Add support for digital signatures

.github/workflows/main.yml

@@ -348,6 +348,21 @@ jobs:
       env:
         RUST_BACKTRACE: 1
 
+  # Build and test digital signatures.
+  test_digital_signatures:
+    name: Test digital signatures
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        submodules: true
+    - run: rustup target add wasm32-wasi
+    - name: Install Rust
+      run: rustup update stable && rustup default stable
+    - run: ./ci/run-digital-signatures-test.sh
+      env:
+        RUST_BACKTRACE: 1
+
   bench:
     name: Run benchmarks
     runs-on: ubuntu-latest

Cargo.toml

@@ -40,6 +40,7 @@ humantime = "2.0.0"
 wasmparser = "0.82.0"
 lazy_static = "1.4.0"
 listenfd = "0.3.5"
+wasmsign2 = { version = "0.1.13", optional = true }
 
 [target.'cfg(unix)'.dependencies]
 rustix = "0.33.0"
@@ -109,6 +110,7 @@ memory-init-cow = ["wasmtime/memory-init-cow"]
 pooling-allocator = ["wasmtime/pooling-allocator"]
 all-arch = ["wasmtime/all-arch"]
 posix-signals-on-macos = ["wasmtime/posix-signals-on-macos"]
+digital-signatures = ["wasmsign2", "wasmtime/digital-signatures"]
 
 # Stub feature that does nothing, for Cargo-features compatibility: the new
 # backend is the default now.

ci/run-digital-signatures-test.sh

@@ -0,0 +1,34 @@
+#! /bin/bash
+
+set -e
+
+TMP_DIR=$(mktemp -d -t ci-XXXXXXXXXX)
+pushd "$TMP_DIR"
+
+WASMSIGN="${TMP_DIR}/bin/wasmsign2"
+WASM_MODULE="${TMP_DIR}/bin/test-module.wasm"
+PUBLIC_KEY="${TMP_DIR}/public.key"
+SECRET_KEY="${TMP_DIR}/secret.key"
+
+cargo install --version 0.1.4 --root "$TMP_DIR" wasmsign2-cli
+"$WASMSIGN" keygen -K "$PUBLIC_KEY" -k "$SECRET_KEY"
+
+rm -fr test-module
+cargo new test-module
+pushd test-module
+cargo install --root "$TMP_DIR" --path . --target=wasm32-wasi
+popd
+
+popd
+
+cargo run --features digital-signatures -- run "$WASM_MODULE"
+
+if cargo run --features digital-signatures -- run --experimental-public-keys "$PUBLIC_KEY" "$WASM_MODULE"; then
+  echo "Module ran even though signature verification failed" >&2
+  exit 1
+fi
+
+"$WASMSIGN" sign -k "$SECRET_KEY" -i "$WASM_MODULE" -o "$WASM_MODULE"
+cargo run --features digital-signatures -- run --experimental-public-keys "$PUBLIC_KEY" "$WASM_MODULE"
+
+rm -fr "$TMP_DIR"

crates/wasmtime/Cargo.toml

@@ -38,6 +38,7 @@ rayon = { version = "1.0", optional = true }
 object = { version = "0.27", default-features = false, features = ['read_core', 'elf'] }
 async-trait = { version = "0.1.51", optional = true }
 once_cell = "1.9"
+wasmsign2 = { version = "0.1.11", optional = true }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 winapi = "0.3.7"
@@ -108,3 +109,6 @@ posix-signals-on-macos = ["wasmtime-runtime/posix-signals-on-macos"]
 # Enabling this feature has no effect on unsupported platforms or when the
 # `uffd` feature is enabled.
 memory-init-cow = ["wasmtime-runtime/memory-init-cow"]
+
+# Enables support for signatures verification
+digital-signatures = ["wasmsign2"]

crates/wasmtime/src/config.rs

@@ -106,6 +106,8 @@ pub struct Config {
     pub(crate) paged_memory_initialization: bool,
     pub(crate) memory_init_cow: bool,
     pub(crate) memory_guaranteed_dense_image_size: u64,
+    #[cfg(feature = "digital-signatures")]
+    pub(crate) public_keys: Option<Arc<wasmsign2::PublicKeySet>>,
 }
 
 impl Config {
@@ -133,6 +135,8 @@ impl Config {
             paged_memory_initialization: cfg!(all(target_os = "linux", feature = "uffd")),
             memory_init_cow: true,
             memory_guaranteed_dense_image_size: 16 << 20,
+            #[cfg(feature = "digital-signatures")]
+            public_keys: None,
         };
         #[cfg(compiler)]
         {
@@ -1069,6 +1073,13 @@ impl Config {
         self
     }
 
+    /// Configure the set of public keys used for digital signatures verification.
+    #[cfg(feature = "digital-signatures")]
+    pub fn public_keys(&mut self, public_keys: wasmsign2::PublicKeySet) -> &mut Self {
+        self.public_keys = Some(Arc::new(public_keys));
+        self
+    }
+
     /// Configures the size, in bytes, of the extra virtual memory space
     /// reserved after a "dynamic" memory for growing into.
     ///
@@ -1337,6 +1348,8 @@ impl Clone for Config {
             paged_memory_initialization: self.paged_memory_initialization,
             memory_init_cow: self.memory_init_cow,
             memory_guaranteed_dense_image_size: self.memory_guaranteed_dense_image_size,
+            #[cfg(feature = "digital-signatures")]
+            public_keys: self.public_keys.clone(),
         }
     }
 }

crates/wasmtime/src/module.rs

@@ -242,10 +242,12 @@ impl Module {
     #[cfg(compiler)]
     #[cfg_attr(nightlydoc, doc(cfg(feature = "cranelift")))] // see build.rs
     pub fn from_file(engine: &Engine, file: impl AsRef<Path>) -> Result<Module> {
-        match Self::new(
-            engine,
-            &fs::read(&file).with_context(|| "failed to read input file")?,
-        ) {
+        let bytes = fs::read(&file).with_context(|| "failed to read input file")?;
+        #[cfg(feature = "digital-signatures")]
+        if let Some(public_key_set) = &engine.config().public_keys {
+            public_key_set.verify(&mut std::io::Cursor::new(&bytes), None)?;
+        }
+        match Self::new(engine, &bytes) {
             Ok(m) => Ok(m),
             Err(e) => {
                 cfg_if::cfg_if! {