Skip to main content

Building from source

Prerequisites​

  • Node ≥ 26.5.0 and pnpm (see root packageManager)
  • Docker — required for REQUIRE_REPRODUCIBLE=1 / CI (pinned emscripten/emsdk from vendor.lock.json)
  • Local Emscripten is optional for day-to-day edits; hashes may differ from CI

Steps​

git clone https://github.com/antonymott/quantum-resistant-rustykey.git
cd quantum-resistant-rustykey
pnpm i
pnpm fetch:vendors   # verify vendor/ trees match vendor.lock.json
pnpm build
REQUIRE_REPRODUCIBLE=1 pnpm build:vendor
pnpm verify:repro

This forces Docker + the Emscripten image digest in vendor.lock.json, sets SOURCE_DATE_EPOCH, and checks src/vendor/*.js against repro.hashes.json.

After an intentional toolchain or C-vendor change:

REQUIRE_REPRODUCIBLE=1 pnpm build:vendor
pnpm verify:repro -- --update
pnpm fetch:vendors -- --update   # if vendor C trees changed

Audit build (source maps)​

pnpm build:audit
# outputs under wasm/audit-build/ (gitignored; also uploaded from CI)

Project structure (ML-KEM path)​

mlkem-native (C) → Emscripten under wasm/ → TypeScript in mlkem-src/ → bundled src/vendor/mlkem*.js → tsdown → dist/.