Skip to content

ciris-verify: Add version 20.1.0 - #3103

Draft
luhenry wants to merge 2 commits into
mainfrom
ciris-verify
Draft

luhenry wants to merge 2 commits into
mainfrom
ciris-verify

Conversation

@luhenry

@luhenry luhenry commented Oct 13, 2026 •

Copy link
Copy Markdown
Member

Compiles the Rust libciris_verify_ffi.so (loaded via ctypes) and the ciris-build-sign/ciris-build-verify CLIs into a py3-none platform wheel. Upstream publishes no riscv64 wheel.

Mirrors the Linux legs of upstream's release.yml.

Differs from upstream

  • Built natively in the manylinux_2_39_riscv64 image instead of on ubuntu-latest / with cross
  • dnf install sqlite-devel - rusqlite links the system libsqlite3, as upstream's libtss2-dev libsqlite3-dev install
  • Same features as upstream's aarch64 leg: no bundled TPM plugin
  • Retagged with wheel tags instead of renaming the wheel file
  • Adds the repo-root LICENSE to the wheel

Testing

  • upstream's bindings/python/tests (with CIRIS_VERIFY_LIVE_TESTS=1) plus post-release-verify's version round-trip, on each interpreter
  • deselected test_capability_check_licensed and test_walk_succeeds_registry_returns_404 - both fail identically on upstream's x86_64 wheel

License: Wheel ships upstream's AGPL-3.0-or-later code; upstream's wheels carry no licence text, so the build adds it.

Build the Rust FFI library and the ciris-build-{sign,verify} binaries
natively in the manylinux_2_39_riscv64 image, mirroring the
aarch64-unknown-linux-gnu legs of upstream's release.yml, and package them
into upstream's py3-none platform wheel. Test the wheel on every
interpreter with upstream's Python test suite and post-release smoke
checks.
luhenry added a commit that referenced this pull request Oct 13, 2026
test_init_rss_within_budget compares the whole pytest process's RSS against
a fixed 64 MB. A free-threaded interpreter exceeds it regardless of
architecture (71 MB on riscv64, 75 MB with upstream's own x86_64 wheel,
against 62 MB on cp314), and upstream only runs the suite on 3.11/3.12.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant