From 83ae17e6210fdca4856ad44d90d07b9847b58fd6 Mon Sep 17 00:00:00 2001 From: "Shane B." Date: Sun, 16 Aug 2026 08:55:23 +0200 Subject: [PATCH] Keep Intel Macs off a source build of cryptography The Intel build still demanded macOS 15 after the Homebrew Python was removed, and the file setting it was still libcrypto.3.dylib. The cause is one version boundary: cryptography publishes macOS wheels for arm64 only from 49.0.0 on, so Intel had nothing to install and compiled it against the runner's OpenSSL - Homebrew's, preinstalled on GitHub's images - which PyInstaller then bundled. 48.0.0 is the last release with a universal2 wheel, and it targets 10.9. Constrained by marker so only darwin x86_64 is held back; the lock now carries 48.0.1 for that platform and 50.0.0 everywhere else. Verified here only that the lock resolves, installs and passes the suite - this machine is arm64, so it takes the 50.0.0 branch. The Intel path is CI's to prove. --- python/pyproject.toml | 17 +++++++++++++++++ python/uv.lock | 31 ++++++++++++++++++++++++++++++- 2 files changed, 47 insertions(+), 1 deletion(-) diff --git a/python/pyproject.toml b/python/pyproject.toml index d7dbbad0..d33faa4d 100644 --- a/python/pyproject.toml +++ b/python/pyproject.toml @@ -41,6 +41,23 @@ dependencies = [ # this directory, so there is nothing to build and no version to declare. package = false +# Intel Macs must not build cryptography from source, and 49.0.0 is where they started having to. +# +# cryptography publishes macOS wheels for arm64 only from 49 onward; 48.0.0 is the last with a +# universal2 wheel, and that one targets macOS 10.9. Without a wheel, the Intel release build +# compiles it against whatever OpenSSL the runner has - Homebrew's, preinstalled on GitHub's +# macOS images - and PyInstaller then bundles Homebrew's libcrypto.3.dylib. A bottle's minimum +# macOS is baked in when Homebrew builds it, so the resulting binary demanded macOS 15 and +# scripts/check_macos_min_version.py refused it. Which was correct: the macOS-local export route +# needs macOS 14 or earlier, so a 15-only binary is useless to exactly the people who need an +# Intel build. +# +# Scoped by marker so only Intel macOS is held back - every other platform keeps the current +# release. Remove it if cryptography ever ships an x86_64 macOS wheel again. +constraint-dependencies = [ + "cryptography<49 ; sys_platform == 'darwin' and platform_machine == 'x86_64'", +] + [tool.uv.sources] FindMy = { git = "https://github.com/parawanderer/FindMy.py", branch = "feat/icloud-keychain-export" } diff --git a/python/uv.lock b/python/uv.lock index 85a91402..a04e92af 100644 --- a/python/uv.lock +++ b/python/uv.lock @@ -1,6 +1,13 @@ version = 1 revision = 3 requires-python = ">=3.10" +resolution-markers = [ + "platform_machine == 'x86_64' and sys_platform == 'darwin'", + "platform_machine != 'x86_64' or sys_platform != 'darwin'", +] + +[manifest] +constraints = [{ name = "cryptography", marker = "platform_machine == 'x86_64' and sys_platform == 'darwin'", specifier = "<49" }] [[package]] name = "aiohappyeyeballs" @@ -514,10 +521,31 @@ toml = [ { name = "tomli", marker = "python_full_version <= '3.11'" }, ] +[[package]] +name = "cryptography" +version = "48.0.1" +source = { registry = "https://pypi.org/simple" } +resolution-markers = [ + "platform_machine == 'x86_64' and sys_platform == 'darwin'", +] +dependencies = [ + { name = "cffi", marker = "platform_python_implementation != 'PyPy'" }, + { name = "typing-extensions", marker = "python_full_version < '3.11'" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/12/45/870e7f4bef50e5f53b9f51d4428aee5290eedf58ba443f16b1ebb7ab8e66/cryptography-48.0.1.tar.gz", hash = "sha256:266f4ee051abb2f725b74ef8072b521ce1feacf685a3364fa6a6b45548db791a", size = 832989, upload-time = "2026-06-09T22:32:31.8Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/1b/bc/ee4137cbbe105652c0ee4252792b78fc8e7afa4b8e61d9d5dc05a7f45731/cryptography-48.0.1-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:3e4a1a3232eef2e6c732827d5722db29a0cc8b27af2a4d865b094cf954be9ca1", size = 8008324, upload-time = "2026-06-09T22:31:00.702Z" }, + { url = "https://files.pythonhosted.org/packages/42/06/3e768b4c3bc78201583fa35a0e18f640dd782ff41afba88f8545481a8874/cryptography-48.0.1-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:f817adc181390bd54f2f700107a7419040fb7c1bdf2fc26f36551a06a68c3345", size = 7989830, upload-time = "2026-06-09T22:31:07.8Z" }, + { url = "https://files.pythonhosted.org/packages/ca/6c/00fa2a95997164c8b2072ce327c23d4ab20809ccc323ea5fab91e53a4bba/cryptography-48.0.1-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:4fdc69f8e4316bcf0c8c8ec1f26f285d12e8142d88d96c876a59a03be3f6ae67", size = 7987408, upload-time = "2026-06-09T22:32:20.777Z" }, +] + [[package]] name = "cryptography" version = "50.0.0" source = { registry = "https://pypi.org/simple" } +resolution-markers = [ + "platform_machine != 'x86_64' or sys_platform != 'darwin'", +] dependencies = [ { name = "cffi", marker = "platform_python_implementation != 'PyPy'" }, { name = "typing-extensions", marker = "python_full_version < '3.11'" }, @@ -637,7 +665,8 @@ dependencies = [ { name = "anisette" }, { name = "beautifulsoup4" }, { name = "bleak" }, - { name = "cryptography" }, + { name = "cryptography", version = "48.0.1", source = { registry = "https://pypi.org/simple" }, marker = "platform_machine == 'x86_64' and sys_platform == 'darwin'" }, + { name = "cryptography", version = "50.0.0", source = { registry = "https://pypi.org/simple" }, marker = "platform_machine != 'x86_64' or sys_platform != 'darwin'" }, { name = "protobuf" }, { name = "srp" }, { name = "typing-extensions" },