fix: add local execution requirement to wasmsign2 for SSH key access

avrabe · avrabe · commit 8894c7808560 · 2025-08-17T11:53:23.000+02:00
- wasmsign2 signing needs local execution when using SSH keys
- ssh_keygen generates keys with 'local: 1' execution requirement
- wasmsign2 must run locally to access those keys in CI sandbox
- Fixes 'I/O error' in WasmSignForOCI action on macOS CI
diff --git a/wkg/defs.bzl b/wkg/defs.bzl
@@ -999,6 +999,9 @@ def _wasm_component_oci_image_impl(ctx):
             outputs = sign_outputs,
             mnemonic = "WasmSignForOCI",
             progress_message = "Signing component for OCI image {}".format(ctx.label),
+            execution_requirements = {
+                "local": "1",  # SSH keys generated locally need local signing access
+            },
         )
 
         # Create signature info

Original file line number	Diff line number	Diff line change
`@@ -999,6 +999,9 @@ def _wasm_component_oci_image_impl(ctx):`
`999`	`999`	`outputs = sign_outputs,`
`1000`	`1000`	`mnemonic = "WasmSignForOCI",`
`1001`	`1001`	`progress_message = "Signing component for OCI image {}".format(ctx.label),`
	`1002`	`+ execution_requirements = {`
	`1003`	`+ "local": "1", # SSH keys generated locally need local signing access`
	`1004`	`+ },`
`1002`	`1005`	`)`
`1003`	`1006`
`1004`	`1007`	`# Create signature info`