Merge from aws/aws-sam-cli/develop

.github/workflows/validate_pyinstaller.yml

@@ -12,26 +12,27 @@ jobs:
   build-for-linux:
     name: build-pyinstaller-linux
     runs-on: ubuntu-latest
-    container: quay.io/pypa/manylinux2014_x86_64:latest
     if: github.repository_owner == 'aws'
     strategy:
       fail-fast: false
     steps:
-      # we need to keep checkout as v3 otherwise it doesn't work with manylinux image above
-      # due to glibc requirement from github actions 
-      # see example failure: https://github.com/aws/aws-sam-cli/actions/runs/6102715182/job/16561754862?pr=5887
-      - uses: actions/checkout@v3
-      - name: Build PyInstaller
+      - uses: actions/checkout@v4
+      - name: Make installer script executable
+        run: chmod +x ./installer/pyinstaller/build-linux.sh
+      - name: Build PyInstaller in manylinux container
         run: |
-          chmod +x ./installer/pyinstaller/build-linux.sh
-          ./installer/pyinstaller/build-linux.sh aws-sam-cli-linux-x86_64.zip
+          docker run --rm -v .:/samcli -w /samcli -e CI_OVERRIDE='1' \
+          quay.io/pypa/manylinux2014_x86_64:latest /samcli/installer/pyinstaller/build-linux.sh aws-sam-cli-linux-x86_64.zip
+      - uses: actions/setup-python@v5
+        with:
+          python-version: 3.11
       - name: Basic tests for PyInstaller
         run: |
           unzip .build/output/aws-sam-cli-linux-x86_64.zip -d sam-installation
-          ./sam-installation/install
+          sudo ./sam-installation/install
           sam-beta --version
           ./tests/sanity-check.sh
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: pyinstaller-linux-zip
           path: .build/output/aws-sam-cli-linux-x86_64.zip

installer/pyinstaller/Instruction.md

@@ -4,3 +4,15 @@ docker run --mount type=bind,src="{Absolute path to AWS SAM CLI source}",dst="/a
 cd aws-sam-cli
 ./installer/pyinstaller/build-linux.sh aws-sam-cli-linux-x86_64.zip
 ```
+
+### Linux Builds
+The Linux builds require using a [manylinux image](https://github.com/pypa/manylinux) to build an artifact usable on a breadth of Linux machines. The currently used image is
+`quay.io/pypa/manylinux2014_x86_64:latest` which uses glibc version `2.17`. This version of glibc is outdated and requires updating
+to support newer software such as Node.js 20 used by GitHub actions. In the meantime, the Linux pyinstaller action is run inside
+of a nested container to get around this issue. In the future, we need to move to using a newer image with a newer version of glibc
+configured. 
+
+A good candidate for this is `quay.io/pypa/manylinux_2_28_x86_64` which is an image that uses glibc version `2.28`. However,
+the current Amazon Linux 2 image uses glibc version `2.26`, meaning that upgrading now will render customer on that OS incapable of using
+newer versions of AWS SAM CLI. When that image hits its [end-of-life date](https://github.com/mayeut/pep600_compliance?tab=readme-ov-file#distro-compatibility), we can update the installer to use the newer image.
+

installer/pyinstaller/build-linux.sh

@@ -49,7 +49,7 @@ mkdir -p .build/output/openssl
 cd .build/output/openssl
 
 echo "Building OpenSSL"
-curl "https://www.openssl.org/source/openssl-${openssl_version}.tar.gz" --output openssl.tar.gz
+curl -L "https://github.com/openssl/openssl/releases/download/OpenSSL_${openssl_version//./_}/openssl-${openssl_version}.tar.gz" --output openssl.tar.gz
 tar xzf openssl.tar.gz
 cd openssl-${openssl_version}
 # install_sw installs OpenSSL without manual pages

requirements/base.txt

@@ -12,12 +12,12 @@ docker~=7.1.0
 dateparser~=1.2
 requests~=2.32.3
 aws_lambda_builders==1.50.0
-tomlkit==0.12.5
+tomlkit==0.13.0
 watchdog==4.0.1
 rich~=13.7.1
-pyopenssl~=24.1.0
+pyopenssl~=24.2.1
 # Pin to <4.18 to until SAM-T no longer uses RefResolver
-jsonschema<4.23
+jsonschema<4.24
 
 # Needed for supporting Protocol in Python 3.7, Protocol class became public with python3.8
 typing_extensions>=4.4.0,<5
@@ -31,4 +31,4 @@ tzlocal==5.2
 cfn-lint~=0.87.7
 
 # Type checking boto3 objects
-boto3-stubs[apigateway,cloudformation,ecr,iam,lambda,s3,schemas,secretsmanager,signer,stepfunctions,sts,xray,sqs,kinesis]==1.34.131
+boto3-stubs[apigateway,cloudformation,ecr,iam,lambda,s3,schemas,secretsmanager,signer,stepfunctions,sts,xray,sqs,kinesis]==1.34.147

requirements/dev.txt

@@ -1,33 +1,33 @@
 -r pre-dev.txt
 
-coverage==7.5.3
+coverage==7.6.0
 pytest-cov==5.0.0
 
 
 # type checking and related stubs
 # mypy adds new rules in new minor versions, which could cause our PR check to fail
 # here we fix its version and upgrade it manually in the future
-mypy==1.10.0
+mypy==1.10.1
 types-pywin32==306.0.0.20240408
-types-PyYAML==6.0.12.20240311
+types-PyYAML==6.0.12.20240724
 types-chevron==0.14.2.20240310
 types-psutil==6.0.0.20240621
-types-setuptools==70.0.0.20240524
+types-setuptools==71.1.0.20240724
 types-Pygments==2.18.0.20240506 
 types-colorama==0.4.15.20240311
 types-dateparser==1.2.0.20240420
-types-docutils==0.21.0.20240423
-types-jsonschema==4.22.0.20240610
-types-pyOpenSSL==24.1.0.20240425
+types-docutils==0.21.0.20240724
+types-jsonschema==4.23.0.20240712
+types-pyOpenSSL==24.1.0.20240722
 # lucashuy: pin `types-request` based on the Python version since newer versions of
 # the types require a newer version of requests, which is only installed in newer versions of Python
 types-requests==2.31.0.6; python_version<"3.10"
-types-requests==2.32.0.20240622; python_version>="3.10"
+types-requests==2.32.0.20240712; python_version>="3.10"
 types-urllib3==1.26.25.14
 
 # Test requirements
 
-pytest==8.2.1
+pytest==8.3.1
 
 parameterized==0.9.0
 pytest-xdist==3.6.1

requirements/pre-dev.txt

@@ -1 +1 @@
-ruff==0.4.10
+ruff==0.5.4

requirements/pyinstaller-build.txt

@@ -1,3 +1,3 @@
 # Executable binary builder requirements
-setuptools==70.0.0
-pyinstaller==6.8.0
+setuptools==70.3.0
+pyinstaller==6.9.0