[work in progress] build manylinux2014_aarch64 wheels

Testing at this stage

.zuul.d/jobs.yaml

@@ -2,7 +2,7 @@
     name: pyca-cryptography-base
     abstract: true
     description: Run pyca/cryptography unit testing
-    run: .zuul.playbooks/playbooks/main.yaml
+    run: .zuul.playbooks/playbooks/tox/main.yaml
 
 - job:
     name: pyca-cryptography-ubuntu-focal-py38-arm64
@@ -31,3 +31,9 @@
     nodeset: centos-8-arm64
     vars:
       tox_envlist: py36
+
+- job:
+    name: pyca-cryptography-build-wheel
+    nodeset: ubuntu-bionic-arm64
+    run: .zuul.playbooks/playbooks/wheel/main.yaml
+    post-run: .zuul.playbooks/playbooks/wheel/post.yaml

.zuul.d/project.yaml

@@ -1,6 +1,7 @@
 - project:
     check:
       jobs:
+        - pyca-cryptography-build-wheel
         - pyca-cryptography-ubuntu-focal-py38-arm64
         - pyca-cryptography-ubuntu-bionic-py36-arm64
         - pyca-cryptography-ubuntu-xenial-py27-arm64

.zuul.playbooks/playbooks/wheel/main.yaml

@@ -0,0 +1,6 @@
+- hosts: all
+  tasks:
+
+    - name: Build wheel
+      include_role:
+        name: build-wheel-manylinux

.zuul.playbooks/playbooks/wheel/post.yaml

@@ -0,0 +1,9 @@
+- hosts: all
+  tasks:
+
+    - name: Copy log files from {{ ansible_user_dir }} on node
+      synchronize:
+        src: '{{ ansible_user_dir }}/{{ zuul.project.src_dir }}/wheelhouse.final'
+        dest: '{{ zuul.executor.log_root }}/wheelhouse'
+        mode: pull
+

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/README.rst

@@ -0,0 +1,4 @@
+Build manylinux wheel for a project
+===================================
+
+Blah

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/files/build-wheels.sh

@@ -0,0 +1,29 @@
+#!/bin/bash -x
+# Compile wheels
+
+cd /io
+mkdir wheelhouse.final
+
+for PYBIN in /opt/python/*/bin; do
+
+    "${PYBIN}"/python -m virtualenv .venv
+
+    .venv/bin/pip install cffi six ipaddress "enum34; python_version < '3'"
+
+    REGEX="cp3([0-9])*"
+
+    #if [[ "${PYBIN}" =~ $REGEX ]]; then
+    #    PY_LIMITED_API="--build-option --py-limited-api=cp3${BASH_REMATCH[1]}"
+    #fi
+
+    LDFLAGS="-L/opt/pyca/cryptography/openssl/lib" \
+           CFLAGS="-I/opt/pyca/cryptography/openssl/include -Wl,--exclude-libs,ALL" \
+           .venv/bin/pip wheel /io --no-binary cryptography --no-deps --wheel-dir=tmpwheelhouse $PY_LIMITED_API
+
+    auditwheel repair --plat manylinux2014_aarch64 tmpwheelhouse/cryptograph*.whl -w wheelhouse/
+
+    mv wheelhouse/* wheelhouse.final
+
+    rm -rf .venv tmpwheelhouse wheelhouse
+
+done

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/tasks/main.yaml

@@ -0,0 +1,33 @@
+- name: Install jq
+  package:
+    name: jq
+    state: present
+  become: yes
+
+- name: Run ensure-docker
+  include_role:
+    name: ensure-docker
+
+- name: HACK for linaro MTU
+  shell: |
+      jq --arg mtu 1400 '. + {mtu: $mtu|tonumber}' /etc/docker/daemon.json > /etc/docker/daemon.json.new
+      cat /etc/docker/daemon.json.new
+      mv /etc/docker/daemon.json.new /etc/docker/daemon.json
+      service docker restart
+  become: yes
+
+- name: Pull manylinux container
+  command: >-
+    docker pull iwienand/pyca-cryptography-manylinux2014_aarch64
+  become: yes
+
+- name: Install build script
+  copy:
+    src: build-wheels.sh
+    dest: '{{ zuul.project.src_dir }}'
+    mode: 0755
+
+- name: Run build
+  command: >-
+    docker run --rm -e PLAT=manylinux2014_aarch64 -v {{ ansible_user_dir }}/{{ zuul.project.src_dir }}:/io iwienand/pyca-cryptography-manylinux2014_aarch64  /io/build-wheels.sh
+  become: yes