d810-cobra 0.1.0__tar.gz

d810_cobra-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 w00tzenheimer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

d810_cobra-0.1.0/MANIFEST.in

@@ -0,0 +1,12 @@
+# Build inputs that live OUTSIDE the importable package.
+#
+# setuptools builds the sdist from packages + package-data, and package-data
+# only reaches files inside a package. src/include and src/cpp are neither, so
+# without these lines the sdist would omit the header and the C++ shim -- and
+# `pip install d810-cobra` from source would fail at compile with a missing
+# cobra_shim.h. The sdist IS published (deploy.yml build_sdist), so this is not
+# hypothetical.
+include LICENSE
+include README.md
+recursive-include src/include *.h
+recursive-include src/cpp *.cpp

d810_cobra-0.1.0/PKG-INFO

@@ -0,0 +1,158 @@
+Metadata-Version: 2.4
+Name: d810-cobra
+Version: 0.1.0
+Summary: CoBRA MBA-solver backend for d810 (mba-solve)
+Author: w00tzenheimer
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/w00tzenheimer/d810-CoBRA
+Project-URL: Issues, https://github.com/w00tzenheimer/d810-CoBRA/issues
+Keywords: deobfuscation,mba,ida-pro,hex-rays,cobra
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: d810-ng>=0.6.6
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == "test"
+Dynamic: license-file
+
+# d810-cobra
+
+[![ci](https://github.com/w00tzenheimer/d810-CoBRA/actions/workflows/ci.yml/badge.svg)](https://github.com/w00tzenheimer/d810-CoBRA/actions/workflows/ci.yml)
+[![python](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue.svg)](pyproject.toml)
+[![license](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
+[![d810-ng](https://img.shields.io/badge/d810--ng-backend-8A2BE2.svg)](https://github.com/w00tzenheimer/d810-ng)
+
+CoBRA MBA-solver backend for [d810](https://github.com/w00tzenheimer/d810-ng) —
+the `mba-solve` pass.
+
+```console
+pip install d810-cobra
+```
+
+That is the whole installation. d810 discovers this package automatically; no
+configuration, no `COBRA_ROOT`, no CMake, no C++23 toolchain on the user's
+machine.
+
+## Why it is a separate package
+
+d810's 203 `mba-simplify` transforms are pattern-matched identities. On
+coefficient-based linear MBA they fire zero times — measured, not assumed.
+[CoBRA](https://github.com/trailofbits/CoBRA) is a signature-driven solver that
+closes exactly that gap.
+
+Shipping it inside d810 meant every d810 wheel carried a C++23 build of abseil,
+highway and cobra-core, and CoBRA's version was pinned to a d810 commit. Split
+out, d810's wheel stays pure and the two version independently.
+
+## How d810 finds it
+
+One entry point, in the unversioned `d810.backends` group:
+
+```toml
+[project.entry-points."d810.backends"]
+cobra = "d810_cobra:MANIFEST"
+```
+
+```python
+MANIFEST = {
+    "name": "cobra",
+    "api_version": 1,
+    "provides": "d810_cobra.solve",
+    "rules": ("d810_cobra.rules.cobra_solve",),
+    "implements": {"mba-solve": "CobraSolveRule"},
+}
+```
+
+`MANIFEST` is a plain dict — deliberately not d810's `BackendManifest`. The
+package depends on d810 at runtime, but the *manifest* must not: importing
+`BackendManifest` would turn "this d810 predates the plugin protocol" from a
+clean "backend not discovered" into an ImportError during d810 startup.
+
+Its `provides` is a *string*, resolved lazily, so a version-incompatible d810
+rejects this backend after reading three fields — without importing `solve.py`
+and therefore without loading the compiled extension.
+
+`rules` and `implements` are what make the pass actually *run*, and each closes
+a failure that is silent without it:
