fix: revert WASM artifact SHA256 checksums to null by henrypark133 · Pull Request #627 · nearai/ironclaw

henrypark133 · 2026-03-06T19:09:54Z

Summary

Reverts SHA256 checksums added in fe4c3c5 back to null across all 14 registry JSON files
Fixes production breakage where WASM tools (web-search) and channels (telegram) fail with WIT version mismatch: component imports instance 'near:agent/host@0.2.0', but a matching implementation was not found in the linker

Root cause

The baked-in checksums block the runtime install path when the host binary's WIT doesn't match the artifacts at /releases/latest/. Setting sha256 to null unblocks ExtensionManager::install() (which doesn't validate checksums) and allows the next release-plz run to publish matching host + artifact pairs.

Test plan

cargo test registry — 113 passed, 0 failed
After merge: release-plz creates new release → new WASM artifacts compiled against current WIT → /releases/latest/ matches new binary

🤖 Generated with Claude Code

Reverts the checksums added in fe4c3c5. The baked-in checksums cause production failures when the host binary's WIT version doesn't match the artifacts at /releases/latest/ — WASM tools (web-search) and channels (telegram) fail with "matching implementation was not found in the linker". Setting sha256 back to null unblocks the runtime install path (ExtensionManager doesn't validate checksums) and allows the next release-plz run to publish matching host + artifact pairs. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gemini-code-assist · 2026-03-06T19:10:30Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves a critical production issue affecting WASM-based tools and channels. The problem stemmed from mismatched WIT versions between the host binary and deployed artifacts, with baked-in SHA256 checksums blocking the runtime installation path. By temporarily reverting these checksums to null, the system can bypass validation, allowing for a subsequent release to publish compatible host and artifact pairs, thereby restoring functionality.

Highlights

Reverted SHA256 Checksums: Reverted SHA256 checksums to null across 14 registry JSON files, which were previously added in commit fe4c3c5.
Production Fix: Addressed a production breakage where WASM tools (e.g., web-search) and channels (e.g., telegram) failed due to a WebAssembly Interface Type (WIT) version mismatch.

Changelog

registry/channels/discord.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/channels/slack.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/channels/telegram.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/channels/whatsapp.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/github.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/gmail.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/google-calendar.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/google-docs.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/google-drive.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/google-sheets.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/google-slides.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/slack.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/telegram.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.
registry/tools/web-search.json
- Updated the sha256 field for wasm32-wasip2 artifacts from a specific hash value to null.

Activity

No human activity (comments, reviews, etc.) has been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request reverts the SHA256 checksums for all WASM artifacts back to null as a hotfix for a production issue caused by a WIT version mismatch. While this change appears to force a build-from-source in the RegistryInstaller by triggering a MissingChecksum error, it introduces a significant security concern. By setting the checksum to null, a critical integrity check is disabled. My review includes a critical security comment highlighting the risk of a Man-in-the-Middle (MITM) attack if any part of the system downloads and installs these artifacts without verification. This change should be treated as a temporary measure and reverted as soon as possible.

_{Note: Security Review has been skipped due to the limited scope of the PR.}

gemini-code-assist · 2026-03-06T19:12:13Z

registry/channels/discord.json

    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/discord-wasm32-wasip2.tar.gz",
-      "sha256": "27d83724c22cac2658c5f4e04dfe761206270e65d599e8f08cc8148c3d9bbe86"
+      "sha256": null


Setting the sha256 checksum to null disables integrity verification for downloaded artifacts. While the RegistryInstaller appears to handle this by falling back to a secure build-from-source, this change introduces a potential security risk if any other installation mechanism downloads from the URL without checksum validation. The pull request description's mention of an ExtensionManager that "doesn't validate checksums" suggests such a path might exist. An attacker could exploit this via a Man-in-the-Middle (MITM) attack to serve a malicious artifact. This change should be reverted and checksums restored as soon as the underlying WIT version mismatch is resolved in a new release.

Copilot

Pull request overview

This PR reverts precomputed SHA256 checksums in the extension registry manifests back to null for WASM tool/channel artifacts, intending to address a production breakage involving WIT version mismatches from releases/latest artifacts.

Changes:

Set artifacts.wasm32-wasip2.sha256 to null across 14 registry manifests (tools + channels).
Leaves the artifacts.wasm32-wasip2.url pointing at GitHub releases/latest downloads.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
registry/tools/web-search.json	Set artifact sha256 to null
registry/tools/telegram.json	Set artifact sha256 to null
registry/tools/slack.json	Set artifact sha256 to null
registry/tools/google-slides.json	Set artifact sha256 to null
registry/tools/google-sheets.json	Set artifact sha256 to null
registry/tools/google-drive.json	Set artifact sha256 to null
registry/tools/google-docs.json	Set artifact sha256 to null
registry/tools/google-calendar.json	Set artifact sha256 to null
registry/tools/gmail.json	Set artifact sha256 to null
registry/tools/github.json	Set artifact sha256 to null
registry/channels/whatsapp.json	Set artifact sha256 to null
registry/channels/telegram.json	Set artifact sha256 to null
registry/channels/slack.json	Set artifact sha256 to null
registry/channels/discord.json	Set artifact sha256 to null

