fix: build Linux Python wheels with vendored OpenSSL (manylinux + musllinux) (#327)

Fixes the Linux Python wheel build that broke the `0.9.3` release (and would
have broken `0.9.4`), and adds a CI guard so it cannot regress silently.

### Root cause
The `live-binance` data layer links `native-tls` -> `openssl-sys`, which needs
OpenSSL at build time. Neither wheel container provides it:
- **manylinux** ships no OpenSSL headers, and
- **musllinux** cross-compiles against a musl sysroot that has no OpenSSL at all,
  so installing a host package (`yum`/`apk`) cannot reach the cross target.

The 3-OS Python CI jobs build natively on the runner, which already has system
OpenSSL, so CI stayed green while the release container build failed.

### Fix
- New opt-in **`vendored-tls`** feature on `wickra-data` and the Python binding:
  enables `native-tls/vendored`, compiling OpenSSL from source and linking it
  statically. No system OpenSSL needed on either libc. No-op on macOS/Windows
  (Security.framework / SChannel — `openssl-sys` is never in the graph there).
- `release.yml` builds the Linux wheels with `--features vendored-tls` (replaces
  the manylinux-only `before-script-linux` header install, which could not fix
  the musllinux cross build).
- CI gains a **`manylinux` + `musllinux` container build-smoke** matrix job, so
  both container builds run on every PR. This PR's own CI is the proof the fix
  works before any release re-attempt.

### Notes
- No version bump: `0.9.4` published nowhere (the release run was cancelled
  before any publish job ran), so this lands on `0.9.4` and the tag is re-pointed
  at the fixed commit.
- Adds checks to `ci.yml` (the smoke job is now a 2-entry matrix).

This commit is contained in:

kingchenc

2026-06-17 22:26:21 +02:00

committed by

GitHub

parent e595ea8bfe

commit 41d5a7dd25

6 changed files with 100 additions and 17 deletions

									
										bindings/python/Cargo.toml
									
		+7
		
												View File
												
				@@ -17,6 +17,13 @@ publish = false

				name = "_wickra"

				crate-type = ["cdylib"]

				[features]

				# Build the bundled data layer against a statically compiled OpenSSL. The

				# release workflow (and the manylinux/musllinux CI smoke job) enable this so the

				# Linux wheels do not depend on system OpenSSL at build time. See the

				# `vendored-tls` feature in wickra-data for the rationale.

				vendored-tls = ["wickra-data/vendored-tls"]

				[lints]

				workspace = true