[work in progress] build manylinux2014_aarch64 wheels

Testing at this stage

.zuul.d/jobs.yaml

@@ -2,7 +2,7 @@
     name: pyca-cryptography-base
     abstract: true
     description: Run pyca/cryptography unit testing
-    run: .zuul.playbooks/playbooks/main.yaml
+    run: .zuul.playbooks/playbooks/tox/main.yaml
 
 - job:
     name: pyca-cryptography-ubuntu-focal-py38-arm64
@@ -31,3 +31,9 @@
     nodeset: centos-8-arm64
     vars:
       tox_envlist: py27
+
+- job:
+    name: pyca-cryptography-build-wheel
+    nodeset: ubuntu-bionic-arm64
+    run: .zuul.playbooks/playbooks/wheel/main.yaml
+    post-run: .zuul.playbooks/playbooks/wheel/post.yaml

.zuul.d/project.yaml

@@ -1,6 +1,7 @@
 - project:
     check:
       jobs:
+        - pyca-cryptography-build-wheel
         - pyca-cryptography-ubuntu-focal-py38-arm64
         - pyca-cryptography-ubuntu-bionic-py36-arm64
         - pyca-cryptography-centos-8-py36-arm64

.zuul.playbooks/playbooks/wheel/main.yaml

@@ -0,0 +1,6 @@
+- hosts: all
+  tasks:
+
+    - name: Build wheel
+      include_role:
+        name: build-wheel-manylinux

.zuul.playbooks/playbooks/wheel/post.yaml

@@ -0,0 +1,19 @@
+- hosts: all
+  tasks:
+
+    - name: Copy log files from {{ ansible_user_dir }} on node
+      synchronize:
+        src: '{{ ansible_user_dir }}/{{ zuul.project.src_dir }}/wheelhouse.final/'
+        dest: '{{ zuul.executor.log_root }}/wheelhouse'
+        mode: pull
+
+
+    - name: Return wheelhouse artifact
+      zuul_return:
+        data:
+          zuul:
+            artifacts:
+              - name: "Wheelhouse"
+                url: "wheelhouse"
+                metadata:
+                  type: wheelhouse

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/README.rst

@@ -0,0 +1,4 @@
+Build manylinux wheel for a project
+===================================
+
+Blah

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/files/build-wheels.sh

@@ -0,0 +1,30 @@
+#!/bin/bash -x
+# Compile wheels
+
+cd /io
+mkdir wheelhouse.final
+
+PYBINS="/opt/python/cp35-cp35m/bin"
+
+for PYBIN in $PYBINS; do
+
+    "${PYBIN}"/python -m virtualenv .venv
+
+    .venv/bin/pip install cffi six ipaddress "enum34; python_version < '3'"
+
+    REGEX="cp3([0-9])*"
+    if [[ "${PYBIN}" =~ $REGEX ]]; then
+        PY_LIMITED_API="--build-option --py-limited-api=cp3${BASH_REMATCH[1]}"
+    fi
+
+    LDFLAGS="-L/opt/pyca/cryptography/openssl/lib" \
+           CFLAGS="-I/opt/pyca/cryptography/openssl/include -Wl,--exclude-libs,ALL" \
+           .venv/bin/python setup.py bdist_wheel $PY_LIMITED_API
+
+    auditwheel repair --plat manylinux2014_aarch64 dist/cryptography*.whl -w wheelhouse/
+
+    mv wheelhouse/* wheelhouse.final
+
+    rm -rf .venv dist wheelhouse
+
+done

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/tasks/main.yaml

@@ -0,0 +1,71 @@
+- name: Install jq
+  package:
+    name: jq
+    state: present
+  become: yes
+
+- name: Run ensure-docker
+  include_role:
+    name: ensure-docker
+
+- name: HACK for linaro MTU
+  shell: |
+      jq --arg mtu 1400 '. + {mtu: $mtu|tonumber}' /etc/docker/daemon.json > /etc/docker/daemon.json.new
+      cat /etc/docker/daemon.json.new
+      mv /etc/docker/daemon.json.new /etc/docker/daemon.json
+      service docker restart
+  become: yes
+
+- name: Pull manylinux container
+  command: >-
+    docker pull iwienand/pyca-cryptography-manylinux2014_aarch64
+  become: yes
+
+- name: Ensure pip installed
+  include_role:
+    name: ensure-pip
+
+# TODO(ianw) : move this into a common role
+- name: Install required packages
+  package:
+    name:
+      - build-essential
+      - libssl-dev
+      - libffi-dev
+      - python3-dev
+  become: yes
+  when: ansible_distribution in ['Debian', 'Ubuntu']
+
+# Build from sdist to avoid PEP517 issues
+- name: Create sdist
+  command: |
+    python3 setup.py sdist
+  args:
+    chdir: '{{ ansible_user_dir }}/{{ zuul.project.src_dir }}'
+
+- name: Find output file
+  find:
+    paths: '{{ ansible_user_dir }}/{{ zuul.projects.src_dir }}/dist'
+    file_type: file
+    patterns: "*.tar.gz"
+  register: _sdist
+
+- assert:
+    that:
+      - _sdist.matched == 1
+
+- name: Create build repo from sdist
+  unarchive:
+    src: _sdist.files[0].path
+    dest: '{{ ansible_user_dir }}/build'
+
+- name: Install build script
+  copy:
+    src: build-wheels.sh
+    dest: '{{ ansible_user_dir }}/build'
+    mode: 0755
+
+- name: Run build
+  command: >-
+    docker run --rm -e PLAT=manylinux2014_aarch64 -v {{ ansible_user_dir }}/build:/io iwienand/pyca-cryptography-manylinux2014_aarch64  /io/build-wheels.sh
+  become: yes