security-audit-v3 #15. download_file already had a verify branch; no caller
used it and every *_SHA256 in versions.sh was a commented placeholder, so a
tampered mirror tarball flowed straight into configure/make and the shipped
WASM.
- versions.sh: 13 pins (cross-checked against Homebrew/Buildroot/nixpkgs/
FreeBSD/vcpkg/boost.org/curl PGP; glm .zip is TOFU), boost/curl/libgit2
versions moved beside their pins.
- all 13 download_file call sites pass "${NAME_SHA256}".
- download_file refuses an empty or malformed pin (PCBJAM_ALLOW_UNPINNED=1
to bootstrap a new dep); file_sha256 prefers sha256sum, falls back to shasum.
- scripts/deps/check-pins.sh: static 3-arg check + offline file:// enforcement
test; runs in wasm-build.yml before the deps cache, on cache hits too.
Expect one cold --build-deps run: the deps-cache key hashes versions.sh.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GcsgJZ77bhZatLAVU8R84H
Three orchestration fixes, validated end-to-end on the Hetzner ccx53
(run 27280051992, 1h14m41s vs 4h05m baseline, e2e identical):
- docker-compose CPU/memory caps were hardcoded to dev-Mac defaults
(10 CPUs / 32G); now env-tunable via KICAD_DOCKER_CPUS/KICAD_DOCKER_MEM
(CI exports nproc/110G — the 32-core runner was compiling on 10 cores).
- docker/build.sh: split build_app into compile_app (container) +
postprocess_app (host-side dyncall shims + finalize + asyncify + -O2)
and added KICAD_PIPELINE=1 mode that overlaps each tool's host-side
wasm-opt with the next tool's container compile (max 2 concurrent
postprocesses — pcbnew -O2 peaks ~34G RSS). Also: comma-separated app
lists for cheap pipeline repros.
- get-wasm-opt.sh: Binaryen default 121 -> 130 (fixes the v121 -O2 lock
convoy, ~9x) and BINARYEN_BUILD_FROM_SOURCE=1 support: the official
x86_64-linux release tarballs (Alpine/musl, no LTO, assertions on) run
asyncify 4x slower than a stock gcc -O3+LTO build with sha256-identical
output; self-build takes ~5 min and is instantly repaid.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Emscripten 4.x removed dynCall_* WASM exports, breaking asyncify
rewind through indirect calls (modal dialogs, event handlers).
Generate JS shims that track Asyncify.exportCallStack and register
in wasmExports so doRewind can find them.
Also fixes empty callback functions ((() => {})) generated by
Emscripten 4.x + pthreads for HTML5 events, pthread entry,
sighandler, async timer, and main loop callbacks.
Build pipeline improvements:
- Stub wasm-opt/finalize in Docker (RAM limits), run on host
- Add setup-emsdk.sh for reproducible Emscripten setup
- Simplify env.sh and version management
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add source hashing to stamp system (functions.sh) for detecting
when dependencies need rebuild based on source file changes
- Update build-pcbnew.sh to use source stamps for wxWidgets
- Add global-setup.ts to clean logs before test runs
- Add maximize_test standalone test to verify wxFrame::Maximize()
works correctly in WASM (it does - window is 1280x720)
- Update Makefile.wasm with maximize test build rules
The maximize_test proves wxWidgets display detection works fine.
KiCad's 20x20 window bug is KiCad-specific, not a wxWidgets issue.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add build.md documentation for the WASM build system
- Default to debug builds with -gsource-map for WASM debugging
- Add --release flag to disable debug symbols
- Add --clean flag for full rebuild (deps + wxWidgets + KiCad)
- Add -j N flag for parallel compilation (default: 1 for sequential)
- Update Docker memory limit to 32GB
- Propagate DEBUG_BUILD and JOBS to all dependency scripts
Build modes:
- ./docker/build.sh --clean -j8 (full rebuild, parallel)
- ./docker/build.sh (rebuild KiCad only)
- ./docker/build.sh --no-clean (incremental)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
