From 2afcef33f67e231c6c146d8f649223a2191838d0 Mon Sep 17 00:00:00 2001 From: Nathan Goldbaum Date: Fri, 19 Jun 2026 11:50:50 -0600 Subject: [PATCH 1/2] Use pyo3-build-config for cryptography-cffi build script --- Cargo.lock | 1 + src/rust/cryptography-cffi/Cargo.toml | 1 + src/rust/cryptography-cffi/build.rs | 31 +++++++++++++++++---------- 3 files changed, 22 insertions(+), 11 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 28ba572e0649..28b569e9c89d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -58,6 +58,7 @@ dependencies = [ "cc", "openssl-sys", "pyo3", + "pyo3-build-config", ] [[package]] diff --git a/src/rust/cryptography-cffi/Cargo.toml b/src/rust/cryptography-cffi/Cargo.toml index 74214d3305ec..44d479bc9490 100644 --- a/src/rust/cryptography-cffi/Cargo.toml +++ b/src/rust/cryptography-cffi/Cargo.toml @@ -13,6 +13,7 @@ openssl-sys.workspace = true [build-dependencies] cc.workspace = true +pyo3-build-config.workspace = true [lints.rust] unexpected_cfgs = { level = "warn", check-cfg = ['cfg(python_implementation, values("CPython", "PyPy"))'] } diff --git a/src/rust/cryptography-cffi/build.rs b/src/rust/cryptography-cffi/build.rs index ea99505434e9..c95ea9031b8a 100644 --- a/src/rust/cryptography-cffi/build.rs +++ b/src/rust/cryptography-cffi/build.rs @@ -6,6 +6,8 @@ use std::env; use std::path::Path; use std::process::Command; +use pyo3_build_config::{PythonAbiKind, StableAbi}; + fn main() { let target = env::var("TARGET").unwrap(); let openssl_static = env::var("OPENSSL_STATIC") @@ -102,24 +104,31 @@ fn main() { build.include(python_include); } - let is_free_threaded = run_python_script( - &python, - "import sysconfig; print(bool(sysconfig.get_config_var('Py_GIL_DISABLED')), end='')", - ) - .unwrap() - == "True"; + // Derive the target ABI from what pyo3 is targeting for this build, + // resolved from the abi3/abi3t Cargo features + let config = pyo3_build_config::get(); - // Enable abi3 mode if we're not using PyPy or the free-threaded build - if !(python_impl == "PyPy" || is_free_threaded) { - // cp39 (Python 3.9 to help our grep when we some day drop 3.9 support) - build.define("Py_LIMITED_API", "0x030900f0"); + match config.target_abi().kind() { + // GIL-enabled limited API (abi3): a single wheel for CPython 3.9 to 3.14 (not free-threaded) + PythonAbiKind::Stable(StableAbi::Abi3) => { + // cp39 (Python 3.9 to help our grep when we some day drop 3.9 support) + build.define("Py_LIMITED_API", "0x030900f0"); + } + // Free-threaded limited API (abi3t): a single wheel CPython 3.15+. + PythonAbiKind::Stable(StableAbi::Abi3t) => { + // cp315 (Python 3.15 to help our grep when we some day drop 3.15 support) + build.define("Py_LIMITED_API", "0x030f00f0"); + } + // PyPy, or a free-threaded build older than abi3t (e.g. 3.14t): + // compile against the full, version-specific ABI. + PythonAbiKind::VersionSpecific(_) => {} } if cfg!(windows) { build.define("WIN32_LEAN_AND_MEAN", None); // python.h doesn't set this on the Windows free-threaded build // see https://github.com/python/cpython/issues/127294 - if is_free_threaded { + if config.is_free_threaded() { build.define("Py_GIL_DISABLED", "1"); } From d3e2f737d9ab0535935dcf550857878961d9a86d Mon Sep 17 00:00:00 2001 From: Nathan Goldbaum Date: Fri, 19 Jun 2026 11:52:12 -0600 Subject: [PATCH 2/2] Add 3.15 CI --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5c7917387e2a..dee4bec70eb8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,6 +28,8 @@ jobs: - {VERSION: "3.14", NOXSESSION: "rust"} - {VERSION: "3.12", NOXSESSION: "docs", OPENSSL: {TYPE: "openssl", VERSION: "4.0.1"}} - {VERSION: "3.14t", NOXSESSION: "rust,tests"} + - {VERSION: "3.15-dev", NOXSESSION: "rust,tests"} + - {VERSION: "3.15t-dev", NOXSESSION: "rust,tests"} - {VERSION: "pypy-3.11", NOXSESSION: "tests-nocoverage"} - {VERSION: "3.14", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "4.0.1", CONFIG_FLAGS: "no-engine no-rc2 no-srtp no-ct no-psk"}} - {VERSION: "3.14", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "4.0.1", CONFIG_FLAGS: "no-legacy", NO_LEGACY: "0"}} @@ -286,6 +288,8 @@ jobs: - {VERSION: "3.9", NOXSESSION: "tests"} - {VERSION: "3.14", NOXSESSION: "tests"} - {VERSION: "3.14t", NOXSESSION: "tests"} + - {VERSION: "3.15-dev", NOXSESSION: "tests"} + - {VERSION: "3.15t-dev", NOXSESSION: "tests"} timeout-minutes: 15 steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 @@ -347,6 +351,8 @@ jobs: - {VERSION: "3.9", NOXSESSION: "tests-nocoverage"} - {VERSION: "3.14", NOXSESSION: "tests"} - {VERSION: "3.14t", NOXSESSION: "tests"} + - {VERSION: "3.15-dev", NOXSESSION: "tests"} + - {VERSION: "3.15t-dev", NOXSESSION: "tests"} include: # Windows on ARM is in a stability validation period; the work # step uses `continue-on-error` only for this entry so transient