ruvnet/RuView · error

plugin trust options were configured, but homecore-server wa

Error message

plugin trust options were configured, but homecore-server was built without --features wasmtime

What it means

Anyhow bail in the plugin manager: config.allow_unsigned is set and/or config.trusted_publishers is non-empty, but the binary lacks the `wasmtime` feature. Plugin trust options (allowing unsigned modules, pinning trusted publisher keys) only apply to the WASM loading path, so on a non-wasmtime build they are configuration the binary cannot honor -- and it fails fast instead of pretending the trust policy is active.

Source

Thrown at v2/crates/homecore-server/src/plugins.rs:74

        for registration in NATIVE_PLUGINS {
            let (manifest, plugin) =
                (registration.create)().context("compiled-in native plugin factory failed")?;
            native
                .load(manifest, plugin, hc.clone())
                .await
                .context("compiled-in native plugin setup failed")?;
        }

        #[cfg(not(feature = "wasmtime"))]
        if !config.directories.is_empty() {
            anyhow::bail!(
                "plugin directories were configured, but homecore-server was built without \
                 --features wasmtime"
            );
        }
        #[cfg(not(feature = "wasmtime"))]
        if config.allow_unsigned || !config.trusted_publishers.is_empty() {
            anyhow::bail!(
                "plugin trust options were configured, but homecore-server was built without \
                 --features wasmtime"
            );
        }

        #[cfg(feature = "wasmtime")]
        let wasm = load_wasm_plugins(&hc, &config).await?;

        let mut receiver = hc.states().subscribe();
        let dispatch_native = native.clone();
        #[cfg(feature = "wasmtime")]
        let dispatch_wasm = wasm.clone();
        let dispatcher = tokio::spawn(async move {
            loop {
                let change = match receiver.recv().await {
                    Ok(change) => change,
                    Err(tokio::sync::broadcast::error::RecvError::Lagged(skipped)) => {
                        warn!(

View on GitHub (pinned to 4685618388)

Solutions

1. Rebuild with cargo build --release --features wasmtime so the trust options take effect
2. Or drop the allow_unsigned / trusted_publishers settings from the config for binaries that only run native plugins
3. Audit deployments so any config carrying plugin trust options is only paired with wasmtime-enabled builds

Example fix

# before
./homecore-server --allow-unsigned --plugin-dir /etc/homecore/plugins   # binary built without wasmtime
# error: plugin trust options were configured, but built without --features wasmtime

# after
cargo build --release --features wasmtime
./homecore-server --plugin-dir /etc/homecore/plugins   # signed plugins only; no --allow-unsigned needed

# preflight: trust options require a wasmtime build
WASMTIME=$(homecore-server --version 2>/dev/null | grep -c wasmtime || true)
if [[ "$WASMTIME" -eq 0 ]]; then
  unset ALLOW_UNSIGNED TRUSTED_PUBLISHERS
fi

When it happens

Trigger: Passing --allow-unsigned or trusted-publisher configuration to a build compiled without --features wasmtime; reuse of a hardened config file on a slim binary; packaging that enables trust flags but builds with default features.

Common situations: Security-hardened deployment templates applied across fleets with mixed builds; local dev binaries built minimally while sharing the production plugin config; feature drift after image rebuilds.

Related errors

• plugin directories were configured, but homecore-server was
• HAP was requested but this binary was built without the `hap
• plugin `{id}` setup returned failure code {result}
• wifi_densepose.aether is not in the binary wheels yet (see r
• wifi_densepose.mat is not in the binary wheels yet (see ruvn

AI-assisted analysis of ruvnet/RuView@4685618388 (2026-08-16). Data as JSON: /api/errors/275b8d2a98e2a6cb. Report an issue: GitHub.