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-06T19:14:47Z

registry/tools/google-slides.json

@@ -18,7 +18,7 @@
  "artifacts": {
    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-slides-wasm32-wasip2.tar.gz",


With sha256: null and a non-null artifact url, RegistryInstaller::install_from_artifact() will error MissingChecksum and (in non-repo environments) won’t be able to fall back to building from source. This will break installs of this tool via ironclaw registry install google-slides / setup flows unless a repo checkout is present; either restore a correct checksum or avoid advertising the artifact URL when checksums aren’t available.

Suggested change

"url": "https://github.com/nearai/ironclaw/releases/latest/download/google-slides-wasm32-wasip2.tar.gz",

"url": null,

Copilot · 2026-03-06T19:14:48Z

registry/tools/google-docs.json

@@ -19,7 +19,7 @@
  "artifacts": {
    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-docs-wasm32-wasip2.tar.gz",


With sha256: null and a non-null artifact url, RegistryInstaller::install_from_artifact() will error MissingChecksum and (in non-repo environments) won’t be able to fall back to building from source. This will break installs of this tool via ironclaw registry install google-docs / setup flows unless a repo checkout is present; either restore a correct checksum or avoid advertising the artifact URL when checksums aren’t available.

Suggested change

"url": "https://github.com/nearai/ironclaw/releases/latest/download/google-docs-wasm32-wasip2.tar.gz",

"url": null,

Copilot · 2026-03-06T19:14:48Z

registry/tools/github.json

@@ -20,7 +20,7 @@
  "artifacts": {
    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/github-wasm32-wasip2.tar.gz",


With sha256: null and a non-null artifact url, RegistryInstaller::install_from_artifact() will error MissingChecksum and (in non-repo environments) won’t be able to fall back to building from source. This will break installs of this tool via ironclaw registry install github / setup flows unless a repo checkout is present; either restore a correct checksum or avoid advertising the artifact URL when checksums aren’t available.

Suggested change

"url": "https://github.com/nearai/ironclaw/releases/latest/download/github-wasm32-wasip2.tar.gz",

"url": null,

Copilot · 2026-03-06T19:14:49Z

registry/tools/telegram.json

    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/telegram-mtproto-wasm32-wasip2.tar.gz",
-      "sha256": "1c3028052f680e2efa7d857d50bcb57dbc171ad197d2527875b9c3cd22f0c830"
+      "sha256": null


With sha256: null and a non-null artifact url, RegistryInstaller::install_from_artifact() will error MissingChecksum and (in non-repo environments) won’t be able to fall back to building from source. This will break ironclaw registry install telegram-mtproto / setup flows unless a repo checkout is present; either restore a correct checksum or avoid advertising the artifact URL when checksums aren’t available.

Copilot · 2026-03-06T19:14:49Z

registry/tools/slack.json

    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/slack-tool-wasm32-wasip2.tar.gz",
-      "sha256": "600fdb6f25f42bd635d3cf28217778c780e781b780c7250a57bebcf889616209"
+      "sha256": null


With sha256: null and a non-null artifact url, RegistryInstaller::install_from_artifact() will error MissingChecksum and (in non-repo environments) won’t be able to fall back to building from source. This will break ironclaw registry install slack-tool / setup flows unless a repo checkout is present; either restore a correct checksum or avoid advertising the artifact URL when checksums aren’t available.

Copilot · 2026-03-06T19:14:51Z

registry/tools/google-drive.json

@@ -19,7 +19,7 @@
  "artifacts": {
    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-drive-wasm32-wasip2.tar.gz",


With sha256: null and a non-null artifact url, RegistryInstaller::install_from_artifact() will error MissingChecksum and (in non-repo environments) won’t be able to fall back to building from source. This will break installs of this tool via ironclaw registry install google-drive / setup flows unless a repo checkout is present; either restore a correct checksum or avoid advertising the artifact URL when checksums aren’t available.

Suggested change

"url": "https://github.com/nearai/ironclaw/releases/latest/download/google-drive-wasm32-wasip2.tar.gz",

"url": null,

Copilot · 2026-03-06T19:14:51Z

registry/tools/google-calendar.json

@@ -19,7 +19,7 @@
  "artifacts": {
    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-calendar-wasm32-wasip2.tar.gz",


With sha256: null and a non-null artifact url, RegistryInstaller::install_from_artifact() will error MissingChecksum and (in non-repo environments) won’t be able to fall back to building from source. This will break installs of this tool via ironclaw registry install google-calendar / setup flows unless a repo checkout is present; either restore a correct checksum or avoid advertising the artifact URL when checksums aren’t available.