+
+- **`rules`** — d810 registers its own optimizer rules by scanning
+  `d810.optimizers.__path__`. That scan is path-scoped and cannot reach a rule
+  living inside this package. Without declaring it, the backend reports
+  `available` while `CobraSolveRule` never registers — indistinguishable from a
+  pass that ran and matched nothing. d810 imports these only after the backend
+  probes usable, so a missing binding yields no rule rather than a rule that
+  raises on every call.
+- **`implements`** — d810 derives a pass's `allowed_rule_names` from it at
+  registration time, long before rules are imported; a rule outside that
+  allowlist is skipped at dispatch. Declaring it here is what let d810 stop
+  hardcoding `"CobraSolveRule"` in its own source. The key is d810's pass id
+  (`d810.core.pass_ids.PassId.MBA_SOLVE`), written as a plain string so that
+  declaring a manifest still requires no d810 import — `PassId` is a
+  `StrEnum`, so the two compare and hash identically.
+
+d810 itself is a hard dependency (`solve.py` uses `d810.core.getLogger`,
+`table.py` uses `d810.core.cache`, `convert.py`/`detect.py` use
+`d810.hexrays.*`). Some of those are d810 internals rather than a published
+API, so a d810 refactor can break this package without either side bumping a
+major version.
+
+d810 ships no MBA solver of its own — `cobra` is not one of its builtin
+backends — so this package supplies the `mba-solve` implementation rather than
+overriding one:
+
+```
+cobra   available   d810-cobra 0.1.0
+```
+
+Check it with `d810cli backends`. Without this package installed, d810's
+`mba-solve` pass resolves no implementation and contributes no stages.
+
+## Building from source
+
+```console
+git clone --recursive https://github.com/w00tzenheimer/d810-CoBRA
+cd d810-CoBRA
+python tools/build_cobra.py     # abseil + highway + cobra-core (CMake + Ninja)
+pip install -e .
+```
+
+`tools/build_cobra.py` needs CMake and Ninja, and a C++23 compiler. On Windows
+it pins MSVC (`cl`) explicitly: `-G Ninja` with no compiler pinned picks
+whatever is first in `PATH`, and a MinGW build produces `libabsl_*.a` archives
+that an MSVC-built `.pyd` can neither `/WHOLEARCHIVE:` nor safely link against.
+
+The build **fails loudly** rather than producing a package without the binding.
+A wheel that installs cleanly and simplifies nothing is the failure mode this
+package exists to make impossible.
+
+## Layout
+
+| path | what |
+|---|---|
+| `src/d810_cobra/expr.py` | parse/evaluate/accept — pure data, no IDA |
+| `src/d810_cobra/probe.py` | locate `cobra-cli`, or report a structured skip |
+| `src/d810_cobra/solve.py` | the backend entry point d810 resolves |
+| `src/d810_cobra/_cobra.pyx` | Cython binding over `cobra_shim.cpp` |
+| `src/d810_cobra/rules/` | the `mba-solve` peephole rule (needs d810 + Hex-Rays) |
+| `src/include/cobra_shim.h` | C ABI the binding compiles against |
+| `src/cpp/cobra_shim.cpp` | C++ shim over cobra-core |
+| `third_party/cobra` | pinned CoBRA submodule |
+
+Headers and the C++ shim sit outside the package, mirroring d810's own
+`src/include`. They are build inputs, so the wheel ships only what is
+importable; `MANIFEST.in` is what carries them into the sdist. Note that
+setuptools auto-includes a declared Extension *source* but never an
+`include_dirs` header — drop `MANIFEST.in` and the sdist still contains
+`cobra_shim.cpp` while silently losing `cobra_shim.h`.
+
+Everything that touches `ida_hexrays` lives under `rules/`, so the solver core
+stays unit-testable without IDA.
+
+## License
+
+MIT. CoBRA itself is vendored as a submodule under its own license.

