[kixelated]

Problem

The musl x86_64/aarch64 and glibc armv7 wheels are uploaded without being imported or tested.

Approach

• Run unit tests, Wycheproof, and mypy stubtest before uploading each of these wheels.
• Test musl with native python:3.11-alpine containers on the matching runners.
• Test armv7 with python:3.11-slim-bookworm under qemu-user, explicitly selecting Cortex-A15. Assert armv7, 32-bit pointers, NEON, and no hardware AES. This exercises rind's NEON paths and portable AES, GHASH, SHA1, and SHA256.
• Skip only pyca-dependent comparisons on armv7 through PYRIND_TEST_PYCA=0; the independent API tests still run. The workflow remains nightly, on demand, and release-only.
• Make oversized HKDF/PBKDF2 test inputs and expected errors portable to 32-bit Python; no binding behavior changes.
• Remove the finished quest and its index link.

Choices

• Current cryptography PyPI metadata includes an armv7 wheel, but its cffi dependency has none. Binary-only resolution fails for that dependency. Both musl targets resolve the full dependency set. The armv7 skip follows the quest's existing decision.
• Keep binary-only dependency installation. On armv7 pip selects mypy 1.18.2, whose dependencies have compatible wheels; no package needs a source build.
• Use Cortex-A15 to select a supported, explicit armv7 CPU tier, following the existing armv7 test script.

Impact

• No public API or wire change.
• Wheel upload now requires these targets' test suites to pass.

Validation

• nix develop -c quest gate just check and nix develop -c quest gate just ci: pass, including all 61 Python tests and stubtest's 20 modules.
• Explicit PYRIND_TEST_PYCA=0 run: pass, 61 tests with exactly 10 pyca comparisons skipped.
• Stubtest using armv7's resolved pure-Python mypy 1.18.2 on the local wheel: pass, 20 modules.
• Binary-only pip downloads: both musl targets resolve cryptography, mypy, and dependencies; armv7 resolves mypy and dependencies. Cryptography on armv7 fails because cffi has no compatible wheel.
• Container execution could not run locally: the installed Docker wrapper fails with /opt/podman/bin/podman: No such file or directory. The new target executions have not been observed locally.
• After merging origin/main (conflict-free) at 5276965: nix develop -c quest gate just check passes, including 61 Python tests and stubtest's 20 modules.
• Dispatched python.yml on this branch to observe the new musl and armv7 container test steps.

Alternatives

• Build pyca dependencies on armv7: rejected by the quest's decision to skip unavailable pyca comparisons.
• Skip the entire API test module, as Windows on Arm currently does: would discard independent unit tests too.

Caused by

• moq-dev/rind#459 - introduced these wheel builds without target test steps.

Follow-ups

None.

Models

Size: S
Implementer: Codex, gpt-6.1-sol, xhigh effort

Review

Rewritten by quest review after each round.

• Reviewer: Claude Code, claude-opus-5-5, low effort
• Session: 7eeb189d-48fc-4e18-a00a-25b39256a4c8, round 1
• Head: 5276965
• Base: origin/main at ea5e690
• Score: 8/10, I found no correctness bug in the CI and quest changes, and the new container test steps look sound, but I haven't confirmed that the armv7 run under qemu works in CI.
• Findings: none

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a35060cc-d76b-4eba-ae47-f71cdafa2300

Commits

Reviewing files that changed from the base of the PR and between ea5e690 and 5276965.

Files selected for processing: 4

• .github/workflows/python.yml
• quest/m2/adoption/README.md
• quest/m2/adoption/pyrind-wheel-tests.md
• rind-python/tests/test_api.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pullfrog]

✅ No new issues found.

Reviewed changes — the full 4-file diff at the head commit, plus the dispatched python.yml run's logs for the three new targets.

• Container test steps for the musl and armv7 wheels — python.yml gains a docker-based "Test in container" step (native python:3.11-alpine for both musl targets; python:3.11-slim-bookworm under qemu-user with QEMU_CPU=cortex-a15 for armv7) that installs mypy and optional pyca plus the built wheel, asserts armv7l/32-bit pointers/NEON/no AES hardware, then runs the unit tests and stubtest before upload. The host "Test" step is correctly gated off with !matrix.container, and the qemu-user-static install lands behind matrix.cpu, so the musl jobs never pay for it.
• PYRIND_TEST_PYCA opt-out — test_api.py imports pyca only when the env var isn't "0", decorates the ten pyca-comparison tests with requires_pyca, and guards the one mixed assertion inline; the Aead class-level pyca map moves into its test so the module still imports without pyca. Grep confirms every pyca usage sits behind one of those guards, and only test_api.py (not test_wycheproof.py/test_readme.py) imports pyca, so the independent suites run unskipped on armv7.
• 32-bit portability — the oversized HKDF/PBKDF2 lengths now use sys.maxsize and expect OverflowError past usize on 32-bit hosts. Both match the actual bindings: rind-python/src/hkdf.rs takes len: usize and rejects > 255 * 64 with WrongLength on either word size, and rind-python/src/pbkdf2.rs takes length: usize, so the too-long PBKDF2 lengths fail at conversion exactly as the test now expects.
• Quest bookkeeping — deletes quest/m2/adoption/pyrind-wheel-tests.md and its README bullet; no references to the slug remain anywhere in the tree.

Verification beyond the diff: the dispatched run on this branch is green on all three new targets. The armv7 job log shows qemu-user-static installing, pip walking mypy down to the pure-Python mypy-1.18.2 wheel, the armv7 wheel installing, the armv7 Cortex-A15: NEON, no crypto extension assertion line printing, Ran 61 tests … OK (skipped=10), and Success: no issues found in 20 modules from stubtest. The PyPI claims check out too (cffi 2.1.0 ships no linux_armv7l wheel; both musl targets resolve cryptography and mypy binary-only), and the cortex-a15 tier and HWCAP_NEON (1 << 12) assertion agree with sh/armv7.sh and rind/src/low/arm/cpu.rs.

  ^{｜ View workflow run ｜ Using glm-5.3 ｜ 𝕏}