From eff99d82569a7c5aa7b1c6bfe2287577be39a7b5 Mon Sep 17 00:00:00 2001
From: Ryan Hammonds <ryan.hammonds@goteleport.com>
Date: Thu, 28 Aug 2025 16:37:29 -0400
Subject: [PATCH 1/4] Get a Teleport build working without wasm-pack

---
 .github/workflows/build-macos.yaml |  2 +-
 BUILD_macos.md                     | 18 ----------
 Makefile                           | 56 +++++++++++++++++++-----------
 README.md                          |  9 -----
 build.assets/Dockerfile            |  6 ----
 build.assets/Dockerfile-centos7    |  5 ---
 build.assets/Dockerfile-node       |  6 ----
 build.assets/Makefile              | 12 +++----
 build.assets/versions.mk           |  2 +-
 build.assets/windows/build.ps1     | 23 ++++--------
 devbox.json                        |  1 -
 devbox.lock                        | 48 -------------------------
 web/README.md                      |  4 ---
 web/packages/shared/README.md      |  1 -
 web/packages/shared/package.json   |  2 +-
 web/packages/teleport/README.md    |  8 -----
 web/packages/teleterm/README.md    |  5 +--
 17 files changed, 50 insertions(+), 158 deletions(-)

diff --git a/.github/workflows/build-macos.yaml b/.github/workflows/build-macos.yaml
index 9a346f5d5a2c8..bf5f653ec5228 100644
--- a/.github/workflows/build-macos.yaml
+++ b/.github/workflows/build-macos.yaml
@@ -67,7 +67,7 @@ jobs:
           rustup override set ${{ env.RUST_VERSION }}
           rustup target add wasm32-unknown-unknown
 
-      - name: Install wasm-pack
+      - name: Install wasm-deps
         run: make ensure-wasm-deps
 
       - name: Build
diff --git a/BUILD_macos.md b/BUILD_macos.md
index 2817317780518..1af5f774bc305 100644
--- a/BUILD_macos.md
+++ b/BUILD_macos.md
@@ -84,24 +84,6 @@ and updates are welcome!
         node --version
         ```
 
-1. Install `wasm-pack`:
-    1. Find the required wasm-pack version in
-    [`build.assets/versions.mk`](/build.assets/versions.mk)
-    (`WASM_PACK_VERSION`).
-
-    1. Install wasm-pack globally:
-
-        ```shell
-        # Replace <version> with the value of WASM_PACK_VERSION from build.assets/versions.mk (e.g., 0.12.1)
-        npm install --global wasm-pack@<version>
-        ```
-
-    1. Verify wasm-pack version:
-
-        ```shell
-        wasm-pack --version
-        ```
-
 1. Install `libfido2`:
 
     ```shell
diff --git a/Makefile b/Makefile
index b2e5865a6dede..6635392d909db 100644
--- a/Makefile
+++ b/Makefile
@@ -132,6 +132,7 @@ CARGO_TARGET_linux_arm := arm-unknown-linux-gnueabihf
 CARGO_TARGET_linux_arm64 := aarch64-unknown-linux-gnu
 CARGO_TARGET_linux_386 := i686-unknown-linux-gnu
 CARGO_TARGET_linux_amd64 := x86_64-unknown-linux-gnu
+CARGO_TARGET_wasm := wasm32-unknown-unknown
 
 CARGO_TARGET := --target=$(RUST_TARGET_ARCH)
 
@@ -488,6 +489,22 @@ ifeq ("$(with_rdpclient)", "yes")
 		cargo build -p rdp-client $(if $(FIPS),--features=fips) --release --locked $(CARGO_TARGET)
 endif
 
+.PHONY: build-ironrdp-wasm
+build-ironrdp-wasm: ironrdp = web/packages/shared/libs/ironrdp
+build-ironrdp-wasm: ensure-wasm-deps
+	cargo build --package ironrdp --lib --target $(CARGO_TARGET_wasm) --release
+	wasm-opt target/$(CARGO_TARGET_wasm)/release/ironrdp.wasm -o target/$(CARGO_TARGET_wasm)/release/ironrdp.wasm -O
+	wasm-bindgen target/$(CARGO_TARGET_wasm)/release/ironrdp.wasm --out-dir $(ironrdp)/pkg --typescript --target web
+	@echo "*" > $(ironrdp)/pkg/.gitignore
+	@printf '%s\n' '{' \
+	' "name": "ironrdp",' \
+	' "version": "0.1.0",' \
+	' "module": "ironrdp.js",' \
+	' "types": "ironrdp.d.ts",' \
+	' "files": ["ironrdp_bg.wasm","ironrdp.js","ironrdp.d.ts"],' \
+	' "sideEffects": ["./snippets/*"]' \
+	'}' > $(ironrdp)/pkg/package.json
+
 # Build libfido2 and dependencies for MacOS. Uses exported C_ARCH variable defined earlier.
 .PHONY: build-fido2
 build-fido2:
@@ -539,7 +556,7 @@ endif
 	rm -f *.zip
 	rm -f gitref.go
 	rm -rf build.assets/tooling/bin
-	# Clean up wasm-pack build artifacts
+	# Clean up wasm build artifacts
 	rm -rf web/packages/shared/libs/ironrdp/pkg/
 
