Attempt to switch to maturin.

It seems to be much faster at doing things locally.

.github/workflows/wheel-builder.yml

@@ -57,7 +57,7 @@ jobs:
       fail-fast: false
       matrix:
         PYTHON:
-          - { VERSION: "cp37-cp37m", ABI_VERSION: 'cp37' }
+          - { VERSION: "cp37-cp37m" }
           - { VERSION: "pp38-pypy38_pp73" }
           - { VERSION: "pp39-pypy39_pp73" }
         MANYLINUX:
@@ -108,12 +108,9 @@ jobs:
       - run: mkdir tmpwheelhouse
       - name: Build the wheel
         run: |
-          if [ -n "${{ matrix.PYTHON.ABI_VERSION }}" ]; then
-              PY_LIMITED_API="--config-settings=--build-option=--py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
-          fi
           OPENSSL_DIR="/opt/pyca/cryptography/openssl" \
               OPENSSL_STATIC=1 \
-              .venv/bin/python -m pip wheel -v $PY_LIMITED_API cryptograph*.tar.gz -w dist/ && mv dist/cryptography*.whl tmpwheelhouse
+              .venv/bin/python -m pip wheel -v cryptograph*.tar.gz -w dist/ && mv dist/cryptography*.whl tmpwheelhouse
         env:
           RUSTUP_HOME: /root/.rustup
       - run: auditwheel repair --plat ${{ matrix.MANYLINUX.NAME }} tmpwheelhouse/cryptograph*.whl -w wheelhouse/
@@ -144,7 +141,6 @@ jobs:
       matrix:
         PYTHON:
           - VERSION: '3.11'
-            ABI_VERSION: 'cp37'
             # Despite the name, this is built for the macOS 11 SDK on arm64 and 10.9+ on intel
             DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.11.3/python-3.11.3-macos11.pkg'
             BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.11/bin/python3'
@@ -156,7 +152,6 @@ jobs:
             # build against
             _PYTHON_HOST_PLATFORM: 'macosx-10.9-universal2'
           - VERSION: '3.11'
-            ABI_VERSION: 'cp37'
             DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.11.3/python-3.11.3-macos11.pkg'
             BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.11/bin/python3'
             DEPLOYMENT_TARGET: '10.12'
@@ -175,7 +170,7 @@ jobs:
             DEPLOYMENT_TARGET: '10.12'
             _PYTHON_HOST_PLATFORM: 'macosx-10.9-x86_64'
             ARCHFLAGS: '-arch x86_64'
-    name: "${{ matrix.PYTHON.VERSION }} ABI ${{ matrix.PYTHON.ABI_VERSION }} macOS ${{ matrix.PYTHON.ARCHFLAGS }}"
+    name: "${{ matrix.PYTHON.VERSION }} macOS ${{ matrix.PYTHON.ARCHFLAGS }}"
     steps:
       - uses: actions/[email protected]
         with:
@@ -213,13 +208,9 @@ jobs:
       - run: mkdir wheelhouse
       - name: Build the wheel
         run: |
-          if [ -n "${{ matrix.PYTHON.ABI_VERSION }}" ]; then
-              PY_LIMITED_API="--config-settings=--build-option=--py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
-          fi
-
           OPENSSL_DIR="$(readlink -f ../openssl-macos-universal2/)" \
               OPENSSL_STATIC=1 \
-              venv/bin/python -m pip wheel -v $PY_LIMITED_API cryptograph*.tar.gz -w dist/ && mv dist/cryptography*.whl wheelhouse
+              venv/bin/python -m pip wheel -v cryptograph*.tar.gz -w dist/ && mv dist/cryptography*.whl wheelhouse
         env:
           MACOSX_DEPLOYMENT_TARGET: ${{ matrix.PYTHON.DEPLOYMENT_TARGET }}
           ARCHFLAGS: ${{ matrix.PYTHON.ARCHFLAGS }}
@@ -250,7 +241,7 @@ jobs:
           - {ARCH: 'x86', WINDOWS: 'win32', RUST_TRIPLE: 'i686-pc-windows-msvc'}
           - {ARCH: 'x64', WINDOWS: 'win64', RUST_TRIPLE: 'x86_64-pc-windows-msvc'}
         PYTHON:
-          - {VERSION: "3.11", "ABI_VERSION": "cp37"}
+          - {VERSION: "3.11"}
           - {VERSION: "pypy-3.8"}
           - {VERSION: "pypy-3.9"}
         exclude:
@@ -259,7 +250,7 @@ jobs:
             PYTHON: {VERSION: "pypy-3.8"}
           - WINDOWS: {ARCH: 'x86', WINDOWS: 'win32', RUST_TRIPLE: 'i686-pc-windows-msvc'}
             PYTHON: {VERSION: "pypy-3.9"}
-    name: "${{ matrix.PYTHON.VERSION }} ${{ matrix.WINDOWS.WINDOWS }} ${{ matrix.PYTHON.ABI_VERSION }}"
+    name: "${{ matrix.PYTHON.VERSION }} ${{ matrix.WINDOWS.WINDOWS }}"
     steps:
       - uses: actions/[email protected]
         with:
@@ -294,11 +285,7 @@ jobs:
       - run: python -m pip install cffi setuptools-rust
       - run: mkdir wheelhouse
       - run: |
-          if [ -n "${{ matrix.PYTHON.ABI_VERSION }}" ]; then
-              PY_LIMITED_API="--config-settings=--build-option=--py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
-          fi
-
-          python -m pip wheel -v cryptography*.tar.gz $PY_LIMITED_API -w dist/ && mv dist/cryptography*.whl wheelhouse/
+          python -m pip wheel -v cryptography*.tar.gz -w dist/ && mv dist/cryptography*.whl wheelhouse/
         shell: bash
       - run: pip install -f wheelhouse --no-index cryptography
       - name: Print the OpenSSL we built and linked against
@@ -309,5 +296,5 @@ jobs:
       - run: move wheelhouse\cryptography*.whl cryptography-wheelhouse\
       - uses: actions/[email protected]
         with:
-          name: "cryptography-${{ github.event.inputs.version }}-${{ matrix.WINDOWS.WINDOWS }}-${{ matrix.PYTHON.VERSION }}-${{ matrix.PYTHON.ABI_VERSION}}"
+          name: "cryptography-${{ github.event.inputs.version }}-${{ matrix.WINDOWS.WINDOWS }}-${{ matrix.PYTHON.VERSION }}"
           path: cryptography-wheelhouse\

pyproject.toml

@@ -1,13 +1,14 @@
 [build-system]
 requires = [
-    # First version of setuptools to support pyproject.toml configuration
-    "setuptools>=61.0.0",
-    "wheel",
+    "maturin==1.0.0b9",
+
     # Must be kept in sync with `project.dependencies`
     "cffi>=1.12; platform_python_implementation != 'PyPy'",
-    "setuptools-rust>=0.11.4",
+    # Needed because cffi imports distutils, and in Python 3.12, distutils has
+    # been removed from the stdlib, but installing setuptools puts it back.
+    "setuptools",
 ]
-build-backend = "setuptools.build_meta"
+build-backend = "maturin"
 
 [project]
 name = "cryptography"
@@ -54,14 +55,6 @@ source = "https://github.com/pyca/cryptography/"
 issues = "https://github.com/pyca/cryptography/issues"
 changelog = "https://cryptography.io/en/latest/changelog/"
 
-[tool.setuptools]
-zip-safe = false
-package-dir = {"" = "src"}
-
-[tool.setuptools.packages.find]
-where = ["src"]
-include = ["cryptography*"]
-
 [project.optional-dependencies]
 ssh = ["bcrypt >=3.1.5"]
 
@@ -80,6 +73,42 @@ docstest =  ["pyenchant >=1.6.11", "twine >=1.12.0", "sphinxcontrib-spelling >=4
 sdist = ["build"]
 pep8test = ["black", "ruff", "mypy", "check-sdist"]
 
+[tool.maturin]
+python-source = "src"
+python-packages = ["cryptography"]
+manifest-path = "src/rust/Cargo.toml"
+module-name = "cryptography.hazmat.bindings._rust"
+locked = true
+sdist-generator = "git"
+include = [
+    "CHANGELOG.rst",
+    "CONTRIBUTING.rst",
+    "LICENSE",
+    "LICENSE.APACHE",
+    "LICENSE.BSD",
+
+    "docs/**/*",
+
+    "src/_cffi_src/**/*.py",
+    "src/_cffi_src/**/*.c",
+    "src/_cffi_src/**/*.h",
+
+    "src/rust/**/Cargo.toml",
+    "src/rust/**/Cargo.lock",
+    "src/rust/**/*.rs",
+
+    "tests/**/*.py",
+]
+exclude = [
+    "vectors/**/*",
+    "src/rust/target/**/*",
+    "docs/_build/**/*",
+    ".github/**/*",
+    ".readthedocs.yml",
+    "ci-constraints-requirements.txt",
+    "mypy.ini",
+]
+
 [tool.black]
 line-length = 79
 target-version = ["py37"]

src/rust/cryptography-cffi/build.rs

@@ -24,6 +24,7 @@ fn main() {
 
     let out_dir = env::var("OUT_DIR").unwrap();
     // FIXME: maybe pyo3-build-config should provide a way to do this?
+    println!("cargo:rerun-if-env-changed=PYO3_PYTHON");
     let python = env::var("PYO3_PYTHON").unwrap_or_else(|_| "python3".to_string());
     println!("cargo:rerun-if-changed=../../_cffi_src/");
     let output = Command::new(&python)