d810_cobra-0.1.0/README.md

@@ -0,0 +1,136 @@
+# d810-cobra
+
+[![ci](https://github.com/w00tzenheimer/d810-CoBRA/actions/workflows/ci.yml/badge.svg)](https://github.com/w00tzenheimer/d810-CoBRA/actions/workflows/ci.yml)
+[![python](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue.svg)](pyproject.toml)
+[![license](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
+[![d810-ng](https://img.shields.io/badge/d810--ng-backend-8A2BE2.svg)](https://github.com/w00tzenheimer/d810-ng)
+
+CoBRA MBA-solver backend for [d810](https://github.com/w00tzenheimer/d810-ng) —
+the `mba-solve` pass.
+
+```console
+pip install d810-cobra
+```
+
+That is the whole installation. d810 discovers this package automatically; no
+configuration, no `COBRA_ROOT`, no CMake, no C++23 toolchain on the user's
+machine.
+
+## Why it is a separate package
+
+d810's 203 `mba-simplify` transforms are pattern-matched identities. On
+coefficient-based linear MBA they fire zero times — measured, not assumed.
+[CoBRA](https://github.com/trailofbits/CoBRA) is a signature-driven solver that
+closes exactly that gap.
+
+Shipping it inside d810 meant every d810 wheel carried a C++23 build of abseil,
+highway and cobra-core, and CoBRA's version was pinned to a d810 commit. Split
+out, d810's wheel stays pure and the two version independently.
+
+## How d810 finds it
+
+One entry point, in the unversioned `d810.backends` group:
+
+```toml
+[project.entry-points."d810.backends"]
+cobra = "d810_cobra:MANIFEST"
+```
+
+```python
+MANIFEST = {
+    "name": "cobra",
+    "api_version": 1,
+    "provides": "d810_cobra.solve",
+    "rules": ("d810_cobra.rules.cobra_solve",),
+    "implements": {"mba-solve": "CobraSolveRule"},
+}
+```
+
+`MANIFEST` is a plain dict — deliberately not d810's `BackendManifest`. The
+package depends on d810 at runtime, but the *manifest* must not: importing
+`BackendManifest` would turn "this d810 predates the plugin protocol" from a
+clean "backend not discovered" into an ImportError during d810 startup.
+
+Its `provides` is a *string*, resolved lazily, so a version-incompatible d810
+rejects this backend after reading three fields — without importing `solve.py`
+and therefore without loading the compiled extension.
+
+`rules` and `implements` are what make the pass actually *run*, and each closes
+a failure that is silent without it:
+
+- **`rules`** — d810 registers its own optimizer rules by scanning
+  `d810.optimizers.__path__`. That scan is path-scoped and cannot reach a rule
+  living inside this package. Without declaring it, the backend reports
+  `available` while `CobraSolveRule` never registers — indistinguishable from a
+  pass that ran and matched nothing. d810 imports these only after the backend
+  probes usable, so a missing binding yields no rule rather than a rule that
+  raises on every call.
+- **`implements`** — d810 derives a pass's `allowed_rule_names` from it at
+  registration time, long before rules are imported; a rule outside that
+  allowlist is skipped at dispatch. Declaring it here is what let d810 stop
+  hardcoding `"CobraSolveRule"` in its own source. The key is d810's pass id
+  (`d810.core.pass_ids.PassId.MBA_SOLVE`), written as a plain string so that
+  declaring a manifest still requires no d810 import — `PassId` is a
+  `StrEnum`, so the two compare and hash identically.
+
+d810 itself is a hard dependency (`solve.py` uses `d810.core.getLogger`,
+`table.py` uses `d810.core.cache`, `convert.py`/`detect.py` use
+`d810.hexrays.*`). Some of those are d810 internals rather than a published
+API, so a d810 refactor can break this package without either side bumping a
+major version.
+
+d810 ships no MBA solver of its own — `cobra` is not one of its builtin
+backends — so this package supplies the `mba-solve` implementation rather than
+overriding one:
+
+```
+cobra   available   d810-cobra 0.1.0
+```
+
+Check it with `d810cli backends`. Without this package installed, d810's
+`mba-solve` pass resolves no implementation and contributes no stages.
+
+## Building from source
+
+```console
+git clone --recursive https://github.com/w00tzenheimer/d810-CoBRA
+cd d810-CoBRA
+python tools/build_cobra.py     # abseil + highway + cobra-core (CMake + Ninja)
+pip install -e .
+```
+
+`tools/build_cobra.py` needs CMake and Ninja, and a C++23 compiler. On Windows
+it pins MSVC (`cl`) explicitly: `-G Ninja` with no compiler pinned picks
+whatever is first in `PATH`, and a MinGW build produces `libabsl_*.a` archives
+that an MSVC-built `.pyd` can neither `/WHOLEARCHIVE:` nor safely link against.
+
+The build **fails loudly** rather than producing a package without the binding.
+A wheel that installs cleanly and simplifies nothing is the failure mode this
+package exists to make impossible.
+
+## Layout
+
+| path | what |
+|---|---|
+| `src/d810_cobra/expr.py` | parse/evaluate/accept — pure data, no IDA |
+| `src/d810_cobra/probe.py` | locate `cobra-cli`, or report a structured skip |
+| `src/d810_cobra/solve.py` | the backend entry point d810 resolves |
+| `src/d810_cobra/_cobra.pyx` | Cython binding over `cobra_shim.cpp` |
+| `src/d810_cobra/rules/` | the `mba-solve` peephole rule (needs d810 + Hex-Rays) |
+| `src/include/cobra_shim.h` | C ABI the binding compiles against |
+| `src/cpp/cobra_shim.cpp` | C++ shim over cobra-core |
+| `third_party/cobra` | pinned CoBRA submodule |
+
+Headers and the C++ shim sit outside the package, mirroring d810's own
+`src/include`. They are build inputs, so the wheel ships only what is
+importable; `MANIFEST.in` is what carries them into the sdist. Note that
+setuptools auto-includes a declared Extension *source* but never an
+`include_dirs` header — drop `MANIFEST.in` and the sdist still contains
+`cobra_shim.cpp` while silently losing `cobra_shim.h`.
+
+Everything that touches `ida_hexrays` lives under `rules/`, so the solver core
+stays unit-testable without IDA.
+
+## License
+
+MIT. CoBRA itself is vendored as a submodule under its own license.

