Record release provenance: resolve r_commit and core_commit - #18
Merged
Conversation
cibuildwheel defaults the x86_64 macOS deployment target to 10.9, but nanobind's C++17 runtime uses aligned new/delete which requires macOS 10.13+. Every macOS wheel job failed to compile nanobind (nb_type.cpp: 'aligned deallocation function ... only available on macOS 10.13 or newer'). Pin the deployment target to 10.14 for the macOS builds.
cibuildwheel's default Linux image is manylinux2014 (glibc 2.17), but numpy/scipy only publish manylinux_2_27/_2_28 wheels. In the glibc 2.17 test container those wheels are incompatible, so pip falls back to compiling scipy from source, which needs OpenBLAS/Fortran that aren't present, and the wheel smoke-test fails. Our runtime deps already require glibc >= 2.27, so manylinux2014 wheels were never installable anyway. Build and test the x86_64 Linux wheels on manylinux_2_28 to match the dependencies' wheel floor. musllinux_1_2 (the cibuildwheel default) is pinned explicitly; it already has matching numpy/scipy wheels.
Resolve the two placeholder SHAs in sync/nns_source.json by matching the vendored bytes to upstream history: - r_commit 905b8bbd: the OVVO-Financial/NNS commit that introduced the exact vendored tools/NNS_13.0.tar.gz blob (parent carried a different tarball). Version 13.0 / Date 2026-06-10, Packaged 2026-06-11 03:14 UTC. - core_commit 7f93df9d: the OVVO-Financial/NNS-core commit that authored the exact vendored extern/NNS-core include/src/CMakeLists objects (its parent had different include/src). A later commit carries the identical core forward unchanged. The release provenance gate now passes for a real tagged release. test_unknown_provenance_fails_real_release previously ran the gate against the committed manifest and relied on it carrying placeholder provenance. Point it at a fixture manifest so it tests the unknown-provenance failure behavior without depending on the real manifest being unfilled.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fills in the two
unknownprovenance SHAs insync/nns_source.json, resolved rigorously by matching the vendored bytes to upstream git history (not guesswork):r_commit905b8bbd42b3236bf88aba7f18df7a9a378dbd7bOVVO-Financial/NNScommit that introduced the exact vendoredtools/NNS_13.0.tar.gzblob (320143…); its parent carried a different tarball (246c9a…). OnNNS-Beta-Version, Version 13.0 / Date 2026-06-10,Packaged: 2026-06-11 03:14 UTC.core_commit7f93df9dff8762df870c1fbba6e03c0469be6e69OVVO-Financial/NNS-corecommit that authored the exact vendoredextern/NNS-coreinclude/src/CMakeListsobjects; its parent had differentinclude/src. A later commit (cfc25a34) carries the byte-identical core forward.The pre-existing
r_src_tree_hash(654e411…) was verified to equal the localtools/NNS/srctree hash.Effect
scripts/check_release_provenance.pynow passes for a real tagged release (previously it blocked tagged releases while these readunknown).Test change
test_unknown_provenance_fails_real_releasepreviously ran the gate against the committed manifest and depended on it carrying placeholder provenance. It now points at a fixture manifest, so it still verifies the unknown-provenance failure path without coupling to the real manifest's state. All 9 provenance/manifest tests pass; ruff clean.https://claude.ai/code/session_012bjk4Y5eT1Sva8tNJjqUSw
Generated by Claude Code