 .PHONY: clean-ui
@@ -1880,29 +1897,17 @@ ensure-js-deps:
 ifeq ($(WEBASSETS_SKIP_BUILD),1)
 ensure-wasm-deps:
 else
-ensure-wasm-deps: ensure-wasm-pack ensure-wasm-bindgen
-
-# Get the version of wasm-bindgen from cargo, as that is what wasm-pack is
-# going to do when it checks for the right version. The buildboxes do not
-# have jq installed (yet), so have a hacky awk version on standby.
-CARGO_GET_VERSION_JQ = cargo metadata --locked --format-version=1 | jq -r 'first(.packages[] | select(.name? == "$(1)") | .version)'
-CARGO_GET_VERSION_AWK = awk -F '[ ="]+' '/^name = "$(1)"$$/ {inpkg = 1} inpkg && $$1 == "version" {print $$2; exit}' Cargo.lock
+ensure-wasm-deps: ensure-wasm-bindgen ensure-wasm-opt rustup-install-wasm-toolchain
 
-BIN_JQ = $(shell which jq 2>/dev/null)
-CARGO_GET_VERSION = $(if $(BIN_JQ),$(CARGO_GET_VERSION_JQ),$(CARGO_GET_VERSION_AWK))
+# Get the version of wasm-bindgen from cargo
+WASM_BINDGEN_VERSION = $(shell cargo pkgid --package ironrdp wasm-bindgen 2>/dev/null | cut -d '@' -f 2)
 
-ensure-wasm-pack: NEED_VERSION = $(shell $(MAKE) --no-print-directory -s -C build.assets print-wasm-pack-version)
-ensure-wasm-pack: INSTALLED_VERSION = $(word 2,$(shell wasm-pack --version 2>/dev/null))
-ensure-wasm-pack:
-	$(if $(filter-out $(INSTALLED_VERSION),$(NEED_VERSION)),\
-		cargo install wasm-pack --force --locked --version "$(NEED_VERSION)", \
-		@echo wasm-pack up-to-date: $(INSTALLED_VERSION) \
-	)
+.PHONY: print-wasm-bindgen-version
+print-wasm-bindgen-version: NEED_VERSION = $(WASM_BINDGEN_VERSION)
+print-wasm-bindgen-version:
+	@echo $(NEED_VERSION)
 
-# TODO: Use CARGO_GET_VERSION_AWK instead of hardcoded version
-#       On 386 Arch, calling the variable produces a malformed command that fails the build.
-#ensure-wasm-bindgen: NEED_VERSION = $(shell $(call CARGO_GET_VERSION,wasm-bindgen))
-ensure-wasm-bindgen: NEED_VERSION = 0.2.99
+ensure-wasm-bindgen: NEED_VERSION = $(WASM_BINDGEN_VERSION)
 ensure-wasm-bindgen: INSTALLED_VERSION = $(word 2,$(shell wasm-bindgen --version 2>/dev/null))
 ensure-wasm-bindgen:
 ifneq ($(CI)$(FORCE),)
@@ -1919,6 +1924,11 @@ else
 endif
 endif
 
+.PHONY: ensure-wasm-opt
+ensure-wasm-opt: WASM_OPT_VERSION := $(shell $(MAKE) --no-print-directory -C build.assets print-wasm-opt-version)
+ensure-wasm-opt:
+	cargo install wasm-opt@$(WASM_OPT_VERSION)
+
 .PHONY: build-ui
 build-ui: ensure-js-deps ensure-wasm-deps
 	@[ "${WEBASSETS_SKIP_BUILD}" -eq 1 ] || pnpm build-ui-oss
@@ -1944,6 +1954,10 @@ rustup-set-version:
 rustup-install-target-toolchain: rustup-set-version
 	rustup target add $(RUST_TARGET_ARCH)
 
+.PHONY: rustup-install-wasm-toolchain
+rustup-install-wasm-toolchain: rustup-set-version
+	rustup target add $(CARGO_TARGET_wasm)
+
 # changelog generates PR changelog between the provided base tag and the tip of
 # the specified branch.
 #
diff --git a/README.md b/README.md
index a16e8a575a2f3..e7e858ed25a2c 100644
--- a/README.md
+++ b/README.md
@@ -144,21 +144,12 @@ versions listed in [`build.assets/versions.mk`](/build.assets/versions.mk):
 1. [`Go`](https://golang.org/dl/)
 1. [`Rust`](https://www.rust-lang.org/tools/install)
 1. [`Node.js`](https://nodejs.org/en/download/)
-1. [`wasm-pack`](https://github.com/rustwasm/wasm-pack)
 1. [`libfido2`](https://github.com/Yubico/libfido2)
 1. [`pkg-config`](https://www.freedesktop.org/wiki/Software/pkg-config/)
 
 For an example of Dev Environment setup on a Mac, see [these
 instructions](/BUILD_macos.md).
 
-##### Linux 64-bit ARM Dependencies
-
-1. On Linux aarch64 (64-bit ARM), you may need to manually install
-   [`binaryen`](https://github.com/WebAssembly/binaryen). Check with `which
-   wasm-opt`. If not found, install with `apt-get install binaryen`
-   (Debian-based systems). On other platforms, `wasm-pack` installs it
-   automatically.
-
 #### Perform a build
 
 >**Important**
diff --git a/build.assets/Dockerfile b/build.assets/Dockerfile
index 7926786363285..46abb5ec1fc87 100644
--- a/build.assets/Dockerfile
+++ b/build.assets/Dockerfile
@@ -181,8 +181,6 @@ RUN apt-get -y update && \
     echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
     tee /etc/apt/sources.list.d/hashicorp.list > /dev/null && \
     apt-get update && apt-get install terraform -y --no-install-recommends && \
-    # Manually install the wasm-opt binary from the binaryen package on ARM64.
-    if [ "$BUILDARCH" = "arm64" ]; then apt-get install -y binaryen; fi && \
     pip3 --no-cache-dir install yamllint && \
     dpkg-reconfigure locales && \
     apt-get -y clean && \
@@ -228,10 +226,6 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup target add wasm32-unknown-unknown && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu; fi
 
-ARG WASM_PACK_VERSION
-# Install wasm-pack for targeting WebAssembly from Rust.
-RUN cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}
-
 # Switch back to root for the remaining instructions and keep it as the default
 # user.
 USER root
diff --git a/build.assets/Dockerfile-centos7 b/build.assets/Dockerfile-centos7
index c3862ee508836..dca5a644e5bb0 100644
--- a/build.assets/Dockerfile-centos7
+++ b/build.assets/Dockerfile-centos7
@@ -279,11 +279,6 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustc --version && \
     rustup target add wasm32-unknown-unknown
 
-# Install wasm-pack for targeting WebAssembly from Rust.
-ARG WASM_PACK_VERSION
-# scl enable is required to use the newer C compiler installed above. Without it, the build fails.
-RUN scl enable ${DEVTOOLSET} "cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}"
-
 # Do a quick switch back to root and copy/setup libfido2 and libpcsclite binaries.
 # Do this last to take better advantage of the multi-stage build.
 USER root
diff --git a/build.assets/Dockerfile-node b/build.assets/Dockerfile-node
index 59a3100c80e1e..58e68525a3be4 100644
--- a/build.assets/Dockerfile-node
+++ b/build.assets/Dockerfile-node
@@ -49,8 +49,6 @@ RUN apt-get -y update && \
     # Used during tag builds to build the RPM package of Connect.
     rpm \
     && \
-    # Manually install the wasm-opt binary from the binaryen package on ARM64.
-    if [ "$BUILDARCH" = "arm64" ]; then apt-get install -y binaryen; fi && \
     dpkg-reconfigure locales && \
     apt-get -y clean && \
     rm -rf /var/lib/apt/lists/*
@@ -82,7 +80,3 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup component add rustfmt clippy && \
     rustup target add wasm32-unknown-unknown && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu; fi
-
-# Install wasm-pack for targeting WebAssembly from Rust.
-ARG WASM_PACK_VERSION
-RUN cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}
diff --git a/build.assets/Makefile b/build.assets/Makefile
index 17106405bbc3c..ec9c570fcb9e9 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -176,7 +176,6 @@ buildbox:
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg GOLANGCI_LINT_VERSION=$(GOLANGCI_LINT_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--build-arg NODE_VERSION=$(NODE_VERSION) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg BUF_VERSION=$(BUF_VERSION) \
@@ -219,7 +218,6 @@ buildbox-centos7:
 		--build-arg TARGETARCH=$(RUNTIME_ARCH) \
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--build-arg DEVTOOLSET=$(DEVTOOLSET) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg LIBPCSCLITE_VERSION=$(LIBPCSCLITE_VERSION) \
@@ -248,7 +246,6 @@ buildbox-centos7-fips:
 		--build-arg TARGETARCH=$(RUNTIME_ARCH) \
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--build-arg DEVTOOLSET=$(DEVTOOLSET) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg LIBPCSCLITE_VERSION=$(LIBPCSCLITE_VERSION) \
@@ -297,7 +294,6 @@ buildbox-node:
 		--build-arg GID=$(GID) \
 		--build-arg NODE_VERSION=$(NODE_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--cache-to type=inline \
 		--cache-from $(BUILDBOX_NODE) \
 		$(if $(PUSH),--push,--load) \
@@ -738,11 +734,11 @@ print-rust-version:
 	@echo $(RUST_VERSION)
 
