Why
Toolchain version pins are scattered across Dockerfiles, shell scripts, and Mill — and some are already contradictory:
- WASI SDK: 24 vs 25. The builder image (
cpython/builder/Dockerfile) and python-host/build-wasm.sh pin SDK 24, but cpython/cpython-wasi/Dockerfile pins SDK 25 — so libpython is built with a different SDK than the Rust host that links it.
- Binaryen: per-arch split.
cpython/cpython-wasi/Dockerfile uses 111 on x86_64 vs 125 on arm64 (builder image: 125). Per-architecture optimizer versions mean per-arch artifacts aren't comparable, undermining any reproducibility/verification story.
build-wasm.sh hardcodes the -macos.tar.gz WASI SDK download regardless of uname — wasm-local on Linux downloads macOS binaries and fails confusingly.- Wizer 10.0.0 is pinned in two places; Rust 1.86 in two (
rust-toolchain.toml, FROM rust:1.86-bookworm); the string python3.14 appears in ~8 places across Java (PythonExecutorFactory.java), Mill (build.mill), build-wasm.sh, both build.rs files, Dockerfiles, CI, and the overlay path — a CPython 3.15 bump is a cross-cutting find-and-replace with no single source of truth.
What
- One versions file (e.g.
versions.env or Mill constants) consumed by Dockerfiles (build args), shell scripts, and Mill for: WASI SDK, Wizer, Binaryen, Rust, CPython version.
- Align WASI SDK across libpython and the Rust host build; unify Binaryen across architectures.
- Platform-detect the WASI SDK download in
build-wasm.sh.
Why
Toolchain version pins are scattered across Dockerfiles, shell scripts, and Mill — and some are already contradictory:
cpython/builder/Dockerfile) andpython-host/build-wasm.shpin SDK 24, butcpython/cpython-wasi/Dockerfilepins SDK 25 — so libpython is built with a different SDK than the Rust host that links it.cpython/cpython-wasi/Dockerfileuses 111 on x86_64 vs 125 on arm64 (builder image: 125). Per-architecture optimizer versions mean per-arch artifacts aren't comparable, undermining any reproducibility/verification story.build-wasm.shhardcodes the-macos.tar.gzWASI SDK download regardless ofuname—wasm-localon Linux downloads macOS binaries and fails confusingly.rust-toolchain.toml,FROM rust:1.86-bookworm); the stringpython3.14appears in ~8 places across Java (PythonExecutorFactory.java), Mill (build.mill),build-wasm.sh, bothbuild.rsfiles, Dockerfiles, CI, and the overlay path — a CPython 3.15 bump is a cross-cutting find-and-replace with no single source of truth.What
versions.envor Mill constants) consumed by Dockerfiles (build args), shell scripts, and Mill for: WASI SDK, Wizer, Binaryen, Rust, CPython version.build-wasm.sh.