fix: correct bindgen filename extraction and re-enable wasmsign2

Two critical fixes:

1. Fixed wit_bindgen extraction to use correct filenames:
   - Separate wit-bindgen's output filename from Bazel's declared filename
   - wit-bindgen generates: basic_component.rs (no suffix)
   - Bazel declares: basic_component_native_guest.rs (with suffix)
   - Extract from wit-bindgen output filename, rename to Bazel filename
   - Resolves: file_ops extraction failures for native-guest bindings

2. Re-enabled wasmsign2 using pulseengine/wsc repository:
   - New location: https://github.com/pulseengine/wsc
   - Release: v0.2.7-rc.1 with wsc-cli.wasm
   - SHA256: cb3125ce35704fed117bee95d56ab34576c6c1c8b940234aba5dc9893c224fa7
   - Re-enabled wasmsign2_wrapper go_binary
   - Re-enabled wasm_signing examples in CI builds

This should resolve all remaining build failures.

Author: avrabe

.github/workflows/ci.yml

@@ -153,6 +153,7 @@ jobs:
             //examples/js_component:simple_js_component \
             //examples/js_component:hello_js_component \
             //examples/js_component:calc_js_component \
+            //examples/wasm_signing/... \
             //rust/... \
             //go/... \
             //cpp/... \
@@ -167,7 +168,6 @@ jobs:
             //test/integration/... \
             //docs-site/... \
             -//examples/go_component:calculator_simple \
-            -//examples/wasm_signing/... \
 
       - name: Run Tests
         run: bazel test --test_output=errors -- //test/integration:basic_component_build_test //test/integration:basic_component_validation //test/unit:unit_tests //test/wkg/unit:smoke //test/js:test_hello_js_component_provides_info //test/js:test_calc_js_component_provides_info //test/js:test_npm_dependencies_installation
@@ -248,6 +248,7 @@ jobs:
             //examples/js_component:simple_js_component \
             //examples/js_component:hello_js_component \
             //examples/js_component:calc_js_component \
+            //examples/wasm_signing/... \
             //rust/... \
             //go/... \
             //cpp/... \
@@ -267,7 +268,6 @@ jobs:
             //docs-site/... \
             -//examples/cpp_component/multi_component_system:analytics_service \
             -//examples/go_component:calculator_component \
-            -//examples/wasm_signing/... \
             -//examples/go_component:calculator_component_debug \
             -//examples/go_component:calculator_simple \
             -//examples/go_component:calculator_simple_binding \

MODULE.bazel

@@ -203,15 +203,13 @@ http_file(
     url = "https://github.com/pulseengine/bazel-file-ops-component/releases/download/v0.1.0-rc.3/file_ops_component.wasm",
 )
 
-# wasmsign2 CLI WASM binary for component signing
-# Commented out temporarily: release v0.2.7-rc.2 not available
-# TODO: Update to use official wasm-signatures/wasmsign2 when WASM binary is published
-# http_file(
-#     name = "wasmsign2_cli_wasm",
-#     downloaded_file_path = "wasmsign2.wasm",
-#     sha256 = "0a2ba6a55621d83980daa7f38e3770ba6b9342736971a0cebf613df08377cd34",
-#     url = "https://github.com/pulseengine/wasmsign2/releases/download/v0.2.7-rc.2/wasmsign2-cli.wasm",
-# )
+# wasmsign2 CLI WASM binary for component signing (from pulseengine/wsc)
+http_file(
+    name = "wasmsign2_cli_wasm",
+    downloaded_file_path = "wasmsign2.wasm",
+    sha256 = "cb3125ce35704fed117bee95d56ab34576c6c1c8b940234aba5dc9893c224fa7",
+    url = "https://github.com/pulseengine/wsc/releases/download/v0.2.7-rc.1/wsc-cli.wasm",
+)
 
 # WASM Tools Component toolchain for universal wasm-tools operations
 register_toolchains("//toolchains:wasm_tools_component_toolchain_local")

tools/wasmsign2_wrapper/BUILD.bazel

@@ -3,50 +3,28 @@
 This wrapper executes the pre-built wasmsign2.wasm component via wasmtime,
 resolving symlinks to real paths to work with both Bazel's sandbox and
 WASI's security model.
-
-TEMPORARILY DISABLED: wasmsign2 binary not available
-TODO: Re-enable when wasmsign2 WASM binary is published
 """
 
 load("@rules_go//go:def.bzl", "go_binary")
 
 package(default_visibility = ["//visibility:public"])
 
-# Temporarily commented out - wasmsign2 binary not available
-# # Wrapper binary that executes wasmsign2.wasm with path resolution
-# go_binary(
-#     name = "wasmsign2_wrapper",
-#     srcs = ["main.go"],
-#     data = [
-#         "@wasmsign2_cli_wasm//file",
-#         "@wasmtime_toolchain//:wasmtime",
-#     ],
-#     pure = "on",  # Pure Go for cross-platform compatibility
-#     visibility = ["//visibility:public"],
-#     deps = ["@rules_go//go/runfiles"],
-# )
-#
-# # Export for easy access in toolchains
-# alias(
-#     name = "wasmsign2",
-#     actual = ":wasmsign2_wrapper",
-#     visibility = ["//visibility:public"],
-# )
-
-# Stub target to prevent build failures while wasmsign2 is unavailable
-# This will fail at runtime if actually used, but allows builds to complete
-genrule(
+# Wrapper binary that executes wasmsign2.wasm with path resolution
+go_binary(
     name = "wasmsign2_wrapper",
-    outs = ["wasmsign2_stub.sh"],
-    cmd = """
-cat > $@ << 'EOF'
-#!/bin/sh
-echo "ERROR: wasmsign2 is temporarily unavailable" >&2
-echo "The wasmsign2 binary could not be downloaded from upstream" >&2
-exit 1
-EOF
-chmod +x $@
-    """,
-    executable = True,
+    srcs = ["main.go"],
+    data = [
+        "@wasmsign2_cli_wasm//file",
+        "@wasmtime_toolchain//:wasmtime",
+    ],
+    pure = "on",  # Pure Go for cross-platform compatibility
+    visibility = ["//visibility:public"],
+    deps = ["@rules_go//go/runfiles"],
+)
+
+# Export for easy access in toolchains
+alias(
+    name = "wasmsign2",
+    actual = ":wasmsign2_wrapper",
     visibility = ["//visibility:public"],
 )

wit/wit_bindgen.bzl

@@ -51,7 +51,10 @@ def _wit_bindgen_impl(ctx):
             # Fallback to target name if world_name not provided
             base_filename = ctx.label.name.replace("_wit_bindgen_guest", "").replace("_wit_bindgen_native_guest", "")
 
-        # Include generation_mode in filename to avoid conflicts between guest and native-guest
+        # wit-bindgen generates files without any suffix
+        wit_bindgen_output_filename = base_filename + ".rs"
+
+        # Include generation_mode in Bazel output filename to avoid conflicts between guest and native-guest
         mode_suffix = "_" + ctx.attr.generation_mode.replace("-", "_") if ctx.attr.generation_mode != "guest" else ""
         rust_filename = base_filename + mode_suffix + ".rs"
         out_file = ctx.actions.declare_file(rust_filename)
@@ -179,9 +182,9 @@ def _wit_bindgen_impl(ctx):
 
             # Extract the generated .rs file from output directory
             # wit-bindgen creates a predictable filename: world_name.to_snake_case() + ".rs"
-            # Since world is now mandatory, we always know the exact filename
+            # Use the filename that wit-bindgen actually generates (without our Bazel suffix)
             # Use file_ops component for cross-platform file copying
-            source_path = out_dir.path + "/" + rust_filename
+            source_path = out_dir.path + "/" + wit_bindgen_output_filename
 
             # Build JSON config for file_ops
             config_file = ctx.actions.declare_file(ctx.label.name + "_extract_config.json")
@@ -208,7 +211,7 @@ def _wit_bindgen_impl(ctx):
                 inputs = [out_dir, config_file],
                 outputs = [out_file],
                 mnemonic = "ExtractRustBinding",
-                progress_message = "Extracting {} from wit-bindgen output".format(rust_filename),
+                progress_message = "Extracting {} from wit-bindgen output".format(wit_bindgen_output_filename),
             )
         else:
             # No dependencies - run wit-bindgen directly on WIT files