 #
-# Print the wasm-pack version used to build Teleport.
+# Print the wasm-opt version used to build Teleport.
 #
-.PHONY:print-wasm-pack-version
-print-wasm-pack-version:
-	@echo $(WASM_PACK_VERSION)
+.PHONY:print-wasm-opt-version
+print-wasm-opt-version:
+	@echo $(WASM_OPT_VERSION)
 
 #
 # Print the Node version used to build Teleport Connect.
diff --git a/build.assets/versions.mk b/build.assets/versions.mk
index 67fec7bc2164a..291bbc9c31801 100644
--- a/build.assets/versions.mk
+++ b/build.assets/versions.mk
@@ -11,7 +11,7 @@ NODE_VERSION ?= 22.14.0
 
 # Run lint-rust check locally before merging code after you bump this.
 RUST_VERSION ?= 1.81.0
-WASM_PACK_VERSION ?= 0.12.1
+WASM_OPT_VERSION ?= 0.116.1
 LIBBPF_VERSION ?= 1.2.2
 LIBPCSCLITE_VERSION ?= 1.9.9-teleport
 
diff --git a/build.assets/windows/build.ps1 b/build.assets/windows/build.ps1
index db5ad6a23a5c5..30efd34ab5a5b 100644
--- a/build.assets/windows/build.ps1
+++ b/build.assets/windows/build.ps1
@@ -164,23 +164,15 @@ function Enable-Node {
     }
 }
 
-function Install-WasmPack {
+function Install-WasmDeps {
     <#
     .SYNOPSIS
-        Builds and installs wasm-pack and dependent tooling.
+        Builds and installs wasm-bindgen-cli, wasm-opt, and wasm32-unknown-unknown toolchain.
     #>
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]
-        [string] $WasmPackVersion
-    )
-    begin {
-        Write-Host "::group::Installing wasm-pack $WasmPackVersion"
-        # TODO(camscale): Don't hard-code wasm-binden-cli version
-        cargo install wasm-bindgen-cli --locked --version 0.2.99
-        cargo install wasm-pack --locked --version "$WasmPackVersion"
-        Write-Host "::endgroup::"
-    }
+    
+    Write-Host "::group::Installing wasm-bindgen-cli, wasm-opt, and wasm32-unknown-unknown toolchain"
+    make -C "$TeleportSourceDirectory" ensure-wasm-deps
+    Write-Host "::endgroup::"
 }
 
 function Install-Wintun {
@@ -349,8 +341,7 @@ function Install-BuildRequirements {
         $GoVersion = $(make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-go-version).TrimStart("go")
         Install-Go -GoVersion "$GoVersion" -ToolchainDir "$InstallDirectory"
 
-        $WasmPackVersion = $(make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-wasm-pack-version).Trim()
-        Install-WasmPack -WasmPackVersion "$WasmPackVersion"
+        Install-WasmDeps
     }
     Write-Host $("All build requirements installed in {0:g}" -f $CommandDuration)
 }
diff --git a/devbox.json b/devbox.json
index 9e6cb5d6dbfb3..4576f87314496 100644
--- a/devbox.json
+++ b/devbox.json
@@ -14,7 +14,6 @@
     "yamllint@latest",
     "zlib@latest",
     "rustup@latest",
-    "wasm-pack@latest",
     "wasm-bindgen-cli@latest",
     "pkg-config@latest",
 
