Release v25.10.2 - Critical Fixes for Source Distribution and NVX; Cryptographic Chain-of-Custody

[oberstet]

🎉 Autobahn v25.10.2 Released

We're pleased to announce the release of Autobahn v25.10.2, now available on PyPI!

This release includes critical fixes for source distribution integrity and CPU architecture compatibility, plus comprehensive cryptographic verification throughout the CI/CD pipeline.

📦 Installation

pip install -U autobahn

Verify the release:

import autobahn
print(autobahn.__version__)  # Should show: 25.10.2

---

🔧 Critical Fixes

1. Critical: Source Distribution Corruption (#1735, #1738)

Issue: Source distribution tarballs on PyPI were corrupted due GitHub Actions with cross-workflow artifacts behavior (#1735 (comment)) and CRLF line ending issues in Windows CI builds, causing installation failures with tools like uv.

Fix:

• Implemented cryptographic chain-of-custody verification for all build artifacts
• Added comprehensive integrity checks preventing corrupted packages from reaching PyPI
• Added .gitattributes with * text=auto eol=lf to enforce LF line endings across all platforms

Impact: Users can now reliably install from source distribution without corruption errors.

# Now works correctly
pip install --no-binary autobahn autobahn==25.10.2

Related: #1735, #1738

---

2. Cryptographic Chain-of-Custody Verification

Feature: All build artifacts now use end-to-end cryptographic verification throughout the CI/CD pipeline to prevent corruption and ensure integrity.

How it works:

1. Build-time: Each workflow generates SHA256 checksums for all artifacts
2. Upload: Artifacts are uploaded with meta-checksum suffixes (e.g., wheels-macos-arm64-{sha256})
3. Download: Release workflow verifies checksums match originals before processing
4. PyPI Upload: Final verification gate - blocks upload on any checksum mismatch

Technical implementation:

• Uses OpenSSL SHA256 for all checksums
• Custom GitHub Action: wamp-proto/wamp-cicd/actions/upload-artifact-verified
• Verifies integrity across GitHub Actions artifact storage/transfer
• Automatic failure with detailed error messages on corruption detection

Example verification output:

==> Wheel Checksum Re-Verification (Chain of Custody - PyPI Upload)
OpenSSL version: OpenSSL 3.0.13 30 Jan 2024

✅ autobahn-25.10.2-cp311-cp311-manylinux1_x86_64.whl: checksum verified
✅ autobahn-25.10.2-cp312-cp312-win_amd64.whl: checksum verified
...
✅ All wheel checksums verified successfully (16 wheels)

Chain of custody confirmed: build workflows → PyPI upload
No corruption detected during artifact transfer.
Safe to proceed with PyPI upload.

Impact: Guarantees bit-for-bit integrity from build to PyPI. The corruption issue (#1735) cannot happen again.

---

3. Critical: NVX Native Compilation CPU Architecture (#1717)

Issue: Pre-built wheels were compiled with -march=native, causing SIGILL (Illegal Instruction) crashes on CPUs different from the build machine.

Fix: All pre-built wheels now use safe portable baselines ensuring compatibility with 99%+ of systems:

x86-64 baseline: -march=x86-64-v2

• Microarchitecture level 2 (2009+)
• Includes: SSE4.2, POPCNT, SSSE3, SSE4.1
• Compatible with: Intel Nehalem+, AMD Bulldozer+ (2009+)
• Coverage: ~99% of x86-64 CPUs from 2010 onwards

ARM64 baseline: -march=armv8-a

• ARMv8-A baseline architecture
• Compatible with: Raspberry Pi 4/5, AWS Graviton, Apple M1/M2/M3/M4
• Coverage: All 64-bit ARM CPUs

Binary Wheels Available on PyPI:

PyPI now lists 16 binary wheels covering major platforms:

Platform	Python	Architecture	Wheel Filename
Linux (manylinux)	3.11	x86-64	autobahn-25.10.2-cp311-cp311-manylinux*.whl
Linux (manylinux)	3.12	x86-64	autobahn-25.10.2-cp312-cp312-manylinux*.whl
Linux (manylinux)	3.13	x86-64	autobahn-25.10.2-cp313-cp313-manylinux*.whl
Linux (manylinux)	PyPy 3.10	x86-64	autobahn-25.10.2-pp310-pypy310_pp73-manylinux*.whl
Linux (manylinux)	3.11	ARM64	autobahn-25.10.2-cp311-cp311-manylinux*_aarch64.whl
Linux (manylinux)	3.13	ARM64	autobahn-25.10.2-cp313-cp313-manylinux*_aarch64.whl
Linux (manylinux)	PyPy 3.11	ARM64	autobahn-25.10.2-pp311-pypy311_pp73-manylinux*_aarch64.whl (2 variants)
Linux (native)	3.11	x86-64	autobahn-25.10.2-cp311-cp311-linux_x86_64.whl (no NVX)
Linux (native)	3.12	x86-64	autobahn-25.10.2-cp312-cp312-linux_x86_64.whl (no NVX)
macOS	3.11	ARM64	autobahn-25.10.2-cp311-cp311-macosx_11_0_arm64.whl
macOS	3.12	ARM64	autobahn-25.10.2-cp312-cp312-macosx_11_0_arm64.whl
macOS	3.13	ARM64	autobahn-25.10.2-cp313-cp313-macosx_11_0_arm64.whl
Windows	3.11	x86-64	autobahn-25.10.2-cp311-cp311-win_amd64.whl
Windows	3.12	x86-64	autobahn-25.10.2-cp312-cp312-win_amd64.whl
Source	-	all	autobahn-25.10.2.tar.gz

