From ef980e4d09d1045349e921c3d10cc9e0ad8a5f24 Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Thu, 9 Jul 2026 17:00:36 -0700 Subject: [PATCH] build: declare the setuptools build backend floor (F-5426) [build-system] declared bare `setuptools`, so isolated builds resolved whatever version the index served at build time. This repo has no uv.lock, so CI's `uv build --wheel` re-resolves the backend on every run. Declare `setuptools>=77`. Nothing was broken before this: an unpinned resolver always fetched a recent backend, so the build worked. The floor is measured, not chosen. The PEP 639 `license` expression and `license-files` key already in this file each require setuptools >= 77 independently (76 and older reject either one alone, while the older `license = {file = ...}` table form passes), so the project had an undeclared >= 77 requirement that stayed invisible precisely because the version floated. Declaring it keeps a build environment pinned below 77 from failing mid-build on an opaque `project.license` config error with no hint that the fix is an upgrade. No upper bound, matching the floor-only convention of every other bound in this file (`cffi>=1.17`, `typing-extensions>=4.4.0`). A ceiling would not address the reported risk anyway -- a malicious point release satisfies any range, so only hash-pinned build requirements help there -- and setuptools ships majors often enough (7 since 2025-03, with 81 and 82 two days apart) that a stale ceiling silently excludes working versions instead of protecting anything. Verified: builds at 77.0.3 and 83.0.0, 76.1.0 refused at resolve time, License-Expression intact in wheel METADATA, ruff clean, 196 passed. --- pyproject.toml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index e227c7a..08af907 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -31,7 +31,9 @@ dependencies = [ Homepage = "https://github.com/wolfssl/wolfcrypt-py" [build-system] -requires = ["setuptools", "cffi>=1.17"] +# setuptools >= 77 is required for the PEP 639 `license` expression and +# `license-files` above; 76 and older reject them. +requires = ["setuptools>=77", "cffi>=1.17"] build-backend = "setuptools.build_meta:__legacy__" [dependency-groups]