Repository navigation
Conversation
nassl statically links its own from-source OpenSSL (a legacy OpenSSL_1_0_2e build and a modern OpenSSL_1_1_1w build) and zlib rather than the system libraries, selected per-platform in build_config.py. That file has no riscv64 branch at all: its 64-bit Linux detection only special-cases aarch64, so riscv64 silently fell through to the x86_64 target. Patch build_config.py to add a riscv64 platform: the modern build uses OpenSSL's own "linux64-riscv64" Configure target (1.1.1w carries no riscv64 assembly at all, added only in the 3.x series, so this is a plain portable-C build with none of the large-shared-object asm relocation pitfalls a newer OpenSSL's riscv64 asm can hit); the legacy build's pinned 1.0.2e predates riscv64 entirely and falls back to "linux-generic64", mirroring how it already special-cases OSX_ARM64 two lines above. Workflow mirrors upstream's own build_wheels.yml/build_wheels_linux_aarch64.yml (cibuildwheel driving invoke's build.deps/build.nassl tasks), narrowed to riscv64, with one extra CIBW_BEFORE_ALL_LINUX step installing the riscv64 manylinux image's full perl package (its minimal perl-interpreter lacks FindBin/lib, which OpenSSL's Configure needs). Matrix is cp310..cp314, matching upstream's own non-abi3 wheel set; no cp314t, which upstream does not build either.
luhenry
added a commit
that referenced
this pull request
Oct 5, 2026
Contributor
|
CI run https://github.com/riseproject-dev/python-wheels/actions/runs/37336888859 was red on 3 of 5 interpreter legs, from two independent, non-riscv64 causes: - cp313/cp314 both failed tests/cert_chain_verifier_test.py::test_valid_certificate_chain with OpenSSL error 20 ("unable to get local issuer certificate"). That test fetches www.github.com's live leaf cert at test time and hardcodes a 2018-era Sectigo intermediate to chain it against tests/mozilla.pem; GitHub's real issuing CA has since rotated (now "Sectigo Public Server Authentication CA DV E36"), so the hardcoded intermediate no longer matches the live leaf's issuer on any platform today, not just riscv64. No newer upstream release fixes this past the 5.4.0 tag, and nassl's Kali Linux packaging has hit the same test break before (error 10 instead of 20, same live-fetch-vs-hardcoded-cert root cause). Pinning today's correct intermediate would only move the next CA rotation's break further out, so skip the test instead (0002). - cp311 timed out (~1018s) and cp310/cp312 hung to the 90-minute job ceiling, all fetching the same https://www.zlib.net/fossils/zlib-1.2.13.tar.gz within the same few seconds, while cp313/cp314 fetched it in seconds -- a thundering-herd/ under-provisioned-server pattern on zlib.net's CDN-less legacy archive, not a one-off single-job flake. Fetch zlib from GitHub's tag archive instead (0003), which this same file already does for OpenSSL, carries the identical tree, and needs no src_path change (GitHub's vX.Y.Z-tag archive already extracts to zlib-1.2.13, same convention build-cvxopt.yml already relies on for SuiteSparse). Both patches verified to apply together, in sequence, against a clean 5.4.0 checkout.
luhenry
added a commit
that referenced
this pull request
Oct 5, 2026
Both failures in PR #2729's first riscv64 CI run were non-riscv64-specific: a stale hardcoded CA intermediate in nassl's own cert-chain test (GitHub has rotated its issuing CA since the test was written), and zlib.net's CDN-less fossils archive choking under this CI matrix's simultaneous fetches. Notes updated with the full root-cause evidence; CI re-run queued, not yet green.
luhenry
marked this pull request as ready for review
October 5, 2026 19:13
luhenry
added a commit
that referenced
this pull request
Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
nassl5.4.0Compiles nassl's C extension against its own statically-linked, from-source OpenSSL (a legacy OpenSSL_1_0_2e build and a modern OpenSSL_1_1_1w build) and zlib. Upstream publishes no riscv64 wheel.
Mirrors upstream's
build_wheels.yml.Differs from upstream
CIBW_BEFORE_ALL_LINUXinstalls the fullperlpackage - the riscv64 image's minimal perl lacks FindBin/lib, which OpenSSL's Configure needs.Matrix: cp310-cp314, matching upstream's own non-abi3 wheel set; no cp314t, which upstream does not build either.
Testing
License: OK
Patches
0001-build_config-add-a-riscv64-target.patch- To upstream. Without it,build_config.py's platform detection has no riscv64 branch and silently targets OpenSSL's Configure atlinux-x86_64. Reproduces off riscv64 (verified by monkeypatchingplatform.machine()).CI pending.