NVX Performance: All wheels include NVX (Native Vector Extensions) for high-performance WebSocket operations using portable SIMD instructions.

Source Installations: When installing from source, NVX automatically optimizes for your specific CPU using -march=native for maximum performance.

# Install from source with native optimizations
pip install --no-binary autobahn autobahn==25.10.2

Impact: No more SIGILL crashes on incompatible CPUs. Pre-built wheels work reliably across diverse hardware.

Related: #1717

---

✨ Additional Improvements

Improved: NVX Runtime Logging (#1737)

When users explicitly disable NVX acceleration via AUTOBAHN_USE_NVX=0, the message is now logged at info level instead of emitting a noisy RuntimeWarning.

Before:

RuntimeWarning: NVX native acceleration is available but explicitly disabled via AUTOBAHN_USE_NVX=0. Falling back to pure Python implementations.

After:

INFO: NVX native acceleration is available but explicitly disabled via AUTOBAHN_USE_NVX=0. Falling back to pure Python implementations.

Impact: Cleaner application logs when testing or benchmarking pure Python WebSocket performance.

Related: #1737

---

Automated Tag-Triggered Releases

CI/CD workflows now trigger automatically when version tags are pushed:

git tag -a v25.10.2 -m "Release v25.10.2"
git push upstream v25.10.2

This automatically:

• Builds all wheels (Linux, macOS, Windows, manylinux, ARM64)
• Runs full test suite (wstest conformance, unit tests)
• Creates GitHub Release with artifacts
• Publishes to PyPI
• Triggers Read the Docs build

---

📚 Documentation

• PyPI: https://pypi.org/project/autobahn/25.10.2/
• Read the Docs: https://autobahn.readthedocs.io/
• Sources: https://github.com/crossbario/autobahn-python/tree/v25.10.2

---

🔍 Changelog

Critical Fixes:

• [ISSUE] 25.10.1 crc errors in .tar.gz #1735: Fix source distribution corruption from Windows CRLF line endings
• [ISSUE] Failed to download and build autobahn==25.10.1 #1738: Fix uv installation failures (same root cause as [ISSUE] 25.10.1 crc errors in .tar.gz #1735)
• [ISSUE] 25.9.1 Illegal instruction SIGILL in nvx/_xormasker.py #1717: Fix SIGILL crashes from unsafe CPU architecture flags in pre-built wheels

Improvements:

• [ISSUE] RuntimeWarning: NVX native acceleration is available but explicitly disabled via AUTOBAHN_USE_NVX=0 #1737: Change NVX disable message from RuntimeWarning to log.info()
• CI/CD: Add cryptographic chain-of-custody verification for all artifacts
• CI/CD: Add tag triggers to all workflows for automated releases
• CI/CD: Add portable CPU architecture baselines (x86-64-v2, armv8-a)
• CI/CD: Fix CRLF normalization in artifact verification scripts

Known Issues:

• [ISSUE] SIGILL {si_signo=SIGILL, si_code=ILL_ILLOPN, si_addr=0x7614dc67dea0} on WSL2 VM ubuntu in version autobahn==23.6.2 #1736: SIGILL crashes on WSL2 (workaround: AUTOBAHN_USE_NVX=0)

---

💬 Feedback

If you encounter any issues with this release:

1. Check existing issues: https://github.com/crossbario/autobahn-python/issues
2. Report new issues: https://github.com/crossbario/autobahn-python/issues/new
3. Discussions: https://github.com/crossbario/autobahn-python/discussions

---

🚀 What's Next

Upcoming improvements in future releases:

• Add AUTOBAHN_BUILD_NVX environment variable to skip NVX compilation during build #1752: Add AUTOBAHN_SKIP_NVX environment variable for build-time NVX control
• Docs: Add consolidated NVX reference page for all environment variables and runtime controls #1753: Consolidated NVX documentation page
• CI/CD: Improve GitHub Release naming, Discussion category organization, et al #1754: Improved GitHub Release naming and Discussion category organization

---

Happy WebSocketing! 🎈