{"record":{"id":"275b8d2a98e2a6cb","repo":"ruvnet/RuView","slug":"plugin-trust-options-were-configured-but-homecore","errorCode":null,"errorMessage":"plugin trust options were configured, but homecore-server was built without --features wasmtime","messagePattern":"plugin trust options were configured, but homecore-server was built without --features wasmtime","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v2/crates/homecore-server/src/plugins.rs","lineNumber":74,"sourceCode":"        for registration in NATIVE_PLUGINS {\n            let (manifest, plugin) =\n                (registration.create)().context(\"compiled-in native plugin factory failed\")?;\n            native\n                .load(manifest, plugin, hc.clone())\n                .await\n                .context(\"compiled-in native plugin setup failed\")?;\n        }\n\n        #[cfg(not(feature = \"wasmtime\"))]\n        if !config.directories.is_empty() {\n            anyhow::bail!(\n                \"plugin directories were configured, but homecore-server was built without \\\n                 --features wasmtime\"\n            );\n        }\n        #[cfg(not(feature = \"wasmtime\"))]\n        if config.allow_unsigned || !config.trusted_publishers.is_empty() {\n            anyhow::bail!(\n                \"plugin trust options were configured, but homecore-server was built without \\\n                 --features wasmtime\"\n            );\n        }\n\n        #[cfg(feature = \"wasmtime\")]\n        let wasm = load_wasm_plugins(&hc, &config).await?;\n\n        let mut receiver = hc.states().subscribe();\n        let dispatch_native = native.clone();\n        #[cfg(feature = \"wasmtime\")]\n        let dispatch_wasm = wasm.clone();\n        let dispatcher = tokio::spawn(async move {\n            loop {\n                let change = match receiver.recv().await {\n                    Ok(change) => change,\n                    Err(tokio::sync::broadcast::error::RecvError::Lagged(skipped)) => {\n                        warn!(","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/ruvnet/RuView/blob/4685618388a5e49fad5b3005806f3bdd6a7c25c3/v2/crates/homecore-server/src/plugins.rs#L56-L92","documentation":"Anyhow bail in the plugin manager: config.allow_unsigned is set and/or config.trusted_publishers is non-empty, but the binary lacks the `wasmtime` feature. Plugin trust options (allowing unsigned modules, pinning trusted publisher keys) only apply to the WASM loading path, so on a non-wasmtime build they are configuration the binary cannot honor -- and it fails fast instead of pretending the trust policy is active.","triggerScenarios":"Passing --allow-unsigned or trusted-publisher configuration to a build compiled without --features wasmtime; reuse of a hardened config file on a slim binary; packaging that enables trust flags but builds with default features.","commonSituations":"Security-hardened deployment templates applied across fleets with mixed builds; local dev binaries built minimally while sharing the production plugin config; feature drift after image rebuilds.","solutions":["Rebuild with cargo build --release --features wasmtime so the trust options take effect","Or drop the allow_unsigned / trusted_publishers settings from the config for binaries that only run native plugins","Audit deployments so any config carrying plugin trust options is only paired with wasmtime-enabled builds"],"exampleFix":"# before\n./homecore-server --allow-unsigned --plugin-dir /etc/homecore/plugins   # binary built without wasmtime\n# error: plugin trust options were configured, but built without --features wasmtime\n\n# after\ncargo build --release --features wasmtime\n./homecore-server --plugin-dir /etc/homecore/plugins   # signed plugins only; no --allow-unsigned needed","handlingStrategy":"validation","validationCode":"# preflight: trust options require a wasmtime build\nWASMTIME=$(homecore-server --version 2>/dev/null | grep -c wasmtime || true)\nif [[ \"$WASMTIME\" -eq 0 ]]; then\n  unset ALLOW_UNSIGNED TRUSTED_PUBLISHERS\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep security-relevant flags (allow_unsigned, trusted publishers) in the same config block as the plugin dirs, and version both with the binary","Never let a config silently imply trust enforcement the binary cannot provide -- this bail is that guard","Audit fleets for trust flags on non-wasmtime builds; they cannot start by design"],"tags":["rust","plugins","wasmtime","feature-flags","security","build-config"],"backgroundTag":null,"analyzedSha":"4685618388a5e49fad5b3005806f3bdd6a7c25c3","analyzedAt":"2026-08-16T06:09:40.886Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}