Add documentation for adding new crates (#12300)

This commit adds contributor documentation to our book about how to add
a new crate to the workspace with respect to the crates.io-based trusted
publ

Add documentation for adding new crates (#12300)

This commit adds contributor documentation to our book about how to add
a new crate to the workspace with respect to the crates.io-based trusted
publishing workflow. The error messages in the verify-publish script
have also been adjusted to point to this URL.

show more ...

Add contrib docs about unsafe code (#11177)

This is my attempt to summarize the discussion from the Wasmtime meeting
today to write down and codify some of the thinking about `unsafe` code
and how w

Add contrib docs about unsafe code (#11177)

This is my attempt to summarize the discussion from the Wasmtime meeting
today to write down and codify some of the thinking about `unsafe` code
and how we handle it within Wasmtime over time.

show more ...

More clearly flag internal crates as such (#10963)

* More clearly flag internal crates as such

This commit is an attempt to more clearly flag internal crates in this
project as internal and not int

More clearly flag internal crates as such (#10963)

* More clearly flag internal crates as such

This commit is an attempt to more clearly flag internal crates in this
project as internal and not intended for external use. Specifically:

* Many crates are renamed from `wasmtime-foo` to
`wasmtime-internal-foo`.
* All of these crates now have `INTERNAL: ...` in their crates.io
description.
* All of these crates now have a warning at the top of their
documentation discouraging use.

This change is a result of rustsec/advisory-db#1999 where the goal is to
be crystal clear from a project perspective that usage of these crates
are highly discouraged and not supported. We'll still probably get such
advisories but we won't be considering them CVEs from the project itself
due to the internal nature of these crates and the discouraging
warnings.

Some concrete changes used here are:

* Inter-crate dependencies still use `wasmtime_foo` for naming and do
so with Cargo's package-renaming features.
* Crate renames are specified at the workspace level so the rename is
only in one locations and all other inherit it.
* Contribution documentation now has some brief guidelines about crate
organization.

* Update vet config

* Update checks for wasmtime-fiber

prtest:full

* Update publish script

* Another fiber rename

* Fix some doc tests

show more ...

refactor(docs): more conversions of sh to console for copy-paste (#10707)

This commit udpates more instructions on various READMEs to avoid `$`
for easy copy-pasting, and also use `console` where ap

refactor(docs): more conversions of sh to console for copy-paste (#10707)

This commit udpates more instructions on various READMEs to avoid `$`
for easy copy-pasting, and also use `console` where appropriate.

Signed-off-by: Victor Adossi <[email protected]>

show more ...

Clarify MSRV intent in contributor docs (#9936)

Currently we support 3 versions of rustc (current, current-1, and
current-2). This is probably too small a window for someone out there on
the interne

Clarify MSRV intent in contributor docs (#9936)

Currently we support 3 versions of rustc (current, current-1, and
current-2). This is probably too small a window for someone out there on
the internet so this commit adds a clarification with some rationale for
the current policy as well as an olive branch for "please talk to us if
you want a wider window". Basically I wanted to update this to
explicitly declare intent that we're open to reconsidering this policy
as necessary (without actually committing to any alternative policy
yet).

show more ...

Add contributors docs about lints/warnings/clippy (#9323)

Inspired by #9318 I realized we haven't actually documented anything
about compiler warnings or Clippy warnings in our contributor docs, so

Add contributors docs about lints/warnings/clippy (#9323)

Inspired by #9318 I realized we haven't actually documented anything
about compiler warnings or Clippy warnings in our contributor docs, so I
have aspired to do so in this commit. My goal is to reflect the current
state of the repository in this documentation, not add anything new.

show more ...

Don't gate on `cargo vet` for PRs (#8343)

* Don't gate on `cargo vet` for PRs

Gate the `cargo vet` step for the merge queue by default but for PRs
don't fail the PR's CI and instead allow entering

Don't gate on `cargo vet` for PRs (#8343)

* Don't gate on `cargo vet` for PRs

Gate the `cargo vet` step for the merge queue by default but for PRs
don't fail the PR's CI and instead allow entering the queue with a
failing `cargo vet` entry. This should help make it easier to land a
`cargo vet` entry on `main` outside of a PR while not requiring the PR
is rebased.

* Fix syntax

* Trigger cargo vet failures

* Fix conditional

* Try to fix conditional

* More changes

* Revert "Trigger cargo vet failures"

This reverts commit 14ba8cb52c955a6843c8c80c19d1274dfc8bb97e.

* Update Cargo.lock but also have vet pass

* Try different syntax

* Revert "Update Cargo.lock but also have vet pass"

This reverts commit 16798388481f9ad57292bedb9b5643a6dcb87297.

* Remove debugging

* Spruce up some comments

* Update docs

show more ...

Update Wasmtime's policy on `cargo vet` (#8259)

* Update Wasmtime's policy on `cargo vet`

This was discussed at today's Wasmtime meeting out of some concerns
around our current policies. Namely I f

Update Wasmtime's policy on `cargo vet` (#8259)

* Update Wasmtime's policy on `cargo vet`

This was discussed at today's Wasmtime meeting out of some concerns
around our current policies. Namely I felt the current state of affairs
is not striking the right balance between cost and benefit with our
usage of `cargo vet`. After discussion we've reached consensus around
two changes to our `cargo vet` policy documented here in this PR:

* An exemption can be added for "popular crates" at any time with no
review required. This should handle most big crates that are needed
for various dependencies. The thinking behind this is that a
supply-chain attack against these crates is highly likely to be
detected in a short time due to their popularity. Coupled with the
fact that changes to Wasmtime take a minimum of two weeks to get
released means that it's an unlikely exploitation vector.

* Maintainers are recommended to push directly to contributor's PRs for
`cargo vet` entries instead of making separate PRs. This avoids the
need for contributor rebasing and additionally solves the problem
where the `vet` entries land in a separate PR but then the
contributor's PR takes much longer to land. In the interim some `vet`
entries have been cleaned up by accident which requires re-landing the
PR to add the entries.

* Review comments

show more ...

Document `cargo vet` in contributing docs (#7635)

I realized just now that we haven't actually documented our usage of
`cargo vet` anywhere in our contributing documentation (or not that I
could fin

Document `cargo vet` in contributing docs (#7635)

I realized just now that we haven't actually documented our usage of
`cargo vet` anywhere in our contributing documentation (or not that I
could find), so I decided to try and rectify that!

show more ...

Update Rust in CI to 1.72.0, clarify Wasmtime's MSRV (#6900)

* Update Rust in CI to 1.72.0

* Update CI, tooling, and docs for MSRV

This commit codifies an MSRV policy for Wasmtime at "stable minus

Update Rust in CI to 1.72.0, clarify Wasmtime's MSRV (#6900)

* Update Rust in CI to 1.72.0

* Update CI, tooling, and docs for MSRV

This commit codifies an MSRV policy for Wasmtime at "stable minus two"
meaning that the latest three releases of Rust will be supported. This
is enforced on CI with a full test suite job running on Linux x86_64
with the minimum supported Rust version. The full test suite will use
the latest stable version. A downside of this approach is that new
changes may break MSRV support on non-Linux or non-x86_64 platforms and
we won't know about it, but that's deemed a minor enough risk at this
time.

A minor fix is applied to Wasmtime's `Cargo.toml` to support Rust 1.70.0
instead of requiring Rust 1.71.0

* Fix installation of rust

* Scrape MSRV from Cargo.toml

* Cranelift is the same as Wasmtime's MSRV now, more words too

* Fix a typo

show more ...

docs: Better title formatting for the coding guidelines

Merge the CONTRIBUTING.md files