fix: pin crypto provider

Author: jackstar12

Cargo.toml

@@ -54,6 +54,7 @@ env_logger = "0.11.8"
 hex = "0.4"
 lnurl-rs = { version = "0.9.0", default-features = false, features = ["async", "async-https"], optional = true }
 reqwest = { version = "0.12.12" , default-features = false, features = ["json", "rustls-tls"] }
+rustls = { version = "0.23.32", default-features = false, features = ["ring"] }
 macros = { version = "1.0.0", package = "boltz-client-macros" }
 futures-util = "0.3.31"
 tokio-tungstenite-wasm = { version = "0.6.0", features = ["rustls-tls-webpki-roots"], optional = true }

bindings/Makefile

@@ -1,23 +1,43 @@
+REPO_ROOT := $(abspath ..)
+CARGO_TARGET_DIR ?= ../target
+MANYLINUX_IMAGE ?= quay.io/pypa/manylinux_2_28_x86_64
+MANYLINUX_PYTHON ?= /opt/python/cp310-cp310/bin/python
+AUDITWHEEL_PLAT ?= manylinux_2_28_x86_64
+RUST_TOOLCHAIN ?= 1.88.0
+DOCKER_PLATFORM_ARG := $(if $(MANYLINUX_PLATFORM),--platform $(MANYLINUX_PLATFORM),)
+DOCKER_USER ?= $(shell id -u):$(shell id -g)
+
 build-debug:
 	cargo build
-	cp ../target/debug/libboltz_client.so ./python/
-	cargo run generate --language python --no-format --library ../target/debug/libboltz_client.so --out-dir python/
+	cp $(CARGO_TARGET_DIR)/debug/libboltz_client.so ./python/
+	cargo run generate --language python --no-format --library $(CARGO_TARGET_DIR)/debug/libboltz_client.so --out-dir python/
 
 build-release:
 	cargo build --release
 	cargo build  # Also build debug for uniffi to read metadata
-	cp ../target/release/libboltz_client.so ./python/
-	cargo run generate --language python --no-format --library ../target/debug/libboltz_client.so --out-dir python/
+	cp $(CARGO_TARGET_DIR)/release/libboltz_client.so ./python/
+	cargo run generate --language python --no-format --library $(CARGO_TARGET_DIR)/debug/libboltz_client.so --out-dir python/
 
 build-python: build-release
 	cd python && uv build
 
-prepare-release-python: build-python
-	cd python && \
-		uvx auditwheel repair dist/*-py3-none-any.whl --wheel-dir dist/ && \
-		rm dist/*-py3-none-any.whl && \
-		uv run --isolated --no-project --with dist/*.whl python -c "import boltz_client" && \
-		uv run --isolated --no-project --with dist/*.tar.gz python -c "import boltz_client"
+build-python-manylinux:
+	docker run --rm $(DOCKER_PLATFORM_ARG) \
+		--user "$(DOCKER_USER)" \
+		-e HOME=/tmp/boltz-build-home \
+		-e CARGO_HOME=/tmp/boltz-cargo \
+		-e RUSTUP_HOME=/tmp/boltz-rustup \
+		-e CARGO_TARGET_DIR=/tmp/boltz-target \
+		-e UV_CACHE_DIR=/tmp/boltz-uv-cache \
+		-e PYTHON_BIN="$(MANYLINUX_PYTHON)" \
+		-e AUDITWHEEL_PLAT="$(AUDITWHEEL_PLAT)" \
+		-e RUST_TOOLCHAIN="$(RUST_TOOLCHAIN)" \
+		-v "$(REPO_ROOT):/io" \
+		-w /io/bindings \
+		"$(MANYLINUX_IMAGE)" \
+		bash scripts/build-python-manylinux.sh
+
+prepare-release-python: build-python-manylinux
 