diff --git a/devbox.lock b/devbox.lock
index 42454fe15ef70..33c209f4fe5db 100644
--- a/devbox.lock
+++ b/devbox.lock
@@ -1458,54 +1458,6 @@
         }
       }
     },
-    "wasm-pack@latest": {
-      "last_modified": "2024-11-16T04:25:12Z",
-      "resolved": "github:NixOS/nixpkgs/34a626458d686f1b58139620a8b2793e9e123bba#wasm-pack",
-      "source": "devbox-search",
-      "version": "0.13.1",
-      "systems": {
-        "aarch64-darwin": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/1p81s2kwmj415jvg1v2avgq83mqx7fns-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/1p81s2kwmj415jvg1v2avgq83mqx7fns-wasm-pack-0.13.1"
-        },
-        "aarch64-linux": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/377fivabb47p4xczxxdjlikpzqjiyw1l-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/377fivabb47p4xczxxdjlikpzqjiyw1l-wasm-pack-0.13.1"
-        },
-        "x86_64-darwin": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/b491smk9is9kmys0v26gbdnqgic3z993-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/b491smk9is9kmys0v26gbdnqgic3z993-wasm-pack-0.13.1"
-        },
-        "x86_64-linux": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/b8630fh9mnsi9gakpldyp3xjrdh760yi-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/b8630fh9mnsi9gakpldyp3xjrdh760yi-wasm-pack-0.13.1"
-        }
-      }
-    },
     "yamllint@latest": {
       "last_modified": "2024-11-16T04:25:12Z",
       "resolved": "github:NixOS/nixpkgs/34a626458d686f1b58139620a8b2793e9e123bba#yamllint",
diff --git a/web/README.md b/web/README.md
index 05cef0df8f558..717c59330750d 100644
--- a/web/README.md
+++ b/web/README.md
@@ -28,10 +28,6 @@ pnpm install
 
 You will also need the following tools installed:
 * The `Rust` and `Cargo` version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11) (search for `RUST_VERSION`) are required.
-* The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required:
-  `curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh`
-* [`binaryen`](https://github.com/WebAssembly/binaryen) (which contains `wasm-opt`) is required to be installed manually
-    on linux aarch64 (64-bit ARM). You can check if it's already installed on your system by running `which wasm-opt`. If not you can install it like `apt-get install binaryen` (for Debian-based Linux). `wasm-pack` will install this automatically on other platforms.
 
 To build the Teleport open source version
 
diff --git a/web/packages/shared/README.md b/web/packages/shared/README.md
index 00b962fd11d42..53e54f0909136 100644
--- a/web/packages/shared/README.md
+++ b/web/packages/shared/README.md
@@ -15,7 +15,6 @@ Add `@gravitational/shared` to your package.json file.
 ### WASM
 
 This package includes a WASM module built from a Rust codebase located in `packages/shared/libs/ironrdp`.
-It is built with the help of [wasm-pack](https://github.com/rustwasm/wasm-pack).
 
 Running `pnpm build-wasm` builds the WASM binary as well as the appropriate Javascript/Typescript
 bindings and types in `web/packages/shared/libs/ironrdp/pkg`.
\ No newline at end of file
diff --git a/web/packages/shared/package.json b/web/packages/shared/package.json
index 77d402bcc6023..09a6621d0cfb6 100644
--- a/web/packages/shared/package.json
+++ b/web/packages/shared/package.json
@@ -10,7 +10,7 @@
     "directory": "packages/shared"
   },
   "scripts": {
-    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && RUST_MIN_STACK=16777216 wasm-pack build ./libs/ironrdp --target web"
+    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && make -C ../../../ build-ironrdp-wasm"
   },
   "dependencies": {
     "@gravitational/design": "workspace:*",
diff --git a/web/packages/teleport/README.md b/web/packages/teleport/README.md
index ccf9b31b3ee60..415d67b138486 100644
--- a/web/packages/teleport/README.md
+++ b/web/packages/teleport/README.md
@@ -5,11 +5,3 @@ This package contains the source code of Teleport Web UI.
 ## Development
 
 Follow the instructions from `web/README.md`.
-
-#### wasm-pack
-
-The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required to build the WebAssembly module.
-
-When calling `wasm-pack`, we set the environment variable `RUST_MIN_STACK=16777216`. This is necessary to avoid a `SIGSEGV` error when building the module on some systems.
-
-`16777216` was chosen based on [the suggestion in the rust compiler error message](https://github.com/rust-lang/rust/blob/10a7aa14fed9b528b74b0f098c4899c37c09a9c7/compiler/rustc_driver_impl/src/signal_handler.rs#L104-L106) to double the [`DEFAULT_STACK_SIZE`](https://github.com/rust-lang/rust/blob/10a7aa14fed9b528b74b0f098c4899c37c09a9c7/compiler/rustc_interface/src/util.rs#L52) value.
diff --git a/web/packages/teleterm/README.md b/web/packages/teleterm/README.md
index 6ec2d5b2536b3..1296942d6b800 100644
--- a/web/packages/teleterm/README.md
+++ b/web/packages/teleterm/README.md
@@ -53,11 +53,8 @@ pnpm install && make build/tsh
 
