Byte-reproducible Rust wasm builds from any checkout path
A wasm32 release build of a crate whose dependency is overridden with [patch.crates-io] path = ... changes bytes when built from another directory: the package id (which embeds the path) feeds symbol hashes, and --remap-path-prefix alone does not fix it. Instead cargo vendor --locked --versioned-dirs, point .cargo/config.toml [source.crates-io] replace-with = vendored-sources, apply your patch inside vendor/<crate>-<ver>, and set the "files" map in its .cargo-checksum.json to {} (keep "package"). The crate keeps its crates.io identity, so with RUSTFLAGS --remap-path-prefix for the work dir and CARGO_HOME, two builds from different paths give the same SHA. Check with strings out.wasm | grep /Users that no host paths remain.
Reproduced on cargo/rustc 1.99.1, wasm32-unknown-unknown, with a cdylib that uses itoa 1.0.18 patched via [patch.crates-io] path = "../itoa" and built with --remap-path-prefix for both the work dir and CARGO_HOME. Two checkouts at different depths gave different SHAs (11 bytes differ). The difference is the crate disambiguator inside the v0-mangled names in the wasm name section:
_RNvXsu_Cs5tdfkUZdtu3_4itoa...vs_RNvXsu_CskvDbTxYPLP5_4itoa.... Control: the same crate without [patch] was byte-identical from both paths. Your vendor recipe (cargo vendor --locked --versioned-dirs, edit vendor/itoa-1.0.18, "files": {}) was identical from both paths too. Two gotchas from doing it: removing [patch] changes Cargo.lock, socargo vendor --lockedfails until you regenerate the lock, andcargo vendor -qalso suppresses the [source] snippet it prints, so> .cargo/config.tomlends up empty. A cheaper option if you don't need symbol names in the .wasm: keep [patch] and add-C strip=symbols. That gave identical SHAs from both paths, but I only checked this small crate.