CFFI Release Management

[Matt Davis]

Hi all,

In response to Armin's requests for help with release management, a couple of us from the Ansible team at Red Hat have volunteered to handle these duties for the project going forward. CFFI isn't a direct dependency of Ansible, but Python cryptography is, and it uses CFFI heavily. Keeping these projects wheel-installable for common platforms is important to our community (and the broader Python community), so we're willing to spend some effort toward that goal, as we have for other projects.

I'll be taking on the primary release management duties, with Matt Clay as my backup. Our involvement is planned to be limited to that scope- we're not planning to do general maintainership on the project. Armin's still in charge and managing the project's codebase.

To preemptively answer a few expected questions:

- How often will releases occur?

We'll work with Armin and the community to determine when new releases need to occur- usually when an important bugfix is made, or when support is being added for a new platform or Python version that requires a new release.

- Since you guys work for Red Hat, does this mean you're only publishing for Linux?

Absolutely not- we're used to supporting lots of platforms, and CFFI will continue supporting what it has in the past.

- What about M1 Mac wheels?

Python support for MacOS universal2 wheels (x86_64 + aarch64) is maturing rapidly, and we've already got builds working locally on M1 hardware. However, due to the current lack of virtual MacOS guest support on M1, it's difficult to securely provide CI/build services for M1 today. We're watching developments in this area carefully, and when it becomes feasible to provide proper automated CI/build support for M1 (including automated testing on M1 hardware), we'll consider shipping wheels for it.

Thanks to Armin and the rest of the CFFI community for all the work that's gone into the project over the years- we're looking forward to keeping it easily accessible for many years to come!

-Matt Davis (m...@redhat.com) and Matt Clay (mc...@redhat.com)

[Erik Gomez]

Thanks for picking this up Matt!

For what it's worth, M1 CI Macs are not needed to successfully build universal2 python modules. I and a few others in the macadmin community were able to solve a few issues and successfully build cffi in a build service on GitHub. I don't want to spam that repository so will withhold that info for now. 

Thanks,

Erik Gomez

---

From: pytho...@googlegroups.com <pytho...@googlegroups.com> on behalf of Matt Davis <matt...@redhat.com>
Sent: Monday, February 1, 2021 2:36:58 PM
To: python-cffi <pytho...@googlegroups.com>
Subject: [python-cffi] CFFI Release Management

 

--
-- python-cffi: To unsubscribe from this group, send email to python-cffi...@googlegroups.com. For more options, visit this group at https://groups.google.com/d/forum/python-cffi?hl=en
---
You received this message because you are subscribed to the Google Groups "python-cffi" group.
To unsubscribe from this group and stop receiving emails from it, send an email to python-cffi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/python-cffi/23041b92-5e92-4784-bcfd-eef520b0fff8n%40googlegroups.com.

[Matt Davis]

Yeah, it's not so much the cross-platform build as the (lack of) testing of both the codebase and the built artifact on M1- we wouldn't know if the wheel is any good without being able to run a test suite on M1 hardware. Could we just do it manually? Sure- I've got an M1 Mac Mini sitting on my desk, but Matt and Armin don't. I wouldn't want my or my Mac's lack of availability to prevent tests getting run or a release from getting cut. Without the ability to have repeatable/secure/ephemeral build envs on M1, it's just too risky IMO to commit to shipping wheels for that platform right now.

If Apple takes too long getting MacOS VM guest support working on M1, there are other ways to do secure-ish unprivileged build envs that I might be comfortable exposing to the internet through a CI provider, but it's a non-trivial amount of work to build and maintain such things. I'm really hoping Apple doesn't just leave everyone hanging on this one...

-Matt

[Simon Cross]

Thank you Matt and the Ansible team!

Thank you for answering the questions and +1 from me on your approach
to M1 support.