 The app depends on Rust WASM code. To compile it, the following tools have to be installed:
 * `Rust` and `Cargo`. The required version is specified by `RUST_VERSION` in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11).
-* [`wasm-pack`](https://github.com/rustwasm/wasm-pack). The required version is specified by `WASM_PACK_VERSION` in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12).
-* [`binaryen`](https://github.com/WebAssembly/binaryen) which contains `wasm-opt`. This is required on on linux aarch64 (64-bit ARM).
-  You can check if it's already installed on your system by running `which wasm-opt`. If not you can install it like `apt-get install binaryen` (for Debian-based Linux). `wasm-pack` will install this automatically on other platforms.
 
-To automatically install `wasm-pack`, run the following command:
+To automatically install `wasm-bindgen-cli` and `wasm-opt`, run the following command:
 ```shell
 make ensure-wasm-deps
 ```

From b7fdb47977ef71d2256cd48ade1cfd2a1bf90ce9 Mon Sep 17 00:00:00 2001
From: Ryan Hammonds <ryan.hammonds@goteleport.com>
Date: Thu, 4 Sep 2025 22:57:08 -0400
Subject: [PATCH 2/4] * seed docker images with wasm-opt, and wasm-bindgen-cli
 * Replace potentially confusing 'CARGO_TARGET_wasm' variable. * Replace
 oneoff .gitignore with a corresponding entry in the top level .gitignore. *
 Replace 'printf' used to create package.json file with a cleaner multiline
 string. * Remove unnecessary 'NEED_VERSION' * Use awk to find wasm-bindgen
 version without using 'cargo' since it doesn't seem to be available on ARM64
 runners

---
 .gitignore                   |  1 +
 Makefile                     | 41 ++++++++++++++++++++----------------
 build.assets/Dockerfile      |  5 +++++
 build.assets/Dockerfile-node |  5 +++++
 build.assets/Makefile        | 11 ++++++++++
 build.assets/versions.mk     |  1 +
 6 files changed, 46 insertions(+), 18 deletions(-)

diff --git a/.gitignore b/.gitignore
index ebec5a42720af..f7bd168f589cf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@ default.etcd
 out
 build
 !/web/packages/build
+/web/packages/shared/libs/ironrdp/pkg/**
 *.o
 *.a
 *.so
diff --git a/Makefile b/Makefile
index 6635392d909db..d95cbf652f82d 100644
--- a/Makefile
+++ b/Makefile
@@ -132,9 +132,9 @@ CARGO_TARGET_linux_arm := arm-unknown-linux-gnueabihf
 CARGO_TARGET_linux_arm64 := aarch64-unknown-linux-gnu
 CARGO_TARGET_linux_386 := i686-unknown-linux-gnu
 CARGO_TARGET_linux_amd64 := x86_64-unknown-linux-gnu
-CARGO_TARGET_wasm := wasm32-unknown-unknown
 
 CARGO_TARGET := --target=$(RUST_TARGET_ARCH)
+CARGO_WASM_TARGET := wasm32-unknown-unknown
 
 # If set to 1, Windows RDP client is not built.
 RDPCLIENT_SKIP_BUILD ?= 0
@@ -489,21 +489,25 @@ ifeq ("$(with_rdpclient)", "yes")
 		cargo build -p rdp-client $(if $(FIPS),--features=fips) --release --locked $(CARGO_TARGET)
 endif
 
+define ironrdp_package_json
+{
+  "name": "ironrdp",
+  "version": "0.1.0",
+  "module": "ironrdp.js",
+  "types": "ironrdp.d.ts",
+  "files": ["ironrdp_bg.wasm","ironrdp.js","ironrdp.d.ts"],
+  "sideEffects": ["./snippets/*"]
+}
+endef
+export ironrdp_package_json
+
 .PHONY: build-ironrdp-wasm
 build-ironrdp-wasm: ironrdp = web/packages/shared/libs/ironrdp
 build-ironrdp-wasm: ensure-wasm-deps
-	cargo build --package ironrdp --lib --target $(CARGO_TARGET_wasm) --release
-	wasm-opt target/$(CARGO_TARGET_wasm)/release/ironrdp.wasm -o target/$(CARGO_TARGET_wasm)/release/ironrdp.wasm -O
-	wasm-bindgen target/$(CARGO_TARGET_wasm)/release/ironrdp.wasm --out-dir $(ironrdp)/pkg --typescript --target web
-	@echo "*" > $(ironrdp)/pkg/.gitignore
-	@printf '%s\n' '{' \
-	' "name": "ironrdp",' \
-	' "version": "0.1.0",' \
-	' "module": "ironrdp.js",' \
-	' "types": "ironrdp.d.ts",' \
-	' "files": ["ironrdp_bg.wasm","ironrdp.js","ironrdp.d.ts"],' \
-	' "sideEffects": ["./snippets/*"]' \
-	'}' > $(ironrdp)/pkg/package.json
+	cargo build --package ironrdp --lib --target $(CARGO_WASM_TARGET) --release
+	wasm-opt target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm -o target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm -O
+	wasm-bindgen target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm --out-dir $(ironrdp)/pkg --typescript --target web
+	printenv ironrdp_package_json > $(ironrdp)/pkg/package.json
 