Suggested change

"url": "https://github.com/nearai/ironclaw/releases/latest/download/google-calendar-wasm32-wasip2.tar.gz",

"url": null,

Copilot · 2026-03-06T19:14:51Z

registry/channels/whatsapp.json

@@ -19,7 +19,7 @@
  "artifacts": {
    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/whatsapp-wasm32-wasip2.tar.gz",


With sha256: null and a non-null artifact url, RegistryInstaller::install_from_artifact() will error MissingChecksum and (in non-repo environments) won’t be able to fall back to building from source. This will break installs of this channel via ironclaw registry install channels/whatsapp and the setup wizard’s channel install step unless a repo checkout is present; either restore a correct checksum or avoid advertising the artifact URL when checksums aren’t available.

Suggested change

"url": "https://github.com/nearai/ironclaw/releases/latest/download/whatsapp-wasm32-wasip2.tar.gz",

"url": null,

Copilot · 2026-03-06T19:14:51Z

registry/tools/web-search.json

@@ -19,7 +19,7 @@
  "artifacts": {
    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/web-search-wasm32-wasip2.tar.gz",


Setting artifacts.wasm32-wasip2.sha256 to null while keeping a non-null url will make RegistryInstaller::install_from_artifact() fail with MissingChecksum (it requires a checksum before download). This breaks ironclaw registry install web-search and the setup wizard’s tool-install step in non-repo installs where source fallback isn’t available; either restore a correct SHA256 for the published artifact, or change the install strategy (e.g., don’t advertise an artifact URL when checksums aren’t provided).

Suggested change

"url": "https://github.com/nearai/ironclaw/releases/latest/download/web-search-wasm32-wasip2.tar.gz",

"url": null,

Copilot · 2026-03-06T19:14:52Z

registry/tools/web-search.json

    "wasm32-wasip2": {
      "url": "https://github.com/nearai/ironclaw/releases/latest/download/web-search-wasm32-wasip2.tar.gz",
-      "sha256": "8e62c9c3efaa90db92dbf421289cd9a8ba83a64613481d0f2bf9070f0403e801"
+      "sha256": null


PR description mentions checksum values blocking ExtensionManager::install(), but the ExtensionManager install path downloads by URL without using manifest sha256; sha256 is enforced by RegistryInstaller instead. If the goal is to fix runtime installs via ExtensionManager, this manifest change alone won’t affect that behavior—consider adjusting the artifact URL/versioning or the runtime install logic accordingly.

Reverts the checksums added in fe4c3c5. The baked-in checksums cause production failures when the host binary's WIT version doesn't match the artifacts at /releases/latest/ — WASM tools (web-search) and channels (telegram) fail with "matching implementation was not found in the linker". Setting sha256 back to null unblocks the runtime install path (ExtensionManager doesn't validate checksums) and allows the next release-plz run to publish matching host + artifact pairs. [skip-regression-check] Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Reverts the checksums added in cad98e9. The baked-in checksums cause production failures when the host binary's WIT version doesn't match the artifacts at /releases/latest/ — WASM tools (web-search) and channels (telegram) fail with "matching implementation was not found in the linker". Setting sha256 back to null unblocks the runtime install path (ExtensionManager doesn't validate checksums) and allows the next release-plz run to publish matching host + artifact pairs. [skip-regression-check] Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings March 6, 2026 19:09

github-actions bot added size: S 10-49 changed lines risk: low Changes to docs, tests, or low-risk modules contributor: core 20+ merged PRs labels Mar 6, 2026

Copilot started reviewing on behalf of henrypark133 March 6, 2026 19:10 View session

nickpismenkov approved these changes Mar 6, 2026

View reviewed changes

gemini-code-assist bot reviewed Mar 6, 2026

View reviewed changes

henrypark133 merged commit 1caed5a into main Mar 6, 2026
16 checks passed

henrypark133 deleted the fix/revert-wasm-checksums branch March 6, 2026 19:12

Copilot AI reviewed Mar 6, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 6, 2026

chore: release v0.16.1 #628

Merged

BrewTestBot mentioned this pull request Mar 6, 2026

ironclaw 0.16.1 Homebrew/homebrew-core#271004

Merged

This was referenced Mar 7, 2026

🦞 OpenClaw 生态日报 2026-03-07 duanyytop/agents-radar#89

Open

🦞 OpenClaw 生态日报 2026-03-07 rollysys/agents-radar#48

Open

🦞 OpenClaw 生态日报 2026-03-07 compasify/agents-radar#5

Open

	"url": "https://github.com/nearai/ironclaw/releases/latest/download/google-slides-wasm32-wasip2.tar.gz",
	"url": null,

Conversation

henrypark133 commented Mar 6, 2026

Summary

Root cause

Test plan

Uh oh!

gemini-code-assist bot commented Mar 6, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants