Skip to content

[Bug] Frozen Z3 macOS ARM wheel metadata fails pip check #783

Open

Description

@djm81

The frozen Z3 5.0.0.0 macOS ARM wheel has inconsistent filename and internal platform tags. Normal pip and uv installs succeed, but pip 26.2.1 reports z3-solver 5.0.0.0 is not supported on this platform during pip check.

Observed on 2026-10-21 Europe/Berlin with macOS 27.0.1 ARM64 and Python 3.12.13. The same failure reproduces in the unchanged frozen environment containing upstream Semgrep 1.179.0 and in both fresh full [dev,scanning] consumer environments. It is independent of PR #782's scanner rename. Native Z3 solver execution has not been tested.

Exact published frozen wheel, SHA256 37d44cf3c90c4c4629d8a074b432bbf06c30ed937b76c79088df9d6534aba50a:

  • Filename tag is py3-none-macosx_13_0_arm64, supported by this host.
  • Internal WHEEL declares Tag: py3-none-macosx_13_3_arm64, absent from supported tags.
  • Installed WHEEL metadata matches the exact downloaded lock-hash artifact.
  • Latest unconstrained Z3 5.3.1.0 also failed this check, so upgrading to latest is not a verified fix.

The actual full candidate pip and uv inventories contain the same 178 distributions. Both fail python -m pip check solely on this Z3 error. The separate [scanning] graph contains 93 equal distributions, omits optional CrossHair/Z3, passes pip check in both installers and passes real installed core scanner behavior. That supported consumer path does not waive the full development gate.

Track under #780, discovered while validating #782. Full development adoption remains blocked by this packaging defect. No dependency pin, installed metadata or check was changed.

Acceptance requires a corrected upstream artifact or separately reviewed dependency selection, normal hash-protected pip and uv installs on macOS ARM, matching supported filename/internal tags, passing pip check, and actual CrossHair/Z3 execution. Keep TLS and integrity checks enabled. Do not retag installed metadata or suppress pip check. Preserve the baseline regression and verify the chosen fix before changing canonical locks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingdependenciesDependency resolution and management

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions