firefox/wasi-sdk: upgrade wasi-sdk 21->29

OldManYellsAtCloud · OldManYellsAtCloud · commit eb049792fef8 · 2025-11-27T16:40:25.000+01:00
This update is an optional build-time requirement for Firefox 144+ to be
able to build some sandboxed libraries.

Since the build system was overhauled by upstream, the original recipe
was split into two also: one recipe builds the toolchain (which is essentially
a WebAssembly-only clang), and the second recipe populates the actual sysroot.

Though they use the same main CMakeLists.txt file, the environment is quite
different for the two steps, hence the split.

One notable change is that building this recipe requires at least Clang 18,
which is a bump from the previous Clang 14. Though Kirkstone can still build
it, it requires switching to a new meta-clang branch.

Signed-off-by: Gyorgy Sarvari &lt;skandigraun@gmail.com&gt;
diff --git a/meta-firefox/README.md b/meta-firefox/README.md
@@ -55,13 +55,13 @@ the kas folder - that contains all the branch/revision information used for test
 install it, in case it is missing  (e.g. on Debian based systems install `libstdc++-dev` or
 on Fedora install `libstdc++-devel`)
 
-By default `disable-sandboxed-libraries` PACKAGECONFIG is *disabled*. This makes the build
-somewhat more secure, but it also brings in the wasi-sdk as a build-time dependency, which
-does increase the build time. Testing is performed using this dependency, but if you
-enable this knob, it can cut off the build time of dependencies quite a bit (for the
-price of some security, which you need to decide if it's acceptable for you).
+By default `disable-sandboxed-libraries` PACKAGECONFIG is *disabled*. Which means that wasi-sdk
+is a build dependency. Starting Firefox 145, wasi-sdk requires at least Clang 18 to be built:
+make sure to use kirkstone-clang18 branch of meta-clang. Without wasi-sdk (when `disable-sanboxed-libraries`
+PACKAGECONFIG is enabled), Firefox should still build with Clang 14. With ther branches
+this restriction is meaningless, since they all use at least Clang 18.
 
-Note: Firefox at least Rust 1.82 from version 137. 
+Firefox requires at least Rust 1.82 from version 137. 
 
 When using meta-rust, make sure to add the following to a bbappend or local.conf:
 
diff --git a/meta-firefox/conf/post-whinlatter-s-config.inc b/meta-firefox/conf/post-whinlatter-s-config.inc
@@ -11,4 +11,7 @@ CORRECT_S = '${@bb.utils.contains_any("LAYERSERIES_CORENAMES", "whinlatter", d.g
 
 S:pn-cbindgen = "${CORRECT_S}"
 S:pn-cbindgen-native = "${CORRECT_S}"
-S:pn-wasi-sdk-native = "${CORRECT_S}"
+S:pn-wasi-sdk-sysroot-native = "${CORRECT_S}"
+S:pn-wasi-sdk-toolchain-native = "${CORRECT_S}"
+S:pn-wasm-component-ld = "${CORRECT_S}"
+S:pn-wasm-component-ld-native = "${CORRECT_S}"
diff --git a/meta-firefox/recipes-browser/firefox/firefox.inc b/meta-firefox/recipes-browser/firefox/firefox.inc
@@ -130,7 +130,7 @@ PACKAGECONFIG[system-pipewire] = "--with-system-pipewire,,pipewire,pipewire"
 PACKAGECONFIG[system-gbm] = "--with-system-gbm,,virtual/libgbm,libgbm"
 PACKAGECONFIG[system-libdrm] = "--with-system-libdrm,,libdrm,libdrm"
 
-DEPENDS:append = '${@bb.utils.contains("PACKAGECONFIG", "disable-sandboxed-libraries", "", " wasi-sdk-native ", d)}'
+DEPENDS:append = '${@bb.utils.contains("PACKAGECONFIG", "disable-sandboxed-libraries", "", " wasi-sdk-sysroot-native ", d)}'
 
 LDFLAGS:append = "${@bb.utils.contains('PACKAGECONFIG', 'system-av1', ' -Wl,--undefined-version ', '', d)}"
 
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/files/0001-allow-compiling-with-cmake-4.patch b/meta-firefox/recipes-devtools/wasi-sdk/files/0001-allow-compiling-with-cmake-4.patch
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/files/0001-disable-exceptions-and-bulk-memory.patch b/meta-firefox/recipes-devtools/wasi-sdk/files/0001-disable-exceptions-and-bulk-memory.patch
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/files/0001-don-t-build-wasm-component-ld.patch b/meta-firefox/recipes-devtools/wasi-sdk/files/0001-don-t-build-wasm-component-ld.patch
@@ -0,0 +1,45 @@
+From 1fdbaaa58d6b816f4280db5de418112b9ff50c48 Mon Sep 17 00:00:00 2001
+From: Gyorgy Sarvari <skandigraun@gmail.com>
+Date: Wed, 26 Nov 2025 13:15:30 +0100
+Subject: [PATCH] don't build wasm-component-ld
+
+wasm-component-ld is fetched from the internet. For OE, it is built
+with a separate recipe, no need to build it here also.
+
+Upstream-Status: Inappropriate [oe-specific]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ cmake/wasi-sdk-toolchain.cmake | 20 --------------------
+ 1 file changed, 20 deletions(-)
+
+diff --git a/cmake/wasi-sdk-toolchain.cmake b/cmake/wasi-sdk-toolchain.cmake
+index 61481e3..f68d288 100644
+--- a/cmake/wasi-sdk-toolchain.cmake
++++ b/cmake/wasi-sdk-toolchain.cmake
+@@ -116,26 +116,6 @@ install(DIRECTORY ${wasi_tmp_install}/bin ${wasi_tmp_install}/lib ${wasi_tmp_ins
+         USE_SOURCE_PERMISSIONS
+         DESTINATION ${CMAKE_INSTALL_PREFIX})
+ 
+-# Build logic for `wasm-component-ld` installed from Rust code.
+-set(wasm_component_ld_root ${CMAKE_CURRENT_BINARY_DIR}/wasm-component-ld)
+-set(wasm_component_ld ${wasm_component_ld_root}/bin/wasm-component-ld${CMAKE_EXECUTABLE_SUFFIX})
+-set(wasm_component_ld_version 0.5.19)
+-if(RUST_TARGET)
+-  set(rust_target_flag --target=${RUST_TARGET})
+-endif()
+-add_custom_command(
+-  OUTPUT ${wasm_component_ld}
+-  COMMAND
+-    cargo install --root ${wasm_component_ld_root} ${rust_target_flag}
+-      wasm-component-ld@${wasm_component_ld_version}
+-  COMMAND
+-    cmake -E make_directory ${wasi_tmp_install}/bin
+-  COMMAND
+-    cmake -E copy ${wasm_component_ld} ${wasi_tmp_install}/bin
+-  COMMENT "Building `wasm-component-ld` ...")
+-add_custom_target(wasm-component-ld DEPENDS ${wasm_component_ld})
+-add_dependencies(build wasm-component-ld)
+-
+ # Setup installation logic for CMake support files.
+ add_custom_target(misc-files)
+ add_dependencies(build misc-files)
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/files/0001-don-t-strip-symbols-from-binaries.patch b/meta-firefox/recipes-devtools/wasi-sdk/files/0001-don-t-strip-symbols-from-binaries.patch
@@ -0,0 +1,31 @@
+From a4ef37515d280b0000de3f3b9a16a58aec91ab95 Mon Sep 17 00:00:00 2001
+From: Gyorgy Sarvari <skandigraun@gmail.com>
+Date: Wed, 26 Nov 2025 16:04:11 +0100
+Subject: [PATCH] don't strip symbols from binaries
+
+By default the project is trying to shrink their footprint by
+stripping the debug symbols from the binaries, which however
+makes the relevant QA check complain.
+
+This patch removes the stripping.
+
+Upstream-Status: Inappropriate [oe-specific]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ cmake/wasi-sdk-toolchain.cmake | 23 -----------------------
+ 1 file changed, 23 deletions(-)
+
+diff --git a/cmake/wasi-sdk-toolchain.cmake b/cmake/wasi-sdk-toolchain.cmake
+index 61481e3..5f04af4 100644
+--- a/cmake/wasi-sdk-toolchain.cmake
++++ b/cmake/wasi-sdk-toolchain.cmake
+@@ -90,9 +90,6 @@ ExternalProject_Add(llvm-build
+     -DLLVM_DEFAULT_TARGET_TRIPLE=wasm32-wasi
+     -DLLVM_INSTALL_BINUTILS_SYMLINKS=TRUE
+     -DLLVM_ENABLE_LIBXML2=OFF
+-    # Pass `-s` to strip symbols by default and shrink the size of the
+-    # distribution
+-    -DCMAKE_EXE_LINKER_FLAGS=-s
+     ${llvm_cmake_flags_list}
+   # See https://www.scivision.dev/cmake-externalproject-list-arguments/ for
+   # why this is in `CMAKE_CACHE_ARGS` instead of above
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/files/0001-lower-cmake-requirement.patch b/meta-firefox/recipes-devtools/wasi-sdk/files/0001-lower-cmake-requirement.patch
@@ -0,0 +1,29 @@
+From 6c777445050d715512acd2ac0d419992bc224da7 Mon Sep 17 00:00:00 2001
+From: Gyorgy Sarvari <skandigraun@gmail.com>
+Date: Wed, 26 Nov 2025 13:06:22 +0100
