No longer allow compact_str 0.8

See discussion in https://bugzilla.redhat.com/show_bug.cgi?id=2357473.

.gitignore

@@ -8,8 +8,7 @@
 /orjson-3.9.10.tar.gz
 /orjson-3.9.12.tar.gz
 /orjson-3.9.13.tar.gz
-/orjson-3.10.1.tar.gz
-/orjson-3.10.3.tar.gz
+/orjson-3.9.15.tar.gz
 /orjson-3.10.6.tar.gz
 /orjson-3.10.7.tar.gz
 /orjson-3.10.10.tar.gz
@@ -18,10 +17,3 @@
 /orjson-3.10.13.tar.gz
 /orjson-3.10.14.tar.gz
 /orjson-3.10.16.tar.gz
-/orjson-3.10.18.tar.gz
-/orjson-3.11.0.tar.gz
-/orjson-3.11.0-filtered.tar.xz
-/orjson-3.11.1-filtered.tar.xz
-/orjson-3.11.2-filtered.tar.xz
-/orjson-3.11.3-filtered.tar.xz
-/orjson-3.11.4-filtered.tar.xz

changelog

@@ -1,21 +1,9 @@
-* Mon Jul 22 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 3.10.6-1
-- Update to 3.10.6. Fixes rhbz#2291190.
+* Tue Jun 04 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 3.9.15-1
+- Update to 3.9.15.
 
-* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Sat Jun 08 2024 Python Maint <python-maint@redhat.com> - 3.10.3-2
-- Rebuilt for Python 3.13
-
-* Sat Jun 01 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 3.10.3-1
-- Update to 3.10.3. Fixes rhbz#2278078.
-
-* Fri May 24 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 3.10.1-2
+* Fri May 24 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 3.9.13-2
 - Rebuild with Rust 1.78 to fix incomplete debuginfo and backtraces
 
-* Mon Apr 15 2024 Maxwell G <maxwell@gtmx.me> - 3.10.1-1
-- Update to 3.10.1. Fixes rhbz#2264126.
-
 * Tue Feb 6 2024 Maxwell G <maxwell@gtmx.me> - 3.9.13-1
 - Update to 3.9.13. Fixes rhbz#2262570.
 

get_source

@@ -1,49 +0,0 @@
-#!/bin/sh
-set -o errexit
-set -o nounset
-
-if [ "$#" != '1' ]
-then
-	cat 1>&2 <<EOF
-Usage: $0 VERSION
-
-Downloads the requested version and creates a filtered source tarball.
-EOF
-	exit 1
-fi
-
-VERSION="${1}"
-OUTDIR="${PWD}"
-TMPDIR="$(mktemp -d)"
-trap "rm -rf '${TMPDIR}'" INT TERM EXIT
-
-cd "${TMPDIR}"
-REPO="https://github.com/ijl/orjson"
-URL="${REPO}/archive/${VERSION}/orjson-${VERSION}.tar.gz"
-echo "--> Downloading: ${URL}" 1>&2
-curl -L -O "${URL}"
-
-ARCHIVE="$(find . -mindepth 1 -maxdepth 1 -type f -name '*.tar.gz' -print -quit)"
-echo "--> Extracting: $(basename "${ARCHIVE}")" 1>&2
-tar -xzf "${ARCHIVE}"
-echo '--> Removing data/ due to licensing issues' 1>&2
-TARDIR="$(basename "${ARCHIVE}" '.tar.gz')"
-MTIME="$(stat -c '%Y' "${TARDIR}")"
-rm -rvf "${TARDIR}/data/"
-# Make sure the original mtime is preserved even though we modified the base
-# directory by removing something at the top level.
-touch -d @"${MTIME}" "${TARDIR}"
-FILTERED="$(basename "${ARCHIVE}" .tar.gz)-filtered.tar.xz"
-echo "--> Re-archiving: ${FILTERED}" 1>&2
-# https://www.gnu.org/software/tar/manual/html_section/Reproducibility.html
-TZ=UTC LC_ALL=C tar \
-    --create --verbose \
-    --sort=name \
-    --format=posix \
-    --numeric-owner --owner=0 --group=0 \
-    --mode=go+u,go-w \
-    --pax-option='delete=atime,delete=ctime' \
-    "${TARDIR}/" |
-  xz -9e > "${FILTERED}"
-mv -v "${FILTERED}" "${OUTDIR}"
-echo 'Done.' 1>&2

python-orjson.spec

@@ -10,39 +10,13 @@
 %bcond pendulum %{undefined el10}
 
 Name:           python-orjson
-Version:        3.11.4
+Version:        3.10.16
 Release:        %autorelease
 Summary:        Fast, correct Python JSON library
 
-# The entire source is (Apache-2.0 OR MIT), except:
-#
-# MIT:
-# - include/yyjson/yyjson.c
-# - include/yyjson/yyjson.h
-#
-# Apache-2.0:
-# - src/serialize/writer/str/mod.rs
-# - src/serialize/writer/str/sse2.rs
-License:        (Apache-2.0 OR MIT) AND Apache-2.0 AND MIT
+License:        Apache-2.0 OR MIT
 URL:            https://github.com/ijl/orjson
-# We must be careful about the source archive.
-#
-# The PyPI releases have a vendored Rust dependency bundle in include/cargo/,
-# which we would remove in %%prep, but which we must still check to make sure
-# everything has a license acceptable for distribution in Fedora before
-# uploading to the lookaside cache.
-# Source:         %%{pypi_source orjson}
-# The GitHub archives from
-# %%{url}/archive/%%{version}/orjson-%%{version}.tar.gz do not have the
-# vendored crates, but they contain benchmark data in data/, some of which is
-# lacking its license text (e.g.  data/blns.txt.xz, which is from
-# https://github.com/minimaxir/big-list-of-naughty-strings and should carry the
-# corresponding MIT license text), and some of which looks like it might have
-# at best unclear license status. Since the benchmark data is potentially
-# problematic, we would need to filter the GitHub archives with a script.
-Source0:        orjson-%{version}-filtered.tar.xz
-# ./get_source ${COMMIT} (or ${TAG})
-Source1:        get_source
+Source:         %{pypi_source orjson}
 
 BuildRequires:  tomcli
 BuildRequires:  python3-devel
@@ -71,40 +45,34 @@ datetimes, and numpy}
 
 %package -n     python3-orjson
 Summary:        %{summary}
-# Output of %%{cargo_license_summary}:
-#
 # (Apache-2.0 OR MIT) AND BSD-3-Clause
 # Apache-2.0 OR BSL-1.0
 # Apache-2.0 OR MIT
-# BSD-2-Clause OR Apache-2.0 OR MIT
 # BSL-1.0
 # MIT
-# MIT OR Apache-2.0
+# MIT OR Apache-2.0 (duplicate)
 # Unlicense OR MIT
 #
-# Note that this must include the terms of the base package License expression.
+# Bundled PyO3 crates in include/pyo3/ are also (Apache-2.0 OR MIT).
 License:        %{shrink:
                 (Apache-2.0 OR MIT) AND
-                Apache-2.0 AND
-                (Apache-2.0 OR BSL-1.0) AND
-                (Apache-2.0 OR BSD-2-Clause OR MIT) AND
                 BSD-3-Clause AND
+                (Apache-2.0 OR BSL-1.0) AND
                 BSL-1.0 AND
                 MIT AND
                 (Unlicense OR MIT)
                 }
 
-# Version from YYJSON_VERSION_STRING in include/yyjson/yyjson.h
+# Path to using published versions of pyo3-ffi/pyo3-build-config again?
+# https://github.com/ijl/orjson/issues/524
 #
-# Since version 3.11.4, orjson unconditionally uses a bundled copy of the C
-# library yyjson, https://github.com/ibireme/yyjson, as the JSON
-# deserialization backend. It is forked (customized) and compiled with a
-# particular set of options via preprocessor defines (see build.rs), so it is
-# not a candidate for unbundling. (Prior to version 3.11.4, this could be
-# disabled, and the json crate from the Rust standard library,
-# https://docs.rs/json, would be used instead, but this is no longer
-# supported.)
-Provides:       bundled(yyjson) = 0.9.0
+# “You are welcome to work to upstream the diff if you find the vendoring
+# unsuitable for your organization's own preferences.”
+#
+# Note that these crates are actually forked, not only bundled/vendored; see
+# https://github.com/ijl/orjson/issues/524#issuecomment-2424170405 for details.
+Provides:       bundled(crate(pyo3-build-config)) = 0.23.3
+Provides:       bundled(crate(pyo3-ffi)) = 0.23.3
 
 %description -n python3-orjson %{_description}
 
@@ -113,10 +81,22 @@ Provides:       bundled(yyjson) = 0.9.0
 %autosetup -p1 -n orjson-%{version}
 %cargo_prep
 
+# Remove unstable features that require rust nightly; the avx512 feature also
+# requires the x86_64 architecture
+tomcli-set Cargo.toml del 'features.unstable-simd'
+tomcli-set Cargo.toml del 'features.avx512'
 # Remove unwind feature, which is not useful here: the comment above it says
 # “Avoid bundling libgcc on musl.”
 tomcli-set Cargo.toml del 'features.unwind'
 tomcli-set Cargo.toml del 'dependencies.unwinding'
+# Remove bundled rust crates
+rm -r include/cargo
+# Remove bundled yyjson.
+rm -rv include/yyjson/
+
+# Collect licenses for remaining vendored crates
+mkdir -p LICENSES.vendored/pyo3
+cp -vp include/pyo3/LICENSE* LICENSES.vendored/pyo3/
 
 %if %{without pendulum}
 sed -i '/^pendulum\b/d' test/requirements.txt
@@ -131,12 +111,23 @@ sed -i '/pytest-random-order/d' test/requirements.txt
 %generate_buildrequires
 %pyproject_buildrequires %{?with_tests:test/requirements.txt}
 %cargo_generate_buildrequires
+for dir in include/pyo3/*/
+do
+  pushd "${dir}" >/dev/null
+  %cargo_generate_buildrequires
+  popd >/dev/null
+done
 
 
 %build
 export RUSTFLAGS='%{build_rustflags}'
 %cargo_license_summary
 %{cargo_license} > LICENSES.dependencies
+# Fedora's pyo3 is patched to not check Python version when building RPM packages.
+# However, this uses a bundled version without the patch.
+# Rather than patching it, we set the environment variable,
+# which allows us to test this package with development Python versions.
+export UNSAFE_PYO3_SKIP_VERSION_CHECK=1
 %pyproject_wheel
 
 
@@ -155,6 +146,7 @@ export RUSTFLAGS='%{build_rustflags}'
 
 
 %files -n python3-orjson -f %{pyproject_files}
+%license LICENSES.vendored/
 %doc README.md
 
 

sources

@@ -1 +1 @@
-SHA512 (orjson-3.11.4-filtered.tar.xz) = 1a457a91dfa1918341acfebcdb86ddf92b5776f166be9dbd16a4253f55140ae0bc90f911ceb3a9b33abd963be22f089aa2764b25e1701691298c0e8840c8225a
+SHA512 (orjson-3.10.16.tar.gz) = ea71aa463206feae1a96bb604366af2f17ddb083a1a4b7cc87c1b8ad1f01b54bd5c4ef148e9472fed8d8308de37b2a4e4fe0b4a4290d19eaf4fc3ae5777791f9