component build doesn't seems to respect local world prefix about cargo-component

[esoterra]

Not including the components own identity in the Wasm is, from the view of the registry security design, intentional and a feature. A given component binary can't be trusted to assert its own identity without context/verification and many kinds of vulnerabilities can arise from trusting them to do so.

[esoterra]

What does your Cargo.toml look like?

[sehz]

[package]
name = "operator-guest"
version = "0.1.0"
edition = "2021"

[lib]
crate-type = ["cdylib"]

[package.metadata.component]
package = "component:my-component"


[package.metadata.component.dependencies]


[dependencies]
cargo-component-bindings = { git = "https://github.com/bytecodealliance/cargo-component" }

[esoterra]

I would bet that whatever tool you're using to generate the WIT that corresponds to your components type is choosing the root:component package name for it arbitrarily.

Components don't intrinsically know their own name or the name of the world they were built against because the name of a component depends on how/where it's published and a given component is compatible with any world matching its type not just the one it was built against. What they do record internally is the identity of the interfaces they import and export, which is why the interfaces in the generated WIT do track your original identifiers.

[sehz]

I am just running cargo component build.

[peterhuene]

I would bet that whatever tool you're using to generate the WIT that corresponds to your components type is choosing the root:component package name for it arbitrarily.

That's correct. wit-component chooses an arbitrary name for the package when decoding a component because the original package name is not encoded in the wasm.

I think we should probably be encoding the package name in the file header of the wasm (as opposed to, say, the names custom section), as technically the package directive in WIT has semantic meaning.

We should probably file an issue with the component model proposal.

[sehz]

The explanation makes sense. Closing this