fizzpy 0.3.0__tar.gz → 0.4.0__tar.gz

{fizzpy-0.3.0 → fizzpy-0.4.0}/.github/workflows/wheels.yml

@@ -12,6 +12,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  # macOS/Windows build fizz from source at this tag; keep it matching the tag the
+  # Linux deps image pins (scripts/build_fizz_deps.py) so every platform ships the
+  # same fizz. The Linux jobs read their pin from the image, not this var.
+  FIZZ_TAG: v2026.06.08.00
+
 jobs:
   # The folly+fizz+liboqs tree is baked into a GHCR image tagged by the hash of
   # its build inputs. This job rebuilds it only when that hash has no image yet
@@ -116,3 +122,72 @@ jobs:
           name: wheels-${{ matrix.python }}
           path: wheelhouse/*.whl
           if-no-files-found: error
+
+  build_wheels_native:
+    # macOS and Windows have no prebuilt deps image, so each runner builds the
+    # folly+fizz+liboqs tree from source (cached). Skipped on PRs — PR feedback
+    # stays on the fast Linux path; these run on master, tags, and dispatch.
+    name: Wheel ${{ matrix.os }}
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        # macos-15-intel = x86_64, macos-14 = arm64 (native per runner). windows-2022
+        # ships VS 2022 (vc143); windows-latest moved to VS 2026, whose toolset Boost
+        # 1.83's bootstrap doesn't recognize. Interpreters (cp310-cp314) come from
+        # [tool.cibuildwheel] build in pyproject.toml.
+        os: [macos-15-intel, macos-14, windows-2022]
+    steps:
+      - uses: actions/checkout@v6
+
+      # before-all runs on the host on macOS/Windows (no container), so these are
+      # inherited by the deps build and the _core configure without CIBW_ENVIRONMENT.
+      - name: Resolve deps paths (unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          {
+            echo "GETDEPS_SCRATCH=$HOME/fizz-deps"
+            echo "FIZZPY_BUILD_INFO=$HOME/fizzpy-build"
+            echo "FIZZ_SRC=$HOME/fizz-src"
+            # Match the runner's macOS major: getdeps pulls Homebrew libs (openssl,
+            # sodium, …) built for this OS, so the wheel can't claim an older target
+            # than they carry. Also satisfies folly's C++17 (>= 10.13) requirement.
+            echo "MACOSX_DEPLOYMENT_TARGET=$(sw_vers -productVersion | cut -d. -f1).0"
+          } >> "$GITHUB_ENV"
+
+      - name: Resolve deps paths and locate MSVC (windows)
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          vswhere="/c/Program Files (x86)/Microsoft Visual Studio/Installer/vswhere.exe"
+          install=$("$vswhere" -latest -property installationPath)
+          {
+            echo "GETDEPS_SCRATCH=C:/fizz-deps"
+            echo "FIZZPY_BUILD_INFO=C:/fizzpy-build"
+            echo "FIZZ_SRC=C:/fizz-src"
+            # getdeps only globs for VS 2022; point it at whatever VS is installed.
+            echo "VCVARS_PATH=$install\\VC\\Auxiliary\\Build\\vcvarsall.bat"
+          } >> "$GITHUB_ENV"
+
+      # The getdeps tree is the ~40-min cost; key it on the build script + tag so a
+      # warm cache turns before-all into a near no-op.
+      - name: Cache deps tree
+        uses: actions/cache@v4
+        with:
+          path: |
+            ${{ env.GETDEPS_SCRATCH }}
+            ${{ env.FIZZPY_BUILD_INFO }}
+            ${{ env.FIZZ_SRC }}
+          key: deps-${{ matrix.os }}-${{ env.FIZZ_TAG }}-${{ env.MACOSX_DEPLOYMENT_TARGET }}-${{ hashFiles('scripts/build_fizz_deps_native.py') }}
+
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v4.1.0
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: wheels-${{ matrix.os }}
+          path: wheelhouse/*.whl
+          if-no-files-found: error

{fizzpy-0.3.0 → fizzpy-0.4.0}/CMakeLists.txt

@@ -7,15 +7,15 @@ project(
   VERSION ${SKBUILD_PROJECT_VERSION}
   LANGUAGES CXX)
 
