fix: resolve CI failures for cross-compilation and dependency issues

## Summary
- Fixed typos for spell check and lifetime elision warning for doc tests
- Updated ring 0.17.13 → 0.17.14 to fix VAES assembly build errors
- Switched to cargo-binstall for cross 0.2.5 installation (rustc 1.85.0 compatible)
- Used custom BASE_IMAGE arg in Cross.toml to use cross-rs :main Docker images (Ubuntu 20.04+) instead of :0.2.5 (Ubuntu 16.04), fixing protoc proto3 support, libclang version, and missing headers
- Pinned mdbook to 0.4.52 for rustc 1.85.0 compatibility

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: Mossaka

.github/workflows/docs.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions-rust-lang/setup-rust-toolchain@v1
       - name: install mermaid preprocessor
-        run: cargo install mdbook mdbook-mermaid
+        run: cargo install mdbook --version 0.4.52 && cargo install mdbook-mermaid --version 0.16.0
       - name: Build mdbook
         working-directory: ./docs
         run: mdbook build

Cargo.lock

@@ -1,14 +1,18 @@
 [build]
 default-target = "x86_64-unknown-linux-musl"
 
-[target.aarch64-unknown-linux-musl]
-dockerfile = "cross/Dockerfile.musl"
+[target.aarch64-unknown-linux-musl.dockerfile]
+file = "cross/Dockerfile.musl"
+build-args = { BASE_IMAGE = "ghcr.io/cross-rs/aarch64-unknown-linux-musl:main", CROSS_CMAKE_SYSTEM_PROCESSOR = "aarch64", CROSS_SYSROOT = "/usr/local/aarch64-linux-musl" }
 
-[target.x86_64-unknown-linux-musl]
-dockerfile = "cross/Dockerfile.musl"
+[target.x86_64-unknown-linux-musl.dockerfile]
+file = "cross/Dockerfile.musl"
+build-args = { BASE_IMAGE = "ghcr.io/cross-rs/x86_64-unknown-linux-musl:main", CROSS_CMAKE_SYSTEM_PROCESSOR = "x86_64", CROSS_SYSROOT = "/usr/local/x86_64-linux-musl" }
 
-[target.aarch64-unknown-linux-gnu]
-dockerfile = "cross/Dockerfile.gnu"
+[target.aarch64-unknown-linux-gnu.dockerfile]
+file = "cross/Dockerfile.gnu"
+build-args = { BASE_IMAGE = "ghcr.io/cross-rs/aarch64-unknown-linux-gnu:main" }
 
-[target.x86_64-unknown-linux-gnu]
-dockerfile = "cross/Dockerfile.gnu"
+[target.x86_64-unknown-linux-gnu.dockerfile]
+file = "cross/Dockerfile.gnu"
+build-args = { BASE_IMAGE = "ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main" }

Cross.toml

@@ -31,7 +31,7 @@ pub trait RuntimeContext: Send + Sync {
     ///   "/app/app.wasm#entry" -> { source: File("/app/app.wasm"), func: "entry", name: "Some(app)", arg0: "/app/app.wasm#entry" }
     ///   "my_module.wat" -> { source: File("my_module.wat"), func: "_start", name: "Some(my_module)", arg0: "my_module.wat" }
     ///   "#init" -> { source: File(""), func: "init", name: None, arg0: "#init" }
-    fn entrypoint(&self) -> Entrypoint;
+    fn entrypoint(&self) -> Entrypoint<'_>;
 }
 
 /// The source for a WASI module / components.
@@ -111,7 +111,7 @@ impl RuntimeContext for WasiContext<'_> {
             .unwrap_or_default()
     }
 
-    fn entrypoint(&self) -> Entrypoint {
+    fn entrypoint(&self) -> Entrypoint<'_> {
         let arg0 = self.args().first();
 
         let entry_point = arg0.map(String::as_str).unwrap_or("");

crates/containerd-shim-wasm/src/sandbox/context.rs

@@ -27,7 +27,7 @@ upon receiving a terminate or interrupt signal in the container.
 
 This can be very useful on the Wasm-first platforms to allow instance-per-request isolation:
 
-> Eeach Wasm instance serves only one HTTP request, and then goes away. This is fantastic for security and bug
+> Each Wasm instance serves only one HTTP request, and then goes away. This is fantastic for security and bug
 > mitigation: the blast radius of an exploit or guest-runtime bug is only a single request, and can never see the data
 > from other users of the platform or even other requests by the same user. [3]
 

crates/containerd-shim-wasmtime/README.md

@@ -1,8 +1,8 @@
-ARG CROSS_BASE_IMAGE
+ARG BASE_IMAGE
 ARG CROSS_DEB_ARCH
-FROM $CROSS_BASE_IMAGE
+FROM ${BASE_IMAGE}
 
 ARG CROSS_DEB_ARCH
 RUN dpkg --add-architecture ${CROSS_DEB_ARCH} && \
     apt-get -y update && \
-    apt-get install -y pkg-config protobuf-compiler libseccomp-dev:${CROSS_DEB_ARCH} libzstd-dev:${CROSS_DEB_ARCH} libssl-dev
+    apt-get install -y pkg-config protobuf-compiler libseccomp-dev:${CROSS_DEB_ARCH} libzstd-dev:${CROSS_DEB_ARCH} libssl-dev libclang-dev

cross/Dockerfile.gnu

@@ -1,5 +1,8 @@
-ARG CROSS_BASE_IMAGE
-FROM $CROSS_BASE_IMAGE
+ARG BASE_IMAGE
+FROM ${BASE_IMAGE}
+
+ARG CROSS_CMAKE_SYSTEM_PROCESSOR
+ARG CROSS_SYSROOT
 
 COPY --from=jorgeprendes420/apk-anywhere / /
 ENV MARCH=${CROSS_CMAKE_SYSTEM_PROCESSOR}
@@ -25,4 +28,4 @@ rustflags = ["-Clink-arg=-lgcc"]
 EOF
 
 RUN apt-get -y update && \
-    apt-get install -y pkg-config protobuf-compiler
+    apt-get install -y pkg-config protobuf-compiler libclang-dev

cross/Dockerfile.musl

@@ -85,6 +85,6 @@ We use [benchmark-action](https://github.com/benchmark-action/github-action-benc
 
 If you want to contribute to the benchmarks, whether it's adding a new benchmark or improving the existing ones, or just want to share your ideas, please refer to the following issue:
 
-- [Bencharking issue #97](https://github.com/containerd/runwasi/issues/97)
+- [Benchmarking issue #97](https://github.com/containerd/runwasi/issues/97)
 
 Any PRs are welcome!

docs/src/benchmarks.md

@@ -1,5 +1,17 @@
 #!/bin/bash
-cargo install cross --git https://github.com/cross-rs/cross
+# Use cargo-binstall to install cross from pre-built binaries
+# This avoids the dependency resolution issue where cargo install
+# resolves dependencies to latest versions that require rustc 1.88+
+
+# Install cargo-binstall if not already installed
+if ! command -v cargo-binstall &> /dev/null; then
+    curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+fi
+
+# Install cross using cargo-binstall (downloads pre-built binary)
+# Use --force to ensure the binary is actually present even if metadata
+# says it's already installed (the Rust cache may have cleaned the binary)
+cargo binstall cross --version 0.2.5 --no-confirm --force
 
 if [ ! -z "$CI" ]; then