+Subject: [PATCH] lower cmake requirement
+
+Kirkstone has CMake 3.22, but the minimum is specified as 3.26.
+
+Lower it, so it can be built on Kirkstone - the cmake files are
+fairly straightforward and simple, without very arcane options.
+
+Upstream-Status: Inappropriate [oe-specific]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index a0d3fca..22ef298 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -6,7 +6,7 @@
+ # WASI sysroot build requires this previous compiler and must be runnable on
+ # the host.
+ 
+-cmake_minimum_required(VERSION 3.26)
++cmake_minimum_required(VERSION 3.22)
+ list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake")
+ project(wasi-sdk)
+ include(ExternalProject)
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/wasi-sdk-native_git.bb b/meta-firefox/recipes-devtools/wasi-sdk/wasi-sdk-native_git.bb
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/wasi-sdk-sysroot-native_29.bb b/meta-firefox/recipes-devtools/wasi-sdk/wasi-sdk-sysroot-native_29.bb
@@ -0,0 +1,36 @@
+require wasi-sdk.inc
+
+DEPENDS += "wasi-sdk-toolchain-native wasm-component-ld-native"
+RDEPENDS:${PN} = "wasi-sdk-toolchain-native wasm-component-ld-native"
+
+# The first 3 options come from the project's readme, about the compiling
+# intructions. The WASI_SDK_CPU_FLAGS' mcpu argument is the default, from
+# the main CMakeLists.txt file. The DEBUG_PREFIX_MAP is required, otherwise
+# it embeds some host-paths into libcxx, which later leak into the final binaries.
+EXTRA_OECMAKE += " \
+    -DCMAKE_TOOLCHAIN_FILE=${STAGING_DATADIR_NATIVE}/wasi-sysroot/share/cmake/wasi-sdk.cmake \
+    -DCMAKE_C_COMPILER_WORKS=ON \
+    -DCMAKE_CXX_COMPILER_WORKS=ON \
+    -DWASI_SDK_CPU_CFLAGS='-mcpu=lime1 ${DEBUG_PREFIX_MAP}' \
+    "
+
+BUILD_LD = "wasm-ld"
+
+# wasi-sysroot is built for wasi target, not for host/target.
+# The wasi toolchain file for cmake contains wasi-specific
+# attributes. To avoid overshadowing, unset the build-target
+# specific attributes.
+CFLAGS = ""
+CXXFLAGS = ""
+LDFLAGS = ""
+CMAKE_C_LINK_FLAGS = ""
+CMAKE_CXX_LINK_FLAGS = ""
+OECMAKE_C_LINK_FLAGS = ""
+OECMAKE_CXX_LINK_FLAGS = ""
+BUILD_CC = ""
+COMPILER_RT:remove = "-rtlib=libgcc"
+
+do_install:append(){
+    install -d ${D}${datadir}/wasi-sysroot/lib/clang/${WASI_CLANG_VERSION}
+    mv ${D}${prefix}/clang-resource-dir/lib ${D}${datadir}/wasi-sysroot/lib/clang/${WASI_CLANG_VERSION}/
+}
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/wasi-sdk-toolchain-native_29.bb b/meta-firefox/recipes-devtools/wasi-sdk/wasi-sdk-toolchain-native_29.bb
@@ -0,0 +1,12 @@
+require wasi-sdk.inc
+
+# wasi-sdk builds its own sysroot within the oe-sysroot,
+# this is where both the toolchain and the sysroot needs to
+# be installed. sysroot is installed automatically here, but
+# this needs to be specified for the toolchain.
+EXTRA_OECMAKE += "-DWASI_SDK_BUILD_TOOLCHAIN=ON -DCMAKE_INSTALL_PREFIX:PATH=${datadir}/wasi-sysroot"
+
+do_install:append(){
+    ln -s ../../../lib/libedit.so.0 ${D}${datadir}/wasi-sysroot/lib/libedit.so.0
+    ln -s ../../../lib/libtinfo.so.5 ${D}${datadir}/wasi-sysroot/lib/libtinfo.so.5
+}
diff --git a/meta-firefox/recipes-devtools/wasi-sdk/wasi-sdk.inc b/meta-firefox/recipes-devtools/wasi-sdk/wasi-sdk.inc
@@ -0,0 +1,30 @@
+SUMMARY = "WebAssembly SDK"
+HOMEPAGE = "https://github.com/WebAssembly/wasi-sdk"
+DESCRIPTION = "SDK for WebAssembly System Interface (WASI)"
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=a1ba2b4c4f909ac0b517d8a37d2ac70f"
+
+# Note: cross-compilation does not work yet (possibly never will, unless someone does
+# the legwork), these recipes are native only currently.
+
+inherit cmake native
+
+DEPENDS = "clang-native cmake-native ninja-native"
+
+SRC_URI = "gitsm://github.com/WebAssembly/wasi-sdk.git;protocol=https;branch=main \
+           file://0001-lower-cmake-requirement.patch \
+           file://0001-don-t-build-wasm-component-ld.patch \
+           file://0001-don-t-strip-symbols-from-binaries.patch"
+
+SRCREV = "338aec5def0debda9de7e47838c9883e4e0d923f"
+
+TOOLCHAIN = "clang"
+TOOLCHAIN:class-native = "clang"
+
+RUNTIME = "llvm"
+RUNTIME:class-native = "llvm"
+
+FILES:${PN} = "${datadir}/wasi-sysroot/*"
+
+# this needs manual updating
+WASI_CLANG_VERSION = "21"