 # Build libfido2 and dependencies for MacOS. Uses exported C_ARCH variable defined earlier.
 .PHONY: build-fido2
@@ -1899,13 +1903,14 @@ ensure-wasm-deps:
 else
 ensure-wasm-deps: ensure-wasm-bindgen ensure-wasm-opt rustup-install-wasm-toolchain
 
-# Get the version of wasm-bindgen from cargo
-WASM_BINDGEN_VERSION = $(shell cargo pkgid --package ironrdp wasm-bindgen 2>/dev/null | cut -d '@' -f 2)
+WASM_BINDGEN_VERSION = $(shell awk ' \
+  $$1 == "name" && $$3 == "\"wasm-bindgen\"" { in_pkg=1; next } \
+  in_pkg && $$1 == "version" { gsub(/"/, "", $$3); print $$3; exit } \
+' Cargo.lock)
 
 .PHONY: print-wasm-bindgen-version
-print-wasm-bindgen-version: NEED_VERSION = $(WASM_BINDGEN_VERSION)
 print-wasm-bindgen-version:
-	@echo $(NEED_VERSION)
+	@echo $(WASM_BINDGEN_VERSION)
 
 ensure-wasm-bindgen: NEED_VERSION = $(WASM_BINDGEN_VERSION)
 ensure-wasm-bindgen: INSTALLED_VERSION = $(word 2,$(shell wasm-bindgen --version 2>/dev/null))
@@ -1956,7 +1961,7 @@ rustup-install-target-toolchain: rustup-set-version
 
 .PHONY: rustup-install-wasm-toolchain
 rustup-install-wasm-toolchain: rustup-set-version
-	rustup target add $(CARGO_TARGET_wasm)
+	rustup target add $(CARGO_WASM_TARGET)
 
 # changelog generates PR changelog between the provided base tag and the tip of
 # the specified branch.
diff --git a/build.assets/Dockerfile b/build.assets/Dockerfile
index 46abb5ec1fc87..ec83963e4a8d4 100644
--- a/build.assets/Dockerfile
+++ b/build.assets/Dockerfile
@@ -226,6 +226,11 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup target add wasm32-unknown-unknown && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu; fi
 
+ARG WASM_OPT_VERSION
+ARG WASM_BINDGEN_VERSION
+# Install wasm-bindgen-ci and wasm-opt for bulding rust webassembly module.
+RUN cargo install --locked wasm-opt@${WASM_OPT_VERSION} wasm-bindgen-cli@${WASM_BINDGEN_VERSION}
+
 # Switch back to root for the remaining instructions and keep it as the default
 # user.
 USER root
diff --git a/build.assets/Dockerfile-node b/build.assets/Dockerfile-node
index 58e68525a3be4..3aea917065e15 100644
--- a/build.assets/Dockerfile-node
+++ b/build.assets/Dockerfile-node
@@ -80,3 +80,8 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup component add rustfmt clippy && \
     rustup target add wasm32-unknown-unknown && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu; fi
+
+ARG WASM_OPT_VERSION
+ARG WASM_BINDGEN_VERSION
+# Install wasm-bindgen-ci and wasm-opt for bulding rust webassembly module.
+RUN cargo install --locked wasm-opt@${WASM_OPT_VERSION} wasm-bindgen-cli@${WASM_BINDGEN_VERSION}
diff --git a/build.assets/Makefile b/build.assets/Makefile
index ec9c570fcb9e9..d1f9e24d8b672 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -176,6 +176,8 @@ buildbox:
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg GOLANGCI_LINT_VERSION=$(GOLANGCI_LINT_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
+		--build-arg WASM_OPT_VERSION=$(WASM_OPT_VERSION) \
+		--build-arg WASM_BINDGEN_VERSION=$(WASM_BINDGEN_VERSION) \
 		--build-arg NODE_VERSION=$(NODE_VERSION) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg BUF_VERSION=$(BUF_VERSION) \
@@ -294,6 +296,8 @@ buildbox-node:
 		--build-arg GID=$(GID) \
 		--build-arg NODE_VERSION=$(NODE_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
+		--build-arg WASM_OPT_VERSION=$(WASM_OPT_VERSION) \
+		--build-arg WASM_BINDGEN_VERSION=$(WASM_BINDGEN_VERSION) \
 		--cache-to type=inline \
 		--cache-from $(BUILDBOX_NODE) \
 		$(if $(PUSH),--push,--load) \
@@ -740,6 +744,13 @@ print-rust-version:
 print-wasm-opt-version:
 	@echo $(WASM_OPT_VERSION)
 