d810_cobra-0.1.0/pyproject.toml

@@ -0,0 +1,65 @@
+[build-system]
+requires = ["setuptools>=77.0.1", "wheel", "Cython>=3.0.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+# Must match the PyPI Trusted Publisher registration exactly.
+name = "d810-cobra"
+version = "0.1.0"
+description = "CoBRA MBA-solver backend for d810 (mba-solve)"
+readme = "README.md"
+requires-python = ">= 3.10"
+license = "MIT"
+authors = [{ name = "w00tzenheimer" }]
+keywords = ["deobfuscation", "mba", "ida-pro", "hex-rays", "cobra"]
+classifiers = [
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+]
+
+# d810 IS a hard runtime dependency, including for the entry-point target:
+# solve.py imports d810.core.getLogger, table.py needs d810.core.cache.CacheImpl
+# and d810.core.typing, convert.py/detect.py need d810.hexrays.*. Only `expr`
+# and `probe` are genuinely standalone.
+#
+# Not circular: d810 never imports this package, it only discovers it through
+# the entry point.
+#
+# Caveat worth knowing: several of these are d810 INTERNALS rather than a
+# published API (d810.core.cache, d810.core.typing), so a d810 refactor can
+# break this package without a major version bump on either side.
+dependencies = ["d810-ng>=0.6.6"]
+
+[project.optional-dependencies]
+test = ["pytest>=8.0"]
+
+[project.urls]
+Homepage = "https://github.com/w00tzenheimer/d810-CoBRA"
+Issues = "https://github.com/w00tzenheimer/d810-CoBRA/issues"
+
+# This is the whole integration surface. d810's BackendRegistry scans this
+# group before its builtins, so an installed copy of this package supersedes
+# anything d810 ships under the same name. The group is deliberately
+# unversioned -- the compatibility contract lives in the manifest's
+# api_version, not in the entry-point name.
+[project.entry-points."d810.backends"]
+cobra = "d810_cobra:MANIFEST"
+
+[tool.setuptools]
+package-dir = { "" = "src" }
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+# cobra_shim.h is no longer here: it moved to src/include, matching d810's own
+# layout. It reaches the sdist through MANIFEST.in instead -- package-data only
+# covers files inside an importable package, and a header is a build input, not
+# something a wheel consumer imports.
+d810_cobra = ["*.pyx", "*.pxd"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests/unit"]

d810_cobra-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

d810_cobra-0.1.0/setup.py

@@ -0,0 +1,174 @@
+"""Build the CoBRA solver binding.
+
+Unlike d810, where this extension was optional and the wheel had to remain
+installable without it, the binding is the entire point of this package. So a
+build that cannot produce it FAILS rather than quietly yielding an inert
+install -- the failure mode we spent a long time chasing in d810 was exactly a
+wheel that installed cleanly and simplified nothing.
+
+The C++ side is built by ``tools/build_cobra.py`` (CMake + Ninja), which
+produces the layout consumed here.
+"""
+
+from __future__ import annotations
+
+import os
+import pathlib
+import platform
+
+from setuptools import setup
+
+OSTYPE = platform.system()
+HERE = pathlib.Path(__file__).parent.resolve()
+
+#: Layout mirrors d810 itself, which keeps shared C headers in ``src/include``
+#: rather than inside the importable package. Both ``_cobra.pyx`` and
+#: ``cobra_shim.cpp`` include the header by bare name, so this must be on the
+#: include path for either to compile.
+#:
+#: Keeping them out of ``src/d810_cobra`` means the wheel ships only what is
+#: importable: the header and the C++ shim are build inputs, and a consumer who
+#: pip-installs a built wheel has no use for either.
+SRC = HERE / "src"
+INCLUDE_DIR = SRC / "include"
+
+
+def _first_existing(root: pathlib.Path, candidates: tuple[str, ...]):
+    for rel in candidates:
+        candidate = root / rel
+        if candidate.exists():
+            return candidate
+    return None
+
+
+def get_cobra_ext_modules():
+    try:
+        from Cython.Build import cythonize
+        from setuptools import Extension
+    except ImportError:  # pragma: no cover - build-time only
+        raise ImportError("Cython is required to build the CoBRA binding")
+
+    # Default to the vendored submodule so `pip install -e .` works in a
+    # checkout with no environment set up. CI overrides this for the flat
+    # artifact layout.
+    cobra_root = os.environ.get("COBRA_ROOT") or str(HERE / "third_party" / "cobra")
+    root = pathlib.Path(cobra_root)
+    if not root.is_dir():
+        raise RuntimeError(
+            f"COBRA_ROOT={root} does not exist. Either init the submodule\n"
+            "  git submodule update --init --recursive\n"
+            "and run  python tools/build_cobra.py , or point COBRA_ROOT at a\n"
+            "prebuilt cobra-core bundle."
+        )
+
+    # TWO accepted layouts. The flat one exists so a released/CI static-lib
+    # bundle can be consumed directly -- requiring callers to reshape a
+    # download into a fake build tree is pure friction, and reshaping inside CI
+    # just relocates it.
+    #
+    #   FLAT (release / CI artifact):  <root>/lib/*.{a,lib}   <root>/include/
+    #   BUILD TREE (local checkout):   <root>/build/lib/core/
+    #                                  <root>/build-deps/install/{lib*,include}/
+    flat_lib = root / "lib"
+    flat_inc = root / "include"
+    is_flat = flat_lib.is_dir() and any(flat_lib.glob("*cobra-core*"))
+
+    if is_flat:
+        include_dirs = [str(INCLUDE_DIR), str(flat_inc)]
+        library_dirs = [str(flat_lib)]
+    else:
+        # Pick ONE dependency prefix and one core build; globbing several and
+        # merging them silently mixes incompatible trees.
+        deps_prefix = _first_existing(
+            root, ("build-deps/install", "build-deps-nollvm/install")
+        )
+        core_dir = _first_existing(root, ("build/lib/core", "build-nollvm/lib/core"))
+        if deps_prefix is None or core_dir is None:
+            raise RuntimeError(
+                f"COBRA_ROOT={root} does not look built. Accepted layouts:\n"
+                f"  flat:       {root}/lib/*cobra-core* + {root}/include/\n"
+                f"  build tree: {root}/build/lib/core + {root}/build-deps/install\n"
