build: declare the setuptools build backend floor (F-5426)

[MarkAtwood]

Problem

pyproject.toml declares setuptools as a PEP 517 build requirement with no version bound:

requires = ["setuptools", "cffi>=1.17"]

In an isolated build (the PEP 517 default), the frontend resolves whatever setuptools the index currently serves before running the backend. This repo has no uv.lock, so CI's uv build --wheel re-resolves the backend on every run.

Nothing is broken today: an unpinned resolver always picks a recent backend, so the build works. This is about declaring what the project actually requires.

Fix

requires = ["setuptools>=77", "cffi>=1.17"]

The floor is measured, not chosen. The PEP 639 license = "GPL-3.0-or-later OR LicenseRef-WolfSSL" expression and the license-files key already in this file each require setuptools >= 77 independently — 76.1.0 rejects either one on its own, while the older license = {file = ...} table form passes. So the project already had an undeclared >= 77 requirement that stayed invisible precisely because the version floated. Without this, a build environment that pins below 77 for unrelated reasons fails mid-build on an opaque project.license must be valid exactly by one definition error, with no hint that the fix is a setuptools upgrade.

No upper bound, which is a change from the first version of this PR. Reasons:

• A ceiling does not address the reported risk. A malicious point release satisfies any range; only hash-pinned build requirements help there.
• setuptools has shipped 7 majors since 2025-03 (81 and 82 two days apart). A ceiling needs bumping several times a year, and a stale one silently excludes working versions instead of protecting anything — this PR's original <81 already excluded the current 83.
• Every other bound in this file is floor-only (cffi>=1.17, typing-extensions>=4.4.0).

Hash-pinning the build environment for release builds is the real mitigation for index compromise; that is out of scope here and tracked separately.

Verification

• Builds at both 77.0.3 and 83.0.0
• 76.1.0 correctly refused at resolve time: No solution found when resolving: setuptools>=77
• License-Expression: GPL-3.0-or-later OR LicenseRef-WolfSSL intact in wheel METADATA
• ruff check clean; pytest tests 196 passed, 7 skipped

Reported by static analysis (Fenrir finding F-5426).

[fenrir-sweep:released]

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

Pins the setuptools PEP 517 build requirement in pyproject.toml to reduce exposure to unvetted upstream changes during isolated builds.

Changes:

• Add an explicit version range for setuptools in [build-system].requires

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.