             Err(e) => {
                 cfg_if::cfg_if! {

crates/wasmtime/src/module.rs

@@ -103,6 +103,11 @@ use wasmtime::{Config, ProfilingStrategy};
 #[cfg(feature = "pooling-allocator")]
 use wasmtime::{InstanceLimits, ModuleLimits, PoolingAllocationStrategy};
 
+#[cfg(feature = "digital-signatures")]
+use wasmsign2::PublicKeySet;
+#[cfg(not(feature = "digital-signatures"))]
+struct PublicKeySet;
+
 fn pick_profiling_strategy(jitdump: bool, vtune: bool) -> Result<ProfilingStrategy> {
     Ok(match (jitdump, vtune) {
         (true, false) => ProfilingStrategy::JitDump,
@@ -258,6 +263,12 @@ struct CommonOptions {
     #[cfg(feature = "pooling-allocator")]
     #[structopt(long)]
     pooling_allocator: bool,
+
+    /// Require modules to have a embedded signature that can be verified
+    /// with the given set of public keys.
+    #[structopt(long, value_name = "FILE,FILE,...", parse(try_from_str = parse_public_keys))]
+    #[allow(dead_code)]
+    public_keys: Option<PublicKeySet>,
 }
 
 impl CommonOptions {
@@ -350,6 +361,11 @@ impl CommonOptions {
             }
         }
 
+        #[cfg(feature = "digital-signatures")]
+        if let Some(public_keys) = &self.public_keys {
+            config.public_keys(public_keys.clone());
+        }
+
         Ok(config)
     }
 
@@ -507,6 +523,21 @@ fn parse_wasi_modules(modules: &str) -> Result<WasiModules> {
     }
 }
 
+#[cfg(feature = "digital-signatures")]
+fn parse_public_keys(pk_files: &str) -> Result<PublicKeySet> {
+    let mut public_key_set = PublicKeySet::empty();
+    for pk_file in pk_files.split(',') {
+        let pk_file = pk_file.trim();
+        public_key_set.insert_any_file(pk_file)?;
+    }
+    Ok(public_key_set)
+}
+
+#[cfg(not(feature = "digital-signatures"))]
+fn parse_public_keys(_pk_files: &str) -> Result<PublicKeySet> {
+    bail!("Digital signatures support is not enabled");
+}
+
 /// Select which WASI modules are available at runtime for use by Wasm programs.
 #[derive(Debug, Clone, Copy, PartialEq)]
 pub struct WasiModules {