Rebuild cryptography 50+ on Intel Mac when find-links is stale

[jakub-kocka]

Description

The cryptography package > 49.0.0 was not correctly handled to trigger the complete build with the OpenSSL bundling/linking process, so this produced that it was not available on Espressif's PyPI. Then the esptool (since it is not officially supported on Intel Mac) tried to build the package from the sdist, which failed since the esptool's pipeline is not ready for this.

This fix should correctly build and upload the cryptography 49+ packages for the esptool.

It would be good to follow up on this PR with an esptools PR that will force the cryptography --only-binary flag ... I believe esptool's pipeline is not ready for any of the platform and architecture cryptography package building, so it should not be hard, since we won't need to distinguish between them and do it for all of them.

Related

• Failing esptool pipeline: https://github.com/espressif/esptool/actions/runs/33168041300/job/98838068472

Testing

• Build pipeline (Intel Mac): https://github.com/espressif/idf-python-wheels/actions/runs/33381502484
• Build pipeline for all the platforms and architectures: https://github.com/espressif/idf-python-wheels/actions/runs/33384316220

---

Checklist

Before submitting a Pull Request, please ensure the following:

• 🚨 This PR does not introduce breaking changes.
• All CI checks (GH Actions) pass.
• Documentation is updated as needed.
• Tests are updated or added as necessary.
• Code is well-commented, especially in complex areas.
• Git history is clean — commits are squashed to the minimum necessary.

[github-actions]

	Messages
📖	🎉 Good Job! All checks are passing!

👋 Hello jakub-kocka, we appreciate your contribution to this project!

---

Click to see more instructions ...

This automated output is generated by the PR linter DangerJS, which checks if your Pull Request meets the project's requirements and helps you fix potential issues.

DangerJS is triggered with each push event to a Pull Request and modify the contents of this comment.

Please consider the following:
- Danger mainly focuses on the PR structure and formatting and can't understand the meaning behind your code or changes.
- Danger is not a substitute for human code reviews; it's still important to request a code review from your colleagues.
- To manually retry these Danger checks, please navigate to the Actions tab and re-run last Danger workflow.

Review and merge process you can expect ...

We do welcome contributions in the form of bug reports, feature requests and pull requests.

1. An internal issue has been created for the PR, we assign it to the relevant engineer.
2. They review the PR and either approve it or ask you for changes or clarifications.
3. Once the GitHub PR is approved we do the final review, collect approvals from core owners and make sure all the automated tests are passing.
- At this point we may do some adjustments to the proposed change, or extend it by adding tests or documentation.
4. If the change is approved and passes the tests it is merged into the default branch.

Generated by 🚫 dangerJS against a6e3dc1

[Copilot]

Pull request overview

This PR fixes macOS Intel (macos_x86_64) handling for cryptography 49+ so that wheel builds are not incorrectly skipped when --find-links contains an older or wrong-platform cryptography wheel; instead, the pipeline rebuilds from sdist using the OpenSSL 4 path to ensure the expected artifacts are produced and published.

Changes:

• Add helper logic to detect when find-links is stale for macOS Intel cryptography and force a rebuild rather than skipping.
• Wire the rebuild logic into both build_wheels.py and build_wheels_from_file.py.
• Add unit tests covering rebuild vs skip decisions, plus update docs and the local spike script.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
_helper_functions.py	Adds macOS Intel cryptography “rebuild instead of skip” decision logic based on PyPI latest matching release vs local macOS x86_64 wheels in find-links.
build_wheels.py	Uses the new helper to rebuild cryptography on macOS Intel when find-links would otherwise cause a skip.
build_wheels_from_file.py	Applies the same rebuild-vs-skip logic for requirements processed from a file.
test_build_wheels.py	Adds tests for the macOS Intel rebuild decision under stale/mismatched find-links scenarios.
test_build_wheels_from_file.py	Adds a test ensuring macOS Intel does not skip when find-links is stale for cryptography.
scripts/spike_cryptography_macos_intel_openssl4.sh	Updates the spike build command to allow cryptography>=49 (unbounded).
README.md	Documents the new behavior: find-links should not prevent macOS Intel cryptography rebuilds when newer matching releases exist on PyPI.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dobairoland]

It would be better to have these in config files instead of code hacks. But if it works then let us go with this for now.

[jakub-kocka]

@dobairoland, thank you for the review. I believe this does not need to be that "universal" in config files - since we are basically taking care of supporting the whole cryptography build pipeline for Intel Mac when it was officially abandoned. Mainly for the esptool, but I believe it might come in handy.

[peterdragun]

LGTM. This seems to have fixed the pipeline; see: https://github.com/espressif/esptool/actions/runs/33368240247/job/99460897081

Thank you!

[jakub-kocka]

Thank you, guys, for the review and verification. I am merging this.