-# Only Linux x86_64 wheels are published. Stop here before the (~40 min) folly +
-# fizz + liboqs source build that an sdist install would otherwise attempt and
-# fail on macOS/Windows.
-if(NOT CMAKE_SYSTEM_NAME STREQUAL "Linux")
+# Wheels target Linux, macOS, and Windows. Other platforms stop here before the
+# (~40 min) folly + fizz + liboqs source build an sdist install would attempt.
+if(NOT CMAKE_SYSTEM_NAME MATCHES "^(Linux|Darwin|Windows)$")
   message(
     FATAL_ERROR
-    "fizzpy publishes prebuilt Linux x86_64 wheels only; ${CMAKE_SYSTEM_NAME} "
-    "is not yet supported. Building from source needs the Fizz toolchain — see "
-    "BUILDING.md (https://github.com/Xevion/fizz-py/blob/master/BUILDING.md).")
+    "fizzpy publishes prebuilt wheels for Linux, macOS, and Windows; "
+    "${CMAKE_SYSTEM_NAME} is not supported. Building from source needs the Fizz "
+    "toolchain — see BUILDING.md "
+    "(https://github.com/Xevion/fizz-py/blob/master/BUILDING.md).")
 endif()
 
 # Fizz's CMake config pulls in its bundled FindSodium.cmake. Homebrew installs
@@ -85,4 +85,12 @@ if(TARGET Folly::folly_io_async_scoped_event_base_thread)
   target_link_libraries(_core PRIVATE Folly::folly_io_async_scoped_event_base_thread)
 endif()
 
+# Static deps need Windows system libs their getdeps configs don't propagate as
+# interface links: bcrypt (RNG: libevent, liboqs), crypt32 (OpenSSL cert store),
+# ws2_32 (sockets), iphlpapi (folly GetAdaptersAddresses), advapi32 (OpenSSL/
+# libevent registry + RNG fallback). Link them on the consumer.
+if(WIN32)
+  target_link_libraries(_core PRIVATE bcrypt crypt32 ws2_32 iphlpapi advapi32)
+endif()
+
 install(TARGETS _core LIBRARY DESTINATION fizzpy)

{fizzpy-0.3.0 → fizzpy-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fizzpy
-Version: 0.3.0
+Version: 0.4.0
 Summary: A low-level TLS 1.3 client toolkit for Python, built on Facebook's Fizz
 Author-Email: Xevion <xevion@xevion.dev>
 License-Expression: MIT
@@ -38,7 +38,7 @@ back to classical X25519 against those that don't.
 > TLS 1.3 only, HTTP/1.1 only. This is a focused toolkit / learning project,
 > not a drop-in `requests` replacement. See [Status](#status).
 
-![A fizzpy ClientHello in Wireshark](docs/pq-handshake.png)
+![A fizzpy ClientHello in Wireshark](https://raw.githubusercontent.com/Xevion/fizz-py/master/docs/pq-handshake.png)
 
 *A fizzpy request captured in Wireshark: the TLS 1.3 ClientHello offers the
 post-quantum `X25519MLKEM768` group (`0x11ec`), and a custom marker extension

{fizzpy-0.3.0 → fizzpy-0.4.0}/README.md

@@ -11,7 +11,7 @@ back to classical X25519 against those that don't.
 > TLS 1.3 only, HTTP/1.1 only. This is a focused toolkit / learning project,
 > not a drop-in `requests` replacement. See [Status](#status).
 
-![A fizzpy ClientHello in Wireshark](docs/pq-handshake.png)
+![A fizzpy ClientHello in Wireshark](https://raw.githubusercontent.com/Xevion/fizz-py/master/docs/pq-handshake.png)
 
 *A fizzpy request captured in Wireshark: the TLS 1.3 ClientHello offers the
 post-quantum `X25519MLKEM768` group (`0x11ec`), and a custom marker extension

{fizzpy-0.3.0 → fizzpy-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "scikit_build_core.build"
 
 [project]
 name = "fizzpy"
-version = "0.3.0"
+version = "0.4.0"
 description = "A low-level TLS 1.3 client toolkit for Python, built on Facebook's Fizz"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -108,6 +108,9 @@ wheel.packages = ["fizzpy"]
 build = "cp310-* cp311-* cp312-* cp313-* cp314-*"
 skip = "*-musllinux*"
 build-frontend = { name = "pip", args = ["--no-build-isolation"] }
+# --no-build-isolation skips auto-installing the build backend, so install it here.
+# Identical on every platform, so it lives at the top level.
+before-build = "pip install scikit-build-core pybind11 pybind11-stubgen"
 
 [tool.cibuildwheel.linux]
 archs = ["x86_64"]
@@ -115,13 +118,31 @@ archs = ["x86_64"]
 # before-all — each build just compiles _core against the baked prefix CMake
 # reads from $FIZZPY_BUILD_INFO. CI sets the image ref (content-addressed, owner
 # resolved at runtime) via CIBW_MANYLINUX_X86_64_IMAGE in wheels.yml.
-before-build = "pip install scikit-build-core pybind11 pybind11-stubgen"
-# glog's exported config links gflags_shared, so _core picks up a runtime
-# dependency on libgflags.so. auditwheel only searches LD_LIBRARY_PATH for
-# external libs to vendor; the getdeps install dirs aren't on it by default. This
-# runs in the container's real shell, so the glob+pipe is fine (the `environment`
-# table uses a restricted evaluator that rejects pipes).
+# The getdeps tree builds glog/gflags (and on Windows openssl/libsodium) as shared
+# libs in install dirs outside the loader's default search path, so _core has a
+# runtime dependency the default repair command can't resolve. Each platform below
+# points its repair tool at those dirs. auditwheel searches only LD_LIBRARY_PATH;
+# the glob+pipe is fine here (repair runs in the real shell, unlike the
+# `environment` table's restricted evaluator).
 repair-wheel-command = "LD_LIBRARY_PATH=\"$(echo /opt/fizz-deps/installed/*/lib /opt/fizz-deps/installed/*/lib64 | tr ' ' ':'):$LD_LIBRARY_PATH\" auditwheel repair -w {dest_dir} {wheel}"
 
 [tool.cibuildwheel.linux.environment]
 FIZZPY_BUILD_INFO = "/opt/fizzpy-build"
+
+# macOS/Windows have no prebuilt deps image, so before-all builds the folly+fizz+
+# liboqs tree on the runner. wheels.yml supplies FIZZ_SRC/GETDEPS_SCRATCH/
+# FIZZPY_BUILD_INFO per-runner and caches the scratch dir.
+[tool.cibuildwheel.macos]
+before-all = "python3 scripts/build_fizz_deps_native.py"
+# delocate reads only DYLD_*. Set it inline: macOS SIP strips DYLD_* from the
+# system shell's env, but not vars that shell sets for its own children.
+repair-wheel-command = "DYLD_LIBRARY_PATH=\"$(echo $GETDEPS_SCRATCH/installed/*/lib | tr ' ' ':')\" delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}"
+
+[tool.cibuildwheel.windows]
+# 64-bit only: the getdeps tree is built x86_64, so the default win32 (32-bit)
+# build can't link it. delvewheel vendors the runtime DLLs into the wheel.
+archs = ["AMD64"]
+before-all = "python scripts/build_fizz_deps_native.py"
+# delvewheel searches only PATH; --add-path feeds it the getdeps dirs. Their names
+# are content-addressed (hashed), so a shim globs them rather than a fixed path.
+repair-wheel-command = "python scripts/repair_wheel_windows.py {dest_dir} {wheel}"

