Releasing the wasm guests (Heimdall is a defensive sandbox)
The static-scan guest goes out with the crates, in the same dwarves release-build run and the same YubiKey-signed SLSA statement. Its two files become subjects next to the .crate files.
Add to the release spec (~/slsa-runs/specs/heimdall-<version>.spec.toml):
lock = ["heimdall/Cargo.toml", "heimdall/guests/static-scan/Cargo.toml"]
[[workspace_example]]
manifest = "heimdall/guests/static-scan/Cargo.toml"
example = "dist"
args = ["{out}/guests", "/target/guests"]
outputs = [
"guests/heimdall-static-scan.wasm",
"guests/heimdall-static-scan.wasm.blake3",
]The guest takes nordisk-heimdall-scan from crates.io (pinned =0.3.0; a path dependency outside the guest's workspace is hashed by its absolute path, which made the module differ per checkout). When crates/heimdall-scan changes, publish it first and raise the pin: tests/release_dist.rs fails while the two differ.
The image needs the wasm32-unknown-unknown target (the CI image nordisk-cargo-toolchain:ci4-* has it). The verify-bundle guest's block (the heimdall-guests-0.2.1 spec) can be added the same way; it also needs clang and wasi-libc headers in the image.
After the owner signs, check what was shipped:
scripts/guest-release-verify.sh <run>/release.intoto.jsonl release-signing-key.pub <run>/out --release heimdall-<version>dwarves release-build verify --bundle <run>/release.intoto.jsonl --key <key> --artifact <file> checks the same signature and digests from the dwarves side.