From bbe0d610c422064fc83bf6a76a5fdfe86f069ea6 Mon Sep 17 00:00:00 2001 From: Ludovic Henry Date: Thu, 15 Oct 2026 15:57:51 +0000 Subject: [PATCH 1/2] Add riscv64 build for pykcs11 PyKCS11 1.5.20 is a SWIG-generated C++ PKCS#11 wrapper (ck_attribute_smart.cpp, pkcs11lib.cpp) that dlopen()s the PKCS#11 module at runtime, so the build links no external library at all. PyPI publishes manylinux x86_64/musllinux x86_64, macOS and Windows wheels for 1.5.20 but no Linux aarch64 and no riscv64 - a real, narrow gap. Mirrors upstream's own linux.yml cibuildwheel job (CIBW_BUILD cp39-cp314t) narrowed to manylinux_riscv64; swig (the only build dependency besides a C++ compiler) resolves from Rocky 10's own riscv64 repos, no EPEL needed. --- .github/workflows/build-pykcs11.yml | 119 ++++++++++++++++++++++++++++ docs/packages/pykcs11.yaml | 5 ++ 2 files changed, 124 insertions(+) create mode 100644 .github/workflows/build-pykcs11.yml create mode 100644 docs/packages/pykcs11.yaml diff --git a/.github/workflows/build-pykcs11.yml b/.github/workflows/build-pykcs11.yml new file mode 100644 index 000000000000..1a08b90facad --- /dev/null +++ b/.github/workflows/build-pykcs11.yml @@ -0,0 +1,119 @@ +# SPDX-FileCopyrightText: 2026 The RISE Project +# SPDX-License-Identifier: MIT +--- +# This workflow is based on: https://github.com/LudovicRousseau/PyKCS11/blob/1.5.20/.github/workflows/linux.yml +name: Build pykcs11 wheels (riscv64) + +on: + workflow_dispatch: + inputs: + version: + description: 'Version glob to (re)build; empty builds every version of docs/packages/pykcs11.yaml not released yet' + required: false + default: '' + pull_request: + branches: [main] + paths: + - '.github/workflows/build-pykcs11.yml' + - 'docs/packages/pykcs11.yaml' + push: + branches: [main] + paths: + - '.github/workflows/build-pykcs11.yml' + - 'docs/packages/pykcs11.yaml' + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +permissions: + contents: read # to fetch code (actions/checkout) + +env: + MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64 + +jobs: + setup: + uses: $/.github/workflows/_setup.yml + with: + package: pykcs11 + version: ${{ inputs.version }} + + build_wheels: + needs: [setup] + if: needs.setup.outputs.versions != '[]' + name: Build pykcs11 ${{ matrix.version }} ${{ matrix.python }}-manylinux_riscv64 + runs-on: ubuntu-24.04-riscv + timeout-minutes: 60 + strategy: + fail-fast: false + matrix: + version: ${{ fromJSON(needs.setup.outputs.versions) }} + python: + - "cp39" + - "cp310" + - "cp311" + - "cp312" + - "cp313" + - "cp314" + - "cp314t" + + env: + PYKCS11_VERSION: ${{ matrix.version }} + + steps: + - name: Checkout pykcs11 ${{ env.PYKCS11_VERSION }} + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: LudovicRousseau/PyKCS11 + ref: ${{ env.PYKCS11_VERSION }} + persist-credentials: false + + - name: Build wheels + uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074 # v4.2.0 + with: + output-dir: wheelhouse/ + only: ${{ matrix.python }}-manylinux_riscv64 + env: + CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }} + # swig is required to generate the _LowLevel C++ extension (setup.py's + # build_py checks `which("swig")`); it's a build-time code generator + # only, not linked into the wheel, and resolves from Rocky 10's own + # repos on riscv64 (no EPEL needed, gotcha 51). + CIBW_BEFORE_ALL_LINUX: dnf -y install swig + # PyKCS11 dlopen()s a PKCS#11 module (e.g. a hardware token driver or + # SoftHSM2) at runtime via a user-supplied path; no such module is + # available in the manylinux container, so the smoke test is limited + # to proving the SWIG-generated extension itself loads and runs real + # C++ code, the same depth as upstream's own tox/coverage runs would + # need a live PKCS#11 module to go further. + CIBW_TEST_COMMAND: >- + python -c " + import PyKCS11, PyKCS11.LowLevel; + lib = PyKCS11.PyKCS11Lib(); + assert isinstance(lib, PyKCS11.PyKCS11Lib); + PyKCS11.LowLevel.CK_ATTRIBUTE() + " + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: pykcs11-${{ env.PYKCS11_VERSION }}-${{ matrix.python }}-manylinux_riscv64 + path: wheelhouse/*.whl + if-no-files-found: error + + publish: + name: Publish pykcs11 ${{ matrix.version }} + needs: [setup, build_wheels] + if: needs.setup.outputs.versions != '[]' + strategy: + fail-fast: false + matrix: + version: ${{ fromJSON(needs.setup.outputs.versions) }} + permissions: + contents: write + pull-requests: write + uses: $/.github/workflows/_publish-wheel.yml + secrets: + app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }} + with: + artifact-pattern: pykcs11-${{ matrix.version }}-*-manylinux_riscv64 diff --git a/docs/packages/pykcs11.yaml b/docs/packages/pykcs11.yaml new file mode 100644 index 000000000000..2c8d3c507f0c --- /dev/null +++ b/docs/packages/pykcs11.yaml @@ -0,0 +1,5 @@ +package-name: pykcs11 +source-code: https://github.com/LudovicRousseau/PyKCS11 +license: GPL-2.0-or-later +versions: +- version: 1.5.20 From 3bf041405b76935713d91be2ab8392779a4c969e Mon Sep 17 00:00:00 2001 From: Ludovic Henry Date: Sun, 25 Oct 2026 18:03:39 +0000 Subject: [PATCH 2/2] pykcs11: fix CIBW_TEST_COMMAND leading-space IndentationError The folded CIBW_TEST_COMMAND scalar put a leading space before 'import' on python -c's first line (python -c " import ..."), which Python rejects as an IndentationError on every riscv64 build leg. Start the quoted code right after the opening quote so the folded command has no leading whitespace. --- .github/workflows/build-pykcs11.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-pykcs11.yml b/.github/workflows/build-pykcs11.yml index 1a08b90facad..10edec2438ce 100644 --- a/.github/workflows/build-pykcs11.yml +++ b/.github/workflows/build-pykcs11.yml @@ -88,12 +88,10 @@ jobs: # C++ code, the same depth as upstream's own tox/coverage runs would # need a live PKCS#11 module to go further. CIBW_TEST_COMMAND: >- - python -c " - import PyKCS11, PyKCS11.LowLevel; + python -c "import PyKCS11, PyKCS11.LowLevel; lib = PyKCS11.PyKCS11Lib(); assert isinstance(lib, PyKCS11.PyKCS11Lib); - PyKCS11.LowLevel.CK_ATTRIBUTE() - " + PyKCS11.LowLevel.CK_ATTRIBUTE()" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: