[work in progress] build manylinux2014_aarch64 wheels

Testing at this stage

.zuul.d/jobs.yaml

@@ -2,7 +2,7 @@
     name: pyca-cryptography-base
     abstract: true
     description: Run pyca/cryptography unit testing
-    run: .zuul.playbooks/playbooks/main.yaml
+    run: .zuul.playbooks/playbooks/tox/main.yaml
 
 - job:
     name: pyca-cryptography-ubuntu-focal-py38-arm64
@@ -31,3 +31,8 @@
     nodeset: centos-8-arm64
     vars:
       tox_envlist: py36
+
+- job:
+    name: pyca-cryptography-build-wheel
+    nodeset: ubuntu-bionic-arm64
+    run: .zuul.playbooks/playbooks/wheel/main.yaml

.zuul.d/project.yaml

@@ -1,6 +1,7 @@
 - project:
     check:
       jobs:
+        - pyca-cryptography-build-wheel
         - pyca-cryptography-ubuntu-focal-py38-arm64
         - pyca-cryptography-ubuntu-bionic-py36-arm64
         - pyca-cryptography-ubuntu-xenial-py27-arm64

.zuul.playbooks/playbooks/wheel/main.yaml

@@ -0,0 +1,6 @@
+- hosts: all
+  tasks:
+
+    - name: Build wheel
+      include_role:
+        name: build-wheel-manylinux

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/README.rst

@@ -0,0 +1,4 @@
+Build manylinux wheel for a project
+===================================
+
+Blah

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/files/build-wheels.sh

@@ -0,0 +1,22 @@
+# Compile wheels
+for PYBIN in /opt/python/*/bin; do
+
+    "${PYBIN} -m virtualenv .venv"
+
+    .venv/bin/pip install cffi six ipaddress "enum34; python_version < '3'"
+
+    REGEX="cp3([0-9])*"
+
+    if [[ "${PYBIN}" =~ $REGEX ]]; then
+        PY_LIMITED_API="--build-option --py-limited-api=cp3${BASH_REMATCH[1]}"
+    fi
+
+    LDFLAGS="-L/opt/pyca/cryptography/openssl/lib" \
+           CFLAGS="-I/opt/pyca/cryptography/openssl/include -Wl,--exclude-libs,ALL" \
+           .venv/bin/pip wheel cryptography==${{ github.event.client_payload.BUILD_VERSION }} --no-binary cryptography --no-deps --wheel-dir=tmpwheelhouse $PY_LIMITED_API
+
+    auditwheel repair --plat manylinux2014_aarch64 tmpwheelhouse/cryptograph*.whl -w wheelhouse/
+
+done
+
+

.zuul.playbooks/playbooks/wheel/roles/build-wheel-manylinux/tasks/main.yaml

@@ -0,0 +1,19 @@
+- name: Run ensure-docker
+  include_role:
+    name: ensure-docker
+
+- name: Pull manylinux container
+  command: >-
+    docker pull iwienand/pyca-cryptography-manylinux2014_aarch64
+  become: yes
+
+- name: Install build script
+  copy:
+    src: build-wheels.sh
+    dest: '{{ zuul.project.src_dir }}'
+    mode: 0755
+
+- name: Run build
+  command: >-
+    docker run --rm -e PLAT=manylinux2014_aarch64 -v {{ ansible_user_dir }}/{{ zuul.project.src_dir }}:/io iwienand/pyca-cryptography-manylinux2014_aarch64  /io/build-wheels.sh
+  become: yes