From 3b5a8e82ab1322d0f90388391e0a27dc279b4d35 Mon Sep 17 00:00:00 2001 From: "Daniel A. Wozniak" Date: Mon, 3 Aug 2026 23:16:31 -0700 Subject: [PATCH] Allow libyaml-linked PyYAML wheel in Linux onedir builds The Linux onedir build passes ``--no-binary=:all:`` to pip so every runtime dependency is compiled against the relenv toolchain and linked against the vendored openssl/krb5/etc. PyYAML's setup.py autodetects libyaml at compile time; because the relenv toolchain does not build or ship libyaml, the source build silently falls back to a pure-Python parser and the resulting onedir has no ``yaml.CSafeLoader`` and no ``_yaml.so`` extension. Salt's ``yamlloader`` uses ``getattr(yaml, "CSafeLoader", yaml.SafeLoader)`` so it does not crash, but every YAML load (configs, pillars, states, returners, mine, event bus, etc.) runs through the pure-Python parser, which is 10-20x slower. Users with segmented configs have reported ``salt-run salt.cmd test.ping`` taking ~20s where a libyaml-linked build completes in well under a second. Add ``pyyaml`` to the Linux ``--only-binary`` allow-list so pip uses PyYAML's manylinux2014 wheel, which bundles libyaml (MIT-licensed) and targets glibc 2.17+ (compatible with every relenv Linux target). This mirrors the existing precedent for ``maturin``, ``cassandra-driver``, ``hatchling``, ``cmake``, ``ninja``, and ``protobuf``. Fixes #69907 --- changelog/69907.fixed.md | 5 +++++ tools/pkg/build.py | 10 +++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 changelog/69907.fixed.md diff --git a/changelog/69907.fixed.md b/changelog/69907.fixed.md new file mode 100644 index 000000000000..36df6f8c2dea --- /dev/null +++ b/changelog/69907.fixed.md @@ -0,0 +1,5 @@ +Include PyYAML manylinux wheel in Linux onedir builds so ``yaml.CSafeLoader`` +(and the libyaml-backed emitter) are available. Previously the ``--no-binary=:all:`` +pip invocation forced a PyYAML source build under the relenv toolchain, which +lacks libyaml headers; PyYAML silently fell back to the pure-Python parser, +significantly slowing config, pillar, and state parsing on large deployments. diff --git a/tools/pkg/build.py b/tools/pkg/build.py index 3a68ca812c73..58d5a318b2fb 100644 --- a/tools/pkg/build.py +++ b/tools/pkg/build.py @@ -699,8 +699,16 @@ def onedir_dependencies( env["RELENV_BUILDENV"] = "1" python_bin = env_scripts_dir / "python3" install_args.append("--no-binary=:all:") + # PyYAML's source build silently falls back to the pure-Python parser + # when libyaml headers are absent, and the relenv toolchain does not + # ship libyaml. That produces an onedir where yaml.CSafeLoader is + # missing, which makes salt fall back to the pure-Python SafeLoader + # and can slow config/pillar/state parsing by an order of magnitude + # on large deployments. The upstream PyYAML manylinux2014 wheel + # bundles libyaml (MIT-licensed) and is compatible with the relenv + # target platform, so allow it through --no-binary=:all: here. install_args.append( - "--only-binary=maturin,apache-libcloud,pymssql,cassandra-driver,hatchling,cmake,ninja,protobuf" + "--only-binary=maturin,apache-libcloud,pymssql,cassandra-driver,hatchling,cmake,ninja,protobuf,pyyaml" ) # CMake 4.x removed support for cmake_minimum_required(VERSION < 3.5). # pyzmq's bundled libzmq still declares an older floor; set the policy