fizzpy-0.4.0/scripts/build_fizz_deps_native.py

@@ -0,0 +1,179 @@
+#!/usr/bin/env python3
+"""cibuildwheel `before-all` for macOS and Windows.
+
+The Linux path bakes the folly + fizz + liboqs tree into a manylinux image; there
+is no such image for macOS/Windows, so the deps are built on the runner here. The
+getdeps scratch dir is restored from actions/cache between runs (keyed by this
+file's hash), so a warm cache makes getdeps a near-instant no-op rather than a
+~40-minute rebuild.
+
+Outputs (read by CMakeLists.txt at configure time, same as the Linux path):
+    $FIZZPY_BUILD_INFO/prefix.txt      semicolon-joined CMAKE_PREFIX_PATH
+    $FIZZPY_BUILD_INFO/module_dir.txt  dir holding fizz's bundled find-modules
+
+Env (set by the workflow so the cache and CMake agree on locations):
+    FIZZ_TAG, FIZZ_SRC, GETDEPS_SCRATCH, FIZZPY_BUILD_INFO
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import platform
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+# Pin fizz to a release whose getdeps manifests pin a matching folly. liboqs is
+# pinned by fizz's own manifest, so post-quantum support travels with the tag.
+FIZZ_TAG = os.environ.get("FIZZ_TAG", "v2026.06.08.00")
+FIZZ_SRC = Path(os.environ["FIZZ_SRC"])
+SCRATCH = os.environ["GETDEPS_SCRATCH"]
+OUT = Path(os.environ["FIZZPY_BUILD_INFO"])
+
+
+def cmake_defines() -> str:
+    # Static-PIC so _core links the tree in wholesale into one self-contained
+    # module, matching the Linux build. PIC is a no-op on Windows but harmless.
+    defines = {"CMAKE_POSITION_INDEPENDENT_CODE": "ON"}
+    if platform.system() == "Darwin":
+        # folly's C++17 (aligned operator new, std::uncaught_exceptions) needs
+        # >= 10.13; without this getdeps defaults to 10.9 and folly fails to
+        # compile. Match the wheel's MACOSX_DEPLOYMENT_TARGET so ABI agrees.
+        defines["CMAKE_OSX_DEPLOYMENT_TARGET"] = os.environ.get(
+            "MACOSX_DEPLOYMENT_TARGET", "11.0"
+        )
+    return json.dumps(defines)
+
+
+def run(cmd: list[str], **kwargs: object) -> None:
+    print("+", " ".join(map(str, cmd)), flush=True)
+    subprocess.run(cmd, check=True, **kwargs)  # type: ignore[arg-type]
+
+
+def patch_folly_sse2() -> None:
+    """Re-enable SSE2 on folly's scalar crypto-math TU (macOS x86_64 only).
+
+    folly builds MathOperation_Simple.cpp with -mno-sse2, but the macOS 15 SDK's
+    <math.h> declares _Float16 unconditionally and Apple Clang can't codegen it
+    without SSE2 ("_Float16 is not supported on this target"). Every x86_64 CPU has
+    SSE2, so flipping the flag is safe; only the _simple target carries -mno-sse2.
+    A getdeps CMAKE_CXX_FLAGS=-msse2 can't fix it: folly's per-target flag is
+    appended after global flags and Clang takes the last -m, so we edit the source.
+    """
+    if platform.system() != "Darwin" or platform.machine() != "x86_64":
+        return
+    pattern = "*folly*/folly/crypto/detail/CMakeLists.txt"
+    found = list(Path(SCRATCH, "repos").glob(pattern))
+    if not found:
+        print("warning: folly crypto/detail CMakeLists not found; skipping SSE2 patch")
+        return
+    for cml in found:
+        text = cml.read_text()
+        patched = text.replace("-mno-sse2", "-msse2")
+        if patched != text:
+            cml.write_text(patched)
+            print(f"patched {cml}: -mno-sse2 -> -msse2 (macOS 15 SDK _Float16)")
+
+
+def main() -> None:
+    getdeps = str(FIZZ_SRC / "build" / "fbcode_builder" / "getdeps.py")
+    common = [
+        "--extra-cmake-defines",
+        cmake_defines(),
+        f"--src-dir={FIZZ_SRC}",
+        "--allow-system-packages",
+    ]
+    # getdeps only autodetects Visual Studio 2022; newer VS on the runner needs an
+    # explicit pointer to vcvarsall.bat (located via vswhere in the workflow).
+    vcvars = os.environ.get("VCVARS_PATH")
+    if vcvars:
+        common += ["--vcvars-path", vcvars]
+
+    # A cache restore brings back the clone; only fetch when it's genuinely absent.
+    if not (FIZZ_SRC / ".git").exists():
+        if FIZZ_SRC.exists():
+            shutil.rmtree(FIZZ_SRC)
+        run(
+            [
+                "git",
+                "clone",
+                "--depth",
+                "1",
+                "--branch",
+                FIZZ_TAG,
+                "https://github.com/facebookincubator/fizz",
+                str(FIZZ_SRC),
+            ]
+        )
+
+    # Fetch all sources first so folly can be patched before it compiles.
+    # --recursive is required: a bare `fetch fizz` clones only fizz, not its
+    # dependencies. build below skips re-fetching repos already at the pinned
+    # rev, so the patched working tree survives.
+    run(
+        [
+            sys.executable,
+            getdeps,
+            "--scratch-path",
+            SCRATCH,
+            "fetch",
+            "--recursive",
+            "fizz",
+            *common,
+        ]
+    )
+    patch_folly_sse2()
+
+    # getdeps skips deps already present in the (cached) scratch, so this is cheap
+    # on a warm cache and does the full build on a cold one.
+    run(
+        [
+            sys.executable,
+            getdeps,
+            "--scratch-path",
+            SCRATCH,
+            "build",
+            "fizz",
+            *common,
+            "--no-tests",
+        ]
+    )
+
+    OUT.mkdir(parents=True, exist_ok=True)
+    # show-inst-dir must use the SAME flags as build — the manifest hash depends
+    # on them — or it points at a different (unbuilt) scratch dir.
+    inst = subprocess.run(
+        [
+            sys.executable,
+            getdeps,
+            "--scratch-path",
+            SCRATCH,
+            "show-inst-dir",
+            "--recursive",
+            "fizz",
+            *common,
+        ],
+        check=True,
+        text=True,
+        capture_output=True,
+    ).stdout
+    # Forward slashes only: CMake treats backslashes as escapes when it splices
+    # these paths into generated TryCompile CMakeLists, so a Windows path like
+    # C:\fizz-src\...\CMake fails with "Invalid character escape '\f'".
+    prefix = ";".join(
+        line.replace("\\", "/") for line in inst.splitlines() if line.strip()
+    )
+    (OUT / "prefix.txt").write_text(prefix + "\n")
+
+    # fizz/folly use bundled find-modules (FindSodium, FindZstd, …) that live in
+    # the fizz source tree rather than installed config packages.
+    module_dir = str(FIZZ_SRC / "build" / "fbcode_builder" / "CMake")
+    (OUT / "module_dir.txt").write_text(module_dir.replace("\\", "/") + "\n")
+
+    print(f"fizz dependency tree ready; prefix written to {OUT / 'prefix.txt'}")
+
+
+if __name__ == "__main__":
+    main()