+                "Run: python tools/build_cobra.py"
+            )
+        include_dirs = [
+            str(INCLUDE_DIR),
+            str(root / "include"),
+            str(deps_prefix / "include"),
+        ]
+        # lib vs lib64: manylinux is RHEL-based, where CMAKE_INSTALL_LIBDIR
+        # defaults to lib64, so never hardcode "lib".
+        library_dirs = [str(core_dir)] + [
+            str(p) for p in sorted(deps_prefix.glob("lib*")) if p.is_dir()
+        ]
+
+    # CoBRA requires C++23 (Result.h uses std::expected).
+    std_args = ["/std:c++latest"] if OSTYPE == "Windows" else ["-std=c++23"]
+
+    # abseil scatters constants and singletons (container_internal::kSooControl,
+    # MixingHashState::kSeed, Mutex, Now, ...) across archive members that
+    # nothing else references, so a normal -l link never pulls them in. Python
+    # extensions link with -undefined dynamic_lookup, so this does NOT fail the
+    # link -- it fails later at dlopen with "symbol not found in flat
+    # namespace", which is much harder to diagnose. Force every abseil archive
+    # in and let the linker dead-strip the remainder.
+    #
+    # MSVC emits absl_base.lib; Unix toolchains emit libabsl_base.a. Globbing
+    # only the Unix shape silently yields NOTHING on Windows and the force-load
+    # never happens -- again a load-time failure, not a link-time one. An empty
+    # match is therefore fatal.
+    _absl_pattern = "absl_*.lib" if OSTYPE == "Windows" else "libabsl_*.a"
+    absl_archives = [
+        str(p) for d in library_dirs for p in sorted(pathlib.Path(d).glob(_absl_pattern))
+    ]
+    if not absl_archives:
+        raise RuntimeError(
+            f"no abseil archives matched {_absl_pattern!r} under {library_dirs}. "
+            "Without force-loading them the extension links but fails at import "
+            "with missing absl symbols; refusing to build a broken binding."
+        )
+    if OSTYPE == "Darwin":
+        link_args = [f"-Wl,-force_load,{a}" for a in absl_archives]
+        link_args.append("-Wl,-dead_strip")
+    elif OSTYPE == "Linux":
+        link_args = [
+            "-Wl,--whole-archive",
+            *absl_archives,
+            "-Wl,--no-whole-archive",
+            "-Wl,--gc-sections",
+        ]
+    else:
+        link_args = [f"/WHOLEARCHIVE:{a}" for a in absl_archives]
+
+    return cythonize(
+        Extension(
+            "d810_cobra._cobra",
+            [
+                "src/d810_cobra/_cobra.pyx",
+                "src/cpp/cobra_shim.cpp",
+            ],
+            language="c++",
+            include_dirs=include_dirs,
+            library_dirs=library_dirs,
+            libraries=["cobra-core"],
+            extra_compile_args=std_args,
+            extra_link_args=link_args,
+        ),
+        compiler_directives={"language_level": "3", "binding": True},
+    )
+
+
+#: Building an sdist compiles nothing -- it packs sources -- but setuptools
+#: evaluates ``ext_modules`` on EVERY PEP 517 hook, including
+#: ``get_requires_for_build_sdist``, which runs before anything is packed. So
+#: ``python -m build --sdist`` demanded a fully built cobra-core just to produce
+#: a tarball, and deploy.yml's build_sdist job (which has no CoBRA build step by
+#: design) died in 8s with the "does not look built" error.
+#:
+#: Deliberately opt-IN, rather than "return [] whenever CoBRA is missing": the
+#: latter would let a *wheel* build silently produce a package with no binding.
+#: That is precisely the failure this package refuses -- a wheel that installs
+#: cleanly and simplifies nothing. Skipping the extension must require someone
+#: to say so explicitly, and only for the one artifact that cannot contain it.
+SDIST_ONLY = os.environ.get("D810_COBRA_SDIST_ONLY") == "1"
+
+setup(ext_modules=[] if SDIST_ONLY else get_cobra_ext_modules())