{Packaging} Prepare native Windows ARM64 packages by illume · Pull Request #34195 · Azure/azure-cli

René Dudfield (illume) · 2026-10-08T12:57:28Z

🤖 PR Validation — ️✔️ All clear

Breaking Changes
️✔️ None

WIP: this is a proof of concept to identify the remaining work for native
Windows ARM64 packaging.

The current Windows lock has three packages without CPython 3.14 ARM64 wheels:
bcrypt==3.2.0, cryptography==48.0.1, and psutil==6.1.0. Newer bcrypt and
psutil releases publish ARM64 wheels. Cryptography ARM64 wheels return in
version 51, which also requires a compatible pyOpenSSL release.

Related command

N/A

Description

Prepare native Windows ARM64 Azure CLI packages for
Azure/azure-cli#29317.

This draft:

adds ARM64 support to the Windows embedded-Python builder;
upgrades to WiX 3.14.1, verifies its SHA-256 digest, and adds ARM64 MSI
product metadata and upgrade handling;
adds gated matrix entries for ARM64 MSI and ZIP builds and installation
tests on a proposed native Windows ARM64 pool;
updates manual and pipeline installation tests for the native Program Files
location; and
gates ARM64 dependency verification, builds, and installation tests behind
the enableWindowsArm64 pipeline parameter, which defaults to false.

The existing released dependency pins remain unchanged so ordinary development
and CI environments stay resolvable. Enable the ARM64 jobs only after:

cryptography 51 publishes its merged Windows ARM64 wheels, tracked by
pyca/cryptography#15350;
a compatible pyOpenSSL release is available;
the Windows lock uses architecture-specific pins that preserve win32
support; and
pool-windows-2022-arm64 is a proposed pool name and must be provisioned or
replaced with the platform engineering team's final 1ES pool.

Keep this PR in draft until those dependency and infrastructure gates are
available.

Assisted by Copilot.

Testing Guide

Completed:

python build_scripts/windows/tests/test_arm64_packaging.py
python -m py_compile \
  build_scripts/windows/scripts/test_msi_package.py \
  build_scripts/windows/tests/test_arm64_packaging.py
git -c core.whitespace=cr-at-eol diff --check upstream/dev..HEAD

All five focused packaging configuration tests pass.
Both changed Azure Pipelines YAML files parse successfully.
WiX 3.14.1 Wix.targets maps InstallerPlatform from Platform; the pinned
release archive matches SHA-256
6ac824e1642d6f7277d0ed7ea09411a508f6116ba6fae0aa5f2c7daa2ff43d31.
CPython 3.14.8 publishes the required Windows ARM64 embeddable archive.
In Azure Pipelines build 363343,
both existing Windows x86 and x64 MSI jobs passed after the WiX 3.14 update.
The overall run was later canceled when the branch history was rewritten.
A fork-only matching validation run
also built and verified both MSI files.
A binary-only audit of the current 143 Windows requirements found 140
compatible ARM64 wheels. ARM64 CI remains disabled by default because the
current bcrypt, cryptography, psutil, and related pyOpenSSL pins require a
coordinated update.
A fork-only native Windows ARM64
source-build probe
downloaded the ARM64 embedded Python runtime and built the local Azure CLI,
core, and telemetry wheels. Pip selected source archives for bcrypt and
cryptography; cryptography then stopped before Rust compilation because its
isolated embedded-Python build environment could not import maturin.

Not completed:

A complete native Windows ARM64 MSI/ZIP build. Source fallback needs the