cryptography icon indicating copy to clipboard operation
cryptography copied to clipboard

refs #11199 attempt to test on windows arm64

Open alex opened this issue 8 months ago • 3 comments

alex avatar Apr 15 '25 12:04 alex

this is now blocked until https://github.com/actions/partner-runner-images/issues/77

alex avatar Apr 15 '25 23:04 alex

@alex hey there! Is rust toolchain is only blocker here?

khmyznikov avatar May 05 '25 11:05 khmyznikov

It's the current blocker. Hacking around that limitation (which we will not merge) produces a segfault, but I have no intent of debugging that until Microsoft resolves the toolchain limitation.

alex avatar May 05 '25 11:05 alex

Good news, we now have Rust in the windows image. Bad news is that we're experiencing segfaults.

https://github.com/openssl/openssl/issues/26239 indicates there was at least one known issue.

Unfortunately, https://github.com/actions/partner-runner-images/blob/main/images/arm-windows-11-image.md doesn't document what software versions are in what image versions.

alex avatar Jul 17 '25 11:07 alex

Looks like it is indeed outdated. Visual Studio 2022 Developer Command Prompt v17.13.2

So now we wait some indeterminate amount of time for arm to update their images again. I have serious qualms with depending on these partner images given how poorly they're executing on this.

reaperhulk avatar Jul 17 '25 14:07 reaperhulk

filed https://github.com/actions/partner-runner-images/issues/113

alex avatar Jul 17 '25 14:07 alex

The fix for OpenSSL should arrive hopefully next week

khmyznikov avatar Jul 26 '25 09:07 khmyznikov

Great to hear. It would be extremely helpful if things like this were communicated/visible in the official repo.

alex avatar Jul 26 '25 10:07 alex

@alex Sure! I’ll make an effort to improve communication. The new image should already be available.

khmyznikov avatar Jul 29 '25 11:07 khmyznikov

rustup appears to now be missing from the image

alex avatar Jul 29 '25 12:07 alex

@alex they asked to try once again and they'll reach out to GH team to see if there's any other issues with the runners. Meanwhile, here is a PR for changes: https://github.com/actions/partner-runner-images/pull/116/files

khmyznikov avatar Jul 29 '25 15:07 khmyznikov

That package information is a major improvement, but ideally arm would move to doing GH releases that contain that data + information about what has changed much like the GH-owned images do (e.g., https://github.com/actions/runner-images/releases/tag/macos-14-arm64%2F20250723.1691). Do you know if that's the intent?

As is, we have a situation where Arm is providing images that aren't consistent with GH's own, doesn't accurately list information about the software manifest on them, makes it nearly impossible to tell what has changed, appears to have regressions that are suggestive of automation issues, and updates them more slowly than GH does. All of this makes us reluctant to depend on them.

reaperhulk avatar Jul 29 '25 15:07 reaperhulk

rustup is still not installed (or not on the PATH)

alex avatar Jul 29 '25 15:07 alex

@reaperhulk the update frequency was slow initially due to a few internal certification issues, but these were resolved and shouldn't impact future releases. Currently, a different team from Arm manages the images, as they have more expertise in this area (Arm) compared to the regular engineering team.

Thanks for providing this feedback, I'll ensure everything is taken into consideration, and the process will be improved to meet everyone's expectations.

khmyznikov avatar Jul 29 '25 17:07 khmyznikov

@alex Rust is now installed in the latest image update. Latest versions and tools here - https://github.com/actions/partner-runner-images/blob/main/images/arm-windows-11-image.md. Please let us know if you face any issues.

pbk8s avatar Jul 30 '25 16:07 pbk8s

Hey @alex , are there any other blockers keeping this from moving forward? Also, is there an ETA for getting support landed?

khmyznikov avatar Aug 04 '25 09:08 khmyznikov

We’re going to merge this, but if we see regressions or stability issues we’ll revert. This project has a strict policy for all CI jobs to be passing to merge any code, so issues like we’ve seen the past several months would have blocked us entirely.

We aren’t planning to ship a wheel until our next release, which does not have a date.

reaperhulk avatar Aug 04 '25 13:08 reaperhulk

I think this needs a test coverage, because openssl is known to crash on arm64 unless debug binary is used and cryptography uses openssl. https://github.com/openssl/openssl/issues/27030

saschanaz avatar Aug 04 '25 13:08 saschanaz

We are running tests. They were crashing, but the issue we saw was resolved with a recent MSV release.

alex avatar Aug 04 '25 13:08 alex

Oh, I see the test, and I see that https://github.com/sfackler/rust-openssl/pull/2407 doesn't crash anymore on CI (even though it does crash locally for me 🤔). Thank you!

saschanaz avatar Aug 04 '25 16:08 saschanaz

If you want to see if our artifacts work for you locally: https://github.com/pyca/infra/actions/runs/16662850185

reaperhulk avatar Aug 04 '25 16:08 reaperhulk

@reaperhulk is there any nightly builds available broadly?

khmyznikov avatar Aug 05 '25 09:08 khmyznikov

It's possible to go into CI and manually download a wheel if you want, but they're not published anywhere, no.

On Tue, Aug 5, 2025 at 5:47 AM Gleb Khmyznikov @.***> wrote:

khmyznikov left a comment (pyca/cryptography#12770) https://github.com/pyca/cryptography/pull/12770#issuecomment-3154398591

@reaperhulk https://github.com/reaperhulk is there any nightly builds available broadly?

— Reply to this email directly, view it on GitHub https://github.com/pyca/cryptography/pull/12770#issuecomment-3154398591, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAAGBAKQBXJPUDOU64A7PT3MB4T5AVCNFSM6AAAAAB3FRQSNCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCNJUGM4TQNJZGE . You are receiving this because you were mentioned.Message ID: @.***>

-- All that is necessary for evil to succeed is for good people to do nothing.

alex avatar Aug 05 '25 10:08 alex

@alex I guess it's not possible to do via CI? I'm asking because we could start the contribution to other projects using the links to nightly builds as temporally solution to prepare the PRs, as we did for scikit-learn.

khmyznikov avatar Aug 06 '25 08:08 khmyznikov

For everyone who need to test their GH Actions:

steps:
  - name: Download cryptography wheel
    uses: robinraju/[email protected]
    with:
      repository: "khmyznikov/PyEnv-WoA-State"
      tag: "cryptography-46.0.0"
      fileName: "*.whl"
      out-file-path: "wheels"

  - name: Install from wheel
    run: |
      python -m pip install --find-links=wheels cryptography
      # Verify installation
      python -c "import cryptography; print(f'Installed cryptography version: {cryptography.__version__}')"

I've created temp release while we are waiting for official wheels.

khmyznikov avatar Aug 12 '25 17:08 khmyznikov

https://pypi.org/project/cryptography/#files still doesn't show the arm64 wheel for 45.0.7, any idea what went wrong?

saschanaz avatar Sep 04 '25 08:09 saschanaz

Seems it's just because this didn't enter 45.0.x branch, do you think it makes sense to do so?

saschanaz avatar Sep 04 '25 08:09 saschanaz

We aren’t planning to backport windows arm64 wheels, they will appear in the next major release (46.0.0)

reaperhulk avatar Sep 04 '25 09:09 reaperhulk

@reaperhulk Eagerly waiting for the release :)

Greenie0701 avatar Sep 11 '25 17:09 Greenie0701