[container] extism 1.6.3 fails with segault on any usage

[markmandel]

Been working on extism extensions for Agones, and run into the following issue:

https://github.com/markmandel/agones/blob/92b3530806a9f7c04c428f3d633c06145674165d/build/build-image/Dockerfile#L86-L87

Is the code in question. but on a shorter version:

FROM debian:bookworm

# ....

# install extism
RUN curl -s https://get.extism.org/cli | sh -s -- -y && \
    extism lib install

Results in the following:

 => ERROR [17/29] RUN curl -s https://get.extism.org/cli | sh -s -- -y && extism lib install                                                              1.3s
------
 > [17/29] RUN curl -s https://get.extism.org/cli | sh -s -- -y && extism lib install:
0.763 Extracting release to /usr/local/bin/extism
1.222 extism executable installed to /usr/local/bin/extism
1.240 Segmentation fault (core dumped)
------

 6 warnings found (use docker --debug to expand):
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 46)
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 53)
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 66)
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 67)
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 95)
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 32)
Dockerfile:86
--------------------
  84 |
  85 |     # install extism
  86 | >>> RUN curl -s https://get.extism.org/cli | sh -s -- -y && extism lib install
  87 |
  88 |     #
--------------------
ERROR: failed to build: failed to solve: process "/bin/sh -c curl -s https://get.extism.org/cli | sh -s -- -y && extism lib install" did not complete successfully: exit code: 139
make[2]: *** [includes/build-image.mk:26: build-build-image] Error 1
make[2]: Leaving directory '/home/mark/workspace/agones/build'
make[1]: *** [includes/build-image.mk:63: ensure-image] Error 2
make[1]: Leaving directory '/home/mark/workspace/agones/build'
make: *** [includes/build-image.mk:44: ensure-build-image] Error 2

This has definitely worked before, so must be an issue with a later release?

[nilslice]

Hmm, it’s possible! Maybe change the install to build from source since you’re using the Go toolchain already:

https://github.com/extism/cli?tab=readme-ov-file#from-source

[markmandel]

Oooh, it's the cli tool itself, it doesn't work 😕

root@48d232c603af:/go/src/agones.dev/agones# extism --version
Segmentation fault (core dumped)

[markmandel]

Also confirmed, locking to 1.6.2 works as expected

RUN curl -s https://get.extism.org/cli | sh -s -- -v v1.6.2 -y && \
    extism lib install

[nilslice]

Thanks! Did you try building the latest from source already?

[markmandel]

No, I haven't tried that yet.

[ozanmuyes]

TL;DR Well I did and all good (for extism v1.6.3)

OS: macOS Tahoe 26.0.1 (Intel)
Go: go version go1.25.1 darwin/amd64

Outputs

$ go install github.com/extism/cli/extism@latest
go: downloading github.com/extism/cli v1.6.3
go: downloading github.com/extism/cli/extism v0.0.0-20240426144342-8fe7ce2102da
go: downloading github.com/extism/cli v1.2.1-0.20240424190857-5e617c3fbd89
go: downloading github.com/spf13/cobra v1.8.0
go: downloading github.com/extism/go-sdk v1.2.0
go: downloading github.com/tetratelabs/wazero v1.6.0
go: downloading github.com/google/go-github/v55 v55.0.0
go: downloading github.com/charmbracelet/lipgloss v0.10.0
go: downloading github.com/charmbracelet/bubbletea v0.25.0
go: downloading github.com/ebitengine/purego v0.5.1
go: downloading github.com/charmbracelet/bubbles v0.18.0
go: downloading github.com/muesli/cancelreader v0.2.2
go: downloading github.com/muesli/reflow v0.3.0
go: downloading github.com/muesli/termenv v0.15.2
go: downloading github.com/muesli/ansi v0.0.0-20211018074035-2e021307bc4b
go: downloading github.com/mattn/go-localereader v0.0.1
go: downloading golang.org/x/term v0.15.0
go: downloading golang.org/x/sync v0.1.0
go: downloading github.com/mattn/go-isatty v0.0.18
go: downloading github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81
go: downloading github.com/rivo/uniseg v0.4.7
go: downloading github.com/sahilm/fuzzy v0.1.1-0.20230530133925-c48e322e2a8f
go: downloading github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c
go: downloading github.com/google/go-querystring v1.1.0
go: downloading github.com/mattn/go-runewidth v0.0.15
go: downloading github.com/atotto/clipboard v0.1.4
go: downloading golang.org/x/sys v0.16.0
go: downloading github.com/aymanbagabas/go-osc52/v2 v2.0.1
go: downloading github.com/lucasb-eyer/go-colorful v1.2.0
go: downloading github.com/cloudflare/circl v1.3.7
go: downloading golang.org/x/crypto v0.17.0
$ extism --version

extism version 1.3.0

[mrBen]

I have the same issue (v1.6.3 on linux)
Build from source did solve the issue for me (extism --version give 1.3.0 though)

[tokcum]

I've the same issue on Linux with v1.6.3. This is how I installed the extism CLI.

curl -s https://get.extism.org/cli | sh -s -- -o $HOME/.local/bin

Installation worked as expected:

which extism
/home/tobias/.local/bin/extism

sha256sum $(which extism)
c5dc020c83795a07ec976f8e06120f7a30bc583aace8c482f4c9a1a07ffd4225  /home/tobias/.local/bin/extism

extism --version
Segmentation fault         (core dumped) extism --version

I've manually checked v1.6.3 from releases and file hash matches installed binary. I've also checked v1.6.2 from releases and confirm that it works fine.

~/Downloads/extism-v1.6.2-linux-amd64/extism --version
extism version 1.6.2

I'm on Manjaro Linux.

[jwetzell]

Repeatable here on Ubuntu 25.04

[nbaertsch]

This is causing GH action CI failure in zig-pdk extism/zig-pdk#43

Reading here, seems I could lock the version to 1.6.2, but I'll refrain for now.

[nilslice]

this is being fully re-written and should solve all of these issues. will update here soon. thanks!

[Boscop]

@nilslice This issue is completely blocking me. Do you know when this will be fixed? Thanks! 🙏

[nilslice]

No, but I've already answered you elsewhere you should just build it from source.