Can't install helix client on arm32 Ubuntu 22.04

[sbomer]

Attempting to install the helix client following the pattern used in other Dockerfiles fails while trying to install (by building from source) the cryptography wheel:

#6 29.46   × Getting requirements to build wheel did not run successfully.
#6 29.46   │ exit code: 1
#6 29.46   ╰─> [33 lines of output]
#6 29.46       Traceback (most recent call last):
#6 29.46         File "/usr/local/lib/python3.10/dist-packages/pip/_vendor/pep517/in_process/_in_process.py", line 363, in <module>
#6 29.46           main()
#6 29.46         File "/usr/local/lib/python3.10/dist-packages/pip/_vendor/pep517/in_process/_in_process.py", line 345, in main
#6 29.46           json_out['return_val'] = hook(**hook_input['kwargs'])
#6 29.46         File "/usr/local/lib/python3.10/dist-packages/pip/_vendor/pep517/in_process/_in_process.py", line 130, in get_requires_for_build_wheel
#6 29.46           return hook(config_settings)
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/build_meta.py", line 162, in get_requires_for_build_wheel
#6 29.46           return self._get_build_requires(
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/build_meta.py", line 143, in _get_build_requires
#6 29.46           self.run_setup()
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/build_meta.py", line 158, in run_setup
#6 29.46           exec(compile(code, __file__, 'exec'), locals())
#6 29.46         File "setup.py", line 1, in <module>
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/__init__.py", line 153, in setup
#6 29.46           return distutils.core.setup(**attrs)
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/_distutils/core.py", line 109, in setup
#6 29.46           _setup_distribution = dist = klass(attrs)
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/dist.py", line 459, in __init__
#6 29.46           _Distribution.__init__(
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/_distutils/dist.py", line 293, in __init__
#6 29.46           self.finalize_options()
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/dist.py", line 836, in finalize_options
#6 29.46           for ep in sorted(loaded, key=by_order):
#6 29.46         File "/usr/lib/python3/dist-packages/setuptools/dist.py", line 835, in <lambda>
#6 29.46           loaded = map(lambda e: e.load(), filtered)
#6 29.46         File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 2464, in load
#6 29.46           self.require(*args, **kwargs)
#6 29.46         File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 2487, in require
#6 29.46           items = working_set.resolve(reqs, env, installer, extras=self.extras)
#6 29.46         File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 782, in resolve
#6 29.46           raise VersionConflict(dist, req).with_context(dependent_req)
#6 29.46       pkg_resources.VersionConflict: (setuptools 59.6.0 (/usr/lib/python3/dist-packages), Requirement.parse('setuptools>=62.4'))
#6 29.46       [end of output]

(hit in https://github.com/dotnet/dotnet-buildtools-prereqs-docker/pull/1043)

It's possible to get the wheel building using virtualenv, but I don't know how the helix client would need to be set up to use the virtualenv.

This points to a larger set of concerns about the python dependencies:

• We install them with --break-system-packages which is not recommended.
  • Building the cryptography wheel from source introduces a dependency on the rust toolchain starting with version 3.5.

• cryptography doesn't appear to be supported for arm32.

  I believe this is why we don't hit problems installing this dependency on other platforms. For example, on amd64 the cryptography package is available as a binary wheel, and we don't have to build it from source:

  root@2ddf6b50d0c4:/# pip install cryptography
  Collecting cryptography
   Downloading cryptography-42.0.7-cp39-abi3-manylinux_2_28_x86_64.whl (3.8 MB)
      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.8/3.8 MB 11.3 MB/s eta 0:00:00
  Collecting cffi>=1.12
   Downloading cffi-1.16.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (443 kB)
      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 443.9/443.9 KB 43.7 MB/s eta 0:00:00
  Collecting pycparser
   Downloading pycparser-2.22-py3-none-any.whl (117 kB)
      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 117.6/117.6 KB 16.2 MB/s eta 0:00:00
  Installing collected packages: pycparser, cffi, cryptography
  Successfully installed cffi-1.16.0 cryptography-42.0.7 pycparser-2.22
  WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
  root@2ddf6b50d0c4:/# 

It looks like this dependency has been a recurring problem based on discussions in https://github.com/dotnet/arcade/issues/13186, https://github.com/dotnet/dnceng/issues/465, and related issues, so I wanted to ask for guidance.

@richlander @agocke

[richlander]

Quite separately, I wonder what the plan is for manylinux2014 wheels. They are built on CentOS 7, which goes EOL shortly.

[lbussell]

This is a recurring issue for the buildtools-prereqs repo:

• https://github.com/dotnet/dotnet-buildtools-prereqs-docker/issues/903
• https://github.com/dotnet/dotnet-buildtools-prereqs-docker/issues/796
• https://github.com/dotnet/dotnet-buildtools-prereqs-docker/issues/359

[richlander]

We now have a working solution.

There are two remaining problems:

• Addressing the cryptography package dependency and needing to build the underlying Rust source, as a long-term solution/policy. This is the first time we've come across that, AFAIK.
• Maintaining Helix Dockerfiles is quite expensive and they are very difficult to test, in part because pip install is done both in our Dockerfiles and in the Helix scripts.