 format-python:
 	# Also formats Python tests

bindings/README.md

@@ -50,15 +50,25 @@ make build-release
 
 # Build Python package (wheel)
 make build-python
+
+# Build release Python artifacts in a manylinux container
+make prepare-release-python
 ```
 
+Use `prepare-release-python` for release artifacts. It builds in manylinux,
+repairs the wheel with `auditwheel`, removes the intermediate `py3-none-any`
+wheel, and smoke-tests both the repaired wheel and the sdist. Override
+`MANYLINUX_IMAGE`, `MANYLINUX_PYTHON`, or `AUDITWHEEL_PLAT` only when the
+release target changes.
+
 ### Generated Files
 
 The build process generates:
 
 - `libboltz_client.so` - The compiled Rust library
 - `boltz_client.py` - Python bindings module
 - `dist/boltz_client-*.whl` - Installable Python wheel
+- `dist/boltz_client-*.tar.gz` - Installable source distribution
 
 ### Testing
 

bindings/scripts/build-python-manylinux.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PYTHON_BIN="${PYTHON_BIN:-/opt/python/cp310-cp310/bin/python}"
+AUDITWHEEL_PLAT="${AUDITWHEEL_PLAT:-manylinux_2_28_x86_64}"
+RUST_TOOLCHAIN="${RUST_TOOLCHAIN:-1.88.0}"
+
+if [ ! -x "$PYTHON_BIN" ]; then
+    echo "Python interpreter not found: $PYTHON_BIN" >&2
+    exit 2
+fi
+
+mkdir -p "$HOME" "${CARGO_HOME:-$HOME/.cargo}" "${RUSTUP_HOME:-$HOME/.rustup}" "${UV_CACHE_DIR:-$HOME/.cache/uv}"
+export PATH="${CARGO_HOME:-$HOME/.cargo}/bin:$HOME/.local/bin:$(dirname "$PYTHON_BIN"):$PATH"
+
+if ! command -v cargo >/dev/null 2>&1; then
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+        | sh -s -- -y --profile minimal --default-toolchain "$RUST_TOOLCHAIN"
+fi
+
+if ! command -v uv >/dev/null 2>&1; then
+    "$PYTHON_BIN" -m pip install --user --upgrade uv
+fi
+
+if ! command -v auditwheel >/dev/null 2>&1; then
+    "$PYTHON_BIN" -m pip install --user --upgrade auditwheel
+fi
+
+make build-release
+
+cd python
+rm -rf dist
+uv build
+
+repair_dir="$(mktemp -d)"
+test_dir="$(mktemp -d)"
+cleanup() {
+    rm -rf "$repair_dir" "$test_dir"
+}
+trap cleanup EXIT
+
+auditwheel repair --plat "$AUDITWHEEL_PLAT" dist/*-py3-none-any.whl --wheel-dir "$repair_dir"
+rm dist/*-py3-none-any.whl
+mv "$repair_dir"/*.whl dist/
+
+wheel="$(find dist -maxdepth 1 -name '*.whl' -print -quit)"
+sdist="$(find dist -maxdepth 1 -name '*.tar.gz' -print -quit)"
+
+if [ -z "$wheel" ] || [ -z "$sdist" ]; then
+    echo "expected wheel and sdist in bindings/python/dist" >&2
+    exit 1
+fi
+
+case "$wheel" in
+    *py3-none-any*)
+        echo "refusing release wheel with non-platform tag: $wheel" >&2
+        exit 1
+        ;;
+esac
+
+"$PYTHON_BIN" -m venv "$test_dir/wheel"
+"$test_dir/wheel/bin/python" -m pip install --no-index "$wheel"
+"$test_dir/wheel/bin/python" -c "import boltz_client"
+
+"$PYTHON_BIN" -m venv "$test_dir/sdist"
+"$test_dir/sdist/bin/python" -m pip install "$sdist"
+"$test_dir/sdist/bin/python" -c "import boltz_client"

src/swaps/boltz.rs

@@ -19,6 +19,8 @@
 
 use crate::network::Network;
 use crate::{error::Error, network::Chain, util::secrets::Preimage};
+#[cfg(feature = "ws")]
+use crate::util::ensure_rustls_crypto_provider;
 use crate::{BtcSwapScript, LBtcSwapScript};
 use bitcoin::secp256k1;
 use bitcoin::{hashes::sha256, hex::DisplayHex, PublicKey};
@@ -376,6 +378,7 @@ impl BoltzApiClientV2 {
     /// Returns the web socket connection to the boltz server
     #[cfg(feature = "ws")]
     pub async fn connect_ws(&self) -> Result<WebSocketStream, Error> {
+        ensure_rustls_crypto_provider();
         Ok(connect(self.get_ws_url()).await?)
     }
 
@@ -385,6 +388,7 @@ impl BoltzApiClientV2 {
         &self,
         protocols: &[&str],
     ) -> Result<WebSocketStream, Error> {
+        ensure_rustls_crypto_provider();
         Ok(connect_with_protocols(self.get_ws_url(), protocols).await?)
     }
 

src/swaps/status_stream.rs

@@ -1,6 +1,6 @@
 use crate::boltz::{InvoiceCreated, InvoiceError, SwapStatus, WsRequest, WsResponse};
 use crate::error::Error;
-use crate::util::sleep;
+use crate::util::{ensure_rustls_crypto_provider, sleep};
 use futures_util::{SinkExt, StreamExt};
 use log::{debug, error, info, trace, warn};
 use std::collections::{HashMap, HashSet};
@@ -22,6 +22,8 @@ struct RequestPacket {
 
 impl BoltzWsConnection {
     async fn new(url: &str, protocols: Option<&[&str]>) -> Result<Self, Error> {
+        ensure_rustls_crypto_provider();
+
         let ws = if let Some(protocols) = protocols {
             connect_with_protocols(url, protocols).await?
         } else {

src/util/mod.rs

@@ -17,6 +17,9 @@ use crate::error::Error;
 #[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
 static INIT: std::sync::Once = std::sync::Once::new();
 
+#[cfg(feature = "ws")]
+static RUSTLS_CRYPTO_PROVIDER: std::sync::Once = std::sync::Once::new();
+
 /// Setup function that will only run once, even if called multiple times.
 pub fn setup_logger() {
     #[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
@@ -32,6 +35,13 @@ pub fn setup_logger() {
     });
 }
 
+#[cfg(feature = "ws")]
+pub(crate) fn ensure_rustls_crypto_provider() {
+    RUSTLS_CRYPTO_PROVIDER.call_once(|| {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+    });
+}
+
 pub async fn sleep(duration: Duration) {
     #[cfg(not(all(target_family = "wasm", target_os = "unknown")))]
     {