fizzpy-0.4.0/scripts/repair_wheel_windows.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""delvewheel front-end for cibuildwheel's Windows `repair-wheel-command`.
+
+getdeps installs each dep under $GETDEPS_SCRATCH/installed/<name>/ with DLLs in
+bin/ and import libs in lib/, under content-addressed (hashed) names. We glob those
+dirs and hand them to `delvewheel repair --add-path` so it can find and vendor the
+shared deps (glog/gflags/openssl/...) into the wheel.
+
+Invoked as: python scripts/repair_wheel_windows.py {dest_dir} {wheel}
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+def main() -> None:
+    dest_dir, wheel = sys.argv[1], sys.argv[2]
+    scratch = Path(os.environ["GETDEPS_SCRATCH"])
+
+    installed = scratch / "installed"
+    dll_dirs = [
+        d for name in ("bin", "lib") for d in installed.glob(f"*/{name}") if d.is_dir()
+    ]
+    add_path = os.pathsep.join(str(d) for d in dll_dirs)
+
+    cmd = [
+        sys.executable,
+        "-m",
+        "delvewheel",
+        "repair",
+        "--add-path",
+        add_path,
+        "-w",
+        dest_dir,
+        "-v",
+        wheel,
+    ]
+    print("+", " ".join(cmd), flush=True)
+    subprocess.run(cmd, check=True)
+
+
+if __name__ == "__main__":
+    main()

{fizzpy-0.3.0 → fizzpy-0.4.0}/uv.lock

@@ -46,7 +46,7 @@ wheels = [
 
 [[package]]
 name = "fizzpy"
-version = "0.1.0"
+version = "0.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "certifi" },