+#
+# Print the wasm-bindgen version used to build Teleport.
+#
+.PHONY:print-wasm-bindgen-version
+print-wasm-bindgen-version:
+	@echo $(WASM_BINDGEN_VERSION)
+
 #
 # Print the Node version used to build Teleport Connect.
 #
diff --git a/build.assets/versions.mk b/build.assets/versions.mk
index 291bbc9c31801..1d58f83803612 100644
--- a/build.assets/versions.mk
+++ b/build.assets/versions.mk
@@ -12,6 +12,7 @@ NODE_VERSION ?= 22.14.0
 # Run lint-rust check locally before merging code after you bump this.
 RUST_VERSION ?= 1.81.0
 WASM_OPT_VERSION ?= 0.116.1
+WASM_BINDGEN_VERSION ?= $(shell $(MAKE) -C .. --no-print-directory  print-wasm-bindgen-version)
 LIBBPF_VERSION ?= 1.2.2
 LIBPCSCLITE_VERSION ?= 1.9.9-teleport
 

From 2a587620d420e717372f98f620034d411622dbf8 Mon Sep 17 00:00:00 2001
From: Ryan Hammonds <ryan.hammonds@goteleport.com>
Date: Wed, 10 Sep 2025 10:33:55 -0400
Subject: [PATCH 3/4] Move 'WASM_BINDGEN_VERSION' definition out of versions.mk

---
 build.assets/Makefile    | 4 ++++
 build.assets/versions.mk | 1 -
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/build.assets/Makefile b/build.assets/Makefile
index d1f9e24d8b672..61c0162fec07f 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -56,6 +56,10 @@ endif
 # $(ARCH) is the target architecture we want to build for.
 REQUIRE_HOST_ARCH = $(if $(filter-out $(ARCH),$(RUNTIME_ARCH)),$(error Cannot cross-compile $@ $(ARCH) on $(RUNTIME_ARCH)))
 
+# Determine which version of wasm-bindgen should be installed on build containers
+# responsible for building webassets.
+WASM_BINDGEN_VERSION ?= $(shell $(MAKE) -C .. --no-print-directory  print-wasm-bindgen-version)
+
 # This determines which make target we call in this repo's top level Makefile when
 # make release in this Makefile is called. Currently this supports its default value
 # (release) and release-unix-preserving-webassets. See the release-arm target for
diff --git a/build.assets/versions.mk b/build.assets/versions.mk
index 1d58f83803612..291bbc9c31801 100644
--- a/build.assets/versions.mk
+++ b/build.assets/versions.mk
@@ -12,7 +12,6 @@ NODE_VERSION ?= 22.14.0
 # Run lint-rust check locally before merging code after you bump this.
 RUST_VERSION ?= 1.81.0
 WASM_OPT_VERSION ?= 0.116.1
-WASM_BINDGEN_VERSION ?= $(shell $(MAKE) -C .. --no-print-directory  print-wasm-bindgen-version)
 LIBBPF_VERSION ?= 1.2.2
 LIBPCSCLITE_VERSION ?= 1.9.9-teleport
 

From e7f4f8b5ce2c960472d399b88e0092ed6c4bb7bd Mon Sep 17 00:00:00 2001
From: Ryan Hammonds <ryan.hammonds@goteleport.com>
Date: Thu, 11 Sep 2025 13:21:26 -0400
Subject: [PATCH 4/4] Pass '--locked' flag to wasm-opt install

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index d95cbf652f82d..a3ac400c13250 100644
--- a/Makefile
+++ b/Makefile
@@ -1932,7 +1932,7 @@ endif
 .PHONY: ensure-wasm-opt
 ensure-wasm-opt: WASM_OPT_VERSION := $(shell $(MAKE) --no-print-directory -C build.assets print-wasm-opt-version)
 ensure-wasm-opt:
-	cargo install wasm-opt@$(WASM_OPT_VERSION)
+	cargo install --locked wasm-opt@$(WASM_OPT_VERSION)
 
 .PHONY: build-ui
 build-ui: ensure-js-deps ensure-wasm-deps