From ebde0797e58895edee2ae7077cb4657527b03728 Mon Sep 17 00:00:00 2001 From: Tobias Oberstein Date: Tue, 16 Jun 2026 14:15:48 +0200 Subject: [PATCH 1/2] start new dev branch; add audit file --- .audit/oberstet_fix_1859.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 .audit/oberstet_fix_1859.md diff --git a/.audit/oberstet_fix_1859.md b/.audit/oberstet_fix_1859.md new file mode 100644 index 000000000..87b545d3c --- /dev/null +++ b/.audit/oberstet_fix_1859.md @@ -0,0 +1,8 @@ +- [ ] I did **not** use any AI-assistance tools to help create this pull request. +- [x] I **did** use AI-assistance tools to *help* create this pull request. +- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request. + +Submitted by: @oberstet +Date: 2026-06-16 +Related issue(s): #1859 +Branch: oberstet:1859 From c6f15fe819c4e677263c441e93e08860b495dbeb Mon Sep 17 00:00:00 2001 From: Tobias Oberstein Date: Tue, 16 Jun 2026 14:30:17 +0200 Subject: [PATCH 2/2] Fail build-all loudly; cap cbor2 <6 on PyPy/Windows only (#1859) The post-merge 26.6.1 dev release failed strict fileset validation with a missing pypy311-win-amd64 wheel. Two defects: 1. build-all (justfile) swallowed per-interpreter build failures: a failing 'just build ' did not fail the recipe (no set -e; the loop ended in 'ls'), so the Windows wheels job went green while silently omitting a wheel. Now build-all attempts all interpreters but exits non-zero if any failed, naming them - the same false-green class as #1856 / zlmdb#116. 2. The PyPy/Windows build aborted installing the core dependency cbor2: cbor2 6.x is Rust/pyo3-only (no PyPy/Windows wheel, and the pure-Python fallback + CBOR2_BUILD_C_EXTENSION toggle were removed in the 6.0 rewrite), so pip built from sdist and the pyo3 link failed (unresolved PyPyModule_FromDefAndSpec2, a known pyo3-on-PyPy/Windows limitation). Cap cbor2 < 6 *only* on PyPy/Windows via environment markers - the 5.x line ships a pure-Python wheel and runs at near-native speed on PyPy - while keeping cbor2 6.x everywhere else. PyPy/Windows is kept as a build target and a required release artifact; the native NVX build is attempted there (it was never reached before, since cbor2 aborted first). If NVX itself turns out not to compile on PyPy/Windows, the now-loud build-all will surface it and we retreat to excluding PyPy/Windows. Note: This work was completed with AI assistance (Claude Code). --- docs/changelog.rst | 2 ++ justfile | 16 +++++++++++++++- pyproject.toml | 7 ++++++- 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/docs/changelog.rst b/docs/changelog.rst index 4f4cc8b0f..b0cc8727e 100644 --- a/docs/changelog.rst +++ b/docs/changelog.rst @@ -29,6 +29,8 @@ Changelog * Bump the ``.cicd`` (wamp-cicd) submodule to pick up the script/shell-injection fix in the shared ``identifiers.yml`` reusable workflow (untrusted GitHub event fields are now passed via ``env:`` as quoted data with a fail-closed branch-name allowlist) (#1856) * Fail wheel builds hard when NVX was requested (``AUTOBAHN_USE_NVX``) but the CFFI extension did not compile, instead of silently degrading to a pure-Python (``py3-none-any``) wheel. A transient native-compile crash (e.g. a ``gcc`` SIGSEGV under QEMU ARM64 emulation) now aborts the build with a non-zero exit so CI can retry it, rather than uploading a structurally valid but unintended artifact. Building with ``AUTOBAHN_USE_NVX=0`` still produces a pure-Python wheel as before (#1856) * Fix NVX native-extension builds breaking under cross-compilation (e.g. Buildroot/Yocto for aarch64), where the cross toolchain rejected the host-only ``-march=native`` flag (``unknown value 'native' for '-march'``). The default architecture target is now the portable baseline for *all* build contexts (wheels, local source installs, and cross-compilation), with ``-march=native`` available opt-in via ``AUTOBAHN_ARCH_TARGET=native``. The target architecture is detected via ``sysconfig.get_platform()`` so the correct baseline is chosen when cross-compiling. Thanks to @jameshilliard for the original report and approach (#1834, #1835) +* Fail the ``just build-all`` recipe (non-zero exit) when any per-interpreter wheel build fails, naming the interpreter(s). Previously a failed build was silently swallowed, producing a green wheels job with a missing wheel that was only caught downstream by strict release fileset validation (#1859) +* Cap ``cbor2 < 6`` on PyPy/Windows only (via environment markers), keeping ``cbor2`` 6.x everywhere else. ``cbor2`` 6.x is Rust/pyo3-only with no PyPy/Windows wheel and no pure-Python fallback, so it cannot be installed on PyPy/Windows; the 5.x line ships a pure-Python wheel (and runs at near-native speed on PyPy). This unblocks building and installing autobahn on PyPy/Windows (#1859) 25.12.2 ------- diff --git a/justfile b/justfile index 3eb233c2a..d8d6d08cd 100644 --- a/justfile +++ b/justfile @@ -1635,10 +1635,24 @@ build-sourcedist venv="": (install-build-tools venv) # Meta-recipe to run `build` on all environments build-all: #!/usr/bin/env bash + # Build a wheel for every interpreter in ENVS. Attempt ALL interpreters (do + # not stop at the first failure, so the report is complete), but FAIL the + # recipe with a non-zero exit if any single build failed, naming them. A + # silently swallowed per-interpreter failure here previously produced a green + # job with a missing wheel, only caught downstream by release fileset + # validation (#1859). + set -uo pipefail + failed=() for venv in {{ENVS}}; do - just build ${venv} + if ! just build "${venv}"; then + failed+=("${venv}") + fi done ls -la dist/ + if [ "${#failed[@]}" -ne 0 ]; then + echo "ERROR: wheel build failed for interpreter(s): ${failed[*]}" >&2 + exit 1 + fi # Clean build artifacts clean-build: diff --git a/pyproject.toml b/pyproject.toml index 07ce47f77..809d93aec 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -51,7 +51,12 @@ dependencies = [ "msgpack>=1.0.2; platform_python_implementation == 'CPython'", "u-msgpack-python>=2.1; platform_python_implementation != 'CPython'", "ujson>=4.0.2", # Binary wheels for both CPython and PyPy - "cbor2>=5.2.0", # Binary wheels + pure Python fallback + # cbor2 6.x is Rust/pyo3-only: no PyPy/Windows wheel and no pure-Python + # fallback, so it cannot be installed on PyPy/Windows. Cap < 6 there (the 5.x + # line ships a pure-Python wheel and runs at near-native speed on PyPy), + # while using cbor2 6.x everywhere else. See #1859. + "cbor2>=5.2.0; platform_python_implementation != 'PyPy' or sys_platform != 'win32'", + "cbor2>=5.2.0,<6; platform_python_implementation == 'PyPy' and sys_platform == 'win32'", # NOTE: the WAMP "ubjson" serializer (bjdata) is an OPTIONAL extra, NOT a base # dependency: bjdata pulls in numpy, which we don't want in a minimal install. # See the [serialization] extra below. This also fixes #1849 (the old, wheel-less