WASM Build Fails in Nix Environment

[nobucc]

Summary

When building the ring crate for WASM in a Nix environment, the resulting WASM binary does not function correctly.

Steps to Reproduce

git clone https://github.com/nobucc/ring-wasm-experiment.git
cd ring-wasm-experiment

# enable the Nix environment (you can toggle with `direnv allow` and `direnv disallow`)
direnv allow

# build and run
cargo build --release --target wasm32-wasip1
wasmtime target/wasm32-wasip1/release/ring-wasm-experiment.wasm

The contents of the ring-wasm-experiment repository are as follows:

expand to view

Cargo.toml

[package]
name = "ring-wasm-experiment"
version = "0.1.0"
edition = "2024"

[dependencies]
hex = "0.4.3"
ring = "0.17.14"

src/main.rs

use ring::digest::{Context, SHA256};

fn main() {
    let data = b"Hello, world!";

    let mut context = Context::new(&SHA256);
    context.update(data);
    let hash = context.finish();

    let hex_hash = hex::encode(hash);
    println!("SHA256 hash: {}", hex_hash);
}

flake.nix

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    rust-overlay.url = "github:oxalica/rust-overlay";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, rust-overlay, flake-utils, ... }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        overlays = [ (import rust-overlay) ];
        pkgs = import nixpkgs { inherit system overlays; };

        rust = pkgs.rust-bin.stable.latest.default.override {
          targets = [ "wasm32-wasip1" ];
        };
      in
      {
        devShells.default = pkgs.mkShell {
          buildInputs = [
            rust
            pkgs.wasmtime
            pkgs.wasm-tools
          ];

          # shellHook = ''
          #   export CC=clang
          # '';
        };
      }
    );
}

Expected Behavior

The binary should run successfully, just as it does when built outside the Nix environment.

Actual Behavior

$ wasmtime target/wasm32-wasip1/release/ring-wasm-experiment.wasm 
Error: failed to run main module `target/wasm32-wasip1/release/ring-wasm-experiment.wasm`

Caused by:
    0: failed to instantiate "target/wasm32-wasip1/release/ring-wasm-experiment.wasm"
    1: unknown import: `env::ring_core_0_17_14__bn_from_montgomery_in_place` has not been defined

$ wasm-tools print target/wasm32-wasip1/release/ring-wasm-experiment.wasm | grep import | grep ring
  (import "env" "ring_core_0_17_14__bn_from_montgomery_in_place" (func $ring_core_0_17_14__bn_from_montgomery_in_place (;0;) (type 8)))
  (import "env" "ring_core_0_17_14__limbs_mul_add_limb" (func $ring_core_0_17_14__limbs_mul_add_limb (;1;) (type 9)))

What I’ve Tried

On a Debian host, uncommenting the shellHook (export CC=clang) in flake.nix and rebuilding results in a valid binary. In other words, using the host’s Clang (rather than the nix-wrapped compiler) allows the compilation to succeed. So I suspected that adding clang-unwrapped to flake.nix might resolve the issue, but that did not work.

I also tried enabling the wasm32_unknown_unknown_js feature of ring, but it had no effect.

Note: The export CC=clang workaround is not a real solution. Depending on tools outside the Nix environment undermines its goal of isolated and reproducible builds, and on NixOS, even the host Clang is nix-wrapped, meaning the build still fails.

[briansmith]

In other words, using the host’s Clang (rather than the nix-wrapped compiler) allows the compilation to succeed.

I agree with this. But, there's not enough information in the bug report to indicate why the nix-wrapped compiler didn't correctly compile the code and/or why the library containing the C code didn't get linked. Much more investigation would be needed. I hope somebody does that and reports back.

I've moved this to the "Building" discussion group.

[ntjohnson1]

I dug into this a little bit because of an downstream issue. On a fresh ubuntu system after following instructions for direnv, nix, and flake support I could reproduce the issue immediately. The environment is using gcc as it's compiler which AFAICT doesn't fully support wasm. In the resulting ring rlib there is a montgomery object file that is an x86 elf instead of wasm binary. So everything compiles but it just doesn't link into the final wasm correctly.

If I apply this (probably overly verbose because I hit some issues) diff to the flake.nix file to use clang then everything appears to work. Maybe this is an issue for upstream cc_rs that while none of the tools fails it doesn't actually produce a self contained wasm.

diff --git a/flake.nix b/flake.nix
index fa8d510..01ee0a5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -21,38 +21,8 @@
             rust
             pkgs.wasmtime
             pkgs.wasm-tools
-            pkgs.llvmPackages_18.clang-unwrapped
-            pkgs.llvmPackages_18.llvm
-            pkgs.llvmPackages_18.libclang
-            pkgs.wabt
           ];
 
-          shellHook = ''
-            export CC=${pkgs.llvmPackages_18.clang-unwrapped}/bin/clang
-            export CXX=${pkgs.llvmPackages_18.clang-unwrapped}/bin/clang++
-            export AR=${pkgs.llvmPackages_18.llvm}/bin/llvm-ar
-            export CC_wasm32_unknown_unknown=${pkgs.llvmPackages_18.clang-unwrapped}/bin/clang
-
-            # Set up the clang resource directory properly
-            CLANG_MAJOR_VERSION="18"
-            CLANG_RESOURCE_DIR="${pkgs.llvmPackages_18.clang-unwrapped}/lib/clang/$CLANG_MAJOR_VERSION"
-
-            # Use libclang's include directory which has the standard headers
-            LIBCLANG_INCLUDE="${pkgs.llvmPackages_18.libclang.lib}/lib/clang/$CLANG_MAJOR_VERSION/include"
-
-            export CFLAGS_wasm32_wasip1="-isystem $LIBCLANG_INCLUDE -resource-dir $CLANG_RESOURCE_DIR"
-            export CPPFLAGS="-isystem $LIBCLANG_INCLUDE -resource-dir $CLANG_RESOURCE_DIR"
-
-            # Debug: Print the paths to verify they exist
-            echo "Clang resource dir: $CLANG_RESOURCE_DIR"
-            echo "Libclang include dir: $LIBCLANG_INCLUDE"
-            if [ -f "$LIBCLANG_INCLUDE/stddef.h" ]; then
-              echo "Found stddef.h at: $LIBCLANG_INCLUDE/stddef.h"
-            else
-              echo "stddef.h not found in $LIBCLANG_INCLUDE"
-            fi
-          '';
-
           # shellHook = ''
           #   export CC=clang
           # '';