wasm-to-oci

General info

wasm-to-oci is a client which allows for the pushing/pulling of WASM modules to/from a registry. The examples here assume compiling to WASM from rust, although you can use many different languages. To follow the examples, you will need rust installed, as well as the rustup and cargo tools, and optionally the wasmtime tool.

Media type: application/vnd.wasm.config.v1+json

Client homepage: https://github.com/engineerd/wasm-to-oci

Usage

Authentication

First, set the BB_USER environment variable to your Bundle Bar username:

BB_USER="<insert_username_here>"

Next, create a token in the Bundle Bar UI and copy it into your clipboard. Set it in the BB_TOKEN environment variable using one of the following commands:

 BB_TOKEN="<insert_token_here>"  # manual copy-paste
 BB_TOKEN="$(pbpaste)"           # with pbpaste
 BB_TOKEN="$(xclip -o)"          # with xclip

Note: the previous commands are intentionally prefixed with a space to prevent them from appearing in your history. This can be enabled in your shell with export HISTCONTROL=ignoreboth.

wasm-to-oci uses docker's login system to access registries. Run the following command to log in to Bundle Bar using docker:

echo "$BB_TOKEN" | docker login bundle.bar -u $BB_USER --password-stdin

Pushing

# 1. Add the wasm build target to your rust installation
rustup target add wasm32-wasi

# 2. Create a new rust project
cargo new welcome && cd welcome

# 3. write your sorce in rust
cat > src/main.rs <<EOF
fn main() {
    println!("hello, world!");
}
EOF

# 4. compile to wasm
cargo build --target wasm32-wasi --release

# 5. optionally, verify your module works
wasmtime target/wasm32-wasi/release/welcome.wasm

# 6. push your module
wasm-to-oci push target/wasm32-wasi/release/welcome.wasm bundle.bar/u/$BB_USER/wasm/welcome:v1

Pulling

# 1. Pull the artifact
wasm-to-oci pull bundle.bar/u/$BB_USER/wasm/welcome:v1

# 2. Check it out
wasmtime ./welcome.wasm

Installation

Official docs

Please see https://github.com/engineerd/wasm-to-oci.

Bundle Bar CDN

Bundle Bar provides a secure mirror of the latest version of wasm-to-oci on the following platforms:

  • Mac x86-64
  • Linux x86-64

Release artifacts were downloaded from here and should have identical checksums.

Mac x86-64

Latest version
VersionFilenameSHA-256 checksum
0.1.1darwin-amd64-wasm-to-oci3a612230dc9f4dafbf6fadbe0f871ad60c3d5d74f687c35acb388701814214a3
Install instructions
WASM_TO_OCI_VERSION="0.1.1"
WASM_TO_OCI_FILENAME="darwin-amd64-wasm-to-oci"
WASM_TO_OCI_CHECKSUM="3a612230dc9f4dafbf6fadbe0f871ad60c3d5d74f687c35acb388701814214a3"

# 1. Download the release artifact
curl -LO "https://cdn.bundle.bar/clients/wasm-to-oci/${WASM_TO_OCI_VERSION}/${WASM_TO_OCI_FILENAME}"

# 2. Verify the checksum
shasum -a 256 "${WASM_TO_OCI_FILENAME}" | grep "^${WASM_TO_OCI_CHECKSUM} "

# 3. Make executable
chmod +x "${WASM_TO_OCI_FILENAME}"

# 4. Move binary into PATH
mv "${WASM_TO_OCI_FILENAME}" /usr/local/bin/wasm-to-oci

# 5. Verify install
wasm-to-oci help
Optional: Validate signatures

For additional security, the release artifact has been signed using Bundle Bar's GPG key. Prior to installing to PATH (steps 3 & 4 above), run the following commands to import our public key and validate the signature:

# 1. Import our public key (Fingerprint: 0E7F990287D5F5F7C1FCD2F165639A2346DC9F5D)
curl -sL "https://cdn.bundle.bar/keys/bundlebar-2020-08-18.pub" | gpg --import

# 2. Download the signature file
curl -LO "https://cdn.bundle.bar/clients/wasm-to-oci/${WASM_TO_OCI_VERSION}/${WASM_TO_OCI_FILENAME}.asc"

# 3. Validate the signature
[[ $(gpg --verify --status-fd=1 "${WASM_TO_OCI_FILENAME}.asc" | \
    grep -c -E '^\[GNUPG:\] (GOODSIG|VALIDSIG)') -ge 2 ]] || \
    (echo "ERROR: Failed to verify signature" && exit 1)

Linux x86-64

Latest version
VersionFilenameSHA-256 checksum
0.1.1linux-amd64-wasm-to-oci54eb3091554cd79a9c7db355e509ac37a1b75e9b743adc2c7f8563ef14606d3f
Install instructions
WASM_TO_OCI_VERSION="0.1.1"
WASM_TO_OCI_FILENAME="linux-amd64-wasm-to-oci"
WASM_TO_OCI_CHECKSUM="54eb3091554cd79a9c7db355e509ac37a1b75e9b743adc2c7f8563ef14606d3f"

# 1. Download the release artifact
curl -LO "https://cdn.bundle.bar/clients/wasm-to-oci/${WASM_TO_OCI_VERSION}/${WASM_TO_OCI_FILENAME}"

# 2. Verify the checksum
shasum -a 256 "${WASM_TO_OCI_FILENAME}" | grep "^${WASM_TO_OCI_CHECKSUM} "

# 3. Make executable
chmod +x "${WASM_TO_OCI_FILENAME}"

# 4. Move binary into PATH
mv "${WASM_TO_OCI_FILENAME}" /usr/local/bin/wasm-to-oci

# 5. Verify install
wasm-to-oci help
Optional: Validate signatures

For additional security, the release artifact has been signed using Bundle Bar's GPG key. Prior to installing to PATH (steps 3 & 4 above), run the following commands to import our public key and validate the signature:

# 1. Import our public key (Fingerprint: 0E7F990287D5F5F7C1FCD2F165639A2346DC9F5D)
curl -sL "https://cdn.bundle.bar/keys/bundlebar-2020-08-18.pub" | gpg --import

# 2. Download the signature file
curl -LO "https://cdn.bundle.bar/clients/wasm-to-oci/${WASM_TO_OCI_VERSION}/${WASM_TO_OCI_FILENAME}.asc"

# 3. Validate the signature
[[ $(gpg --verify --status-fd=1 "${WASM_TO_OCI_FILENAME}.asc" | \
    grep -c -E '^\[GNUPG:\] (GOODSIG|VALIDSIG)') -ge 2 ]] || \
    (echo "ERROR: Failed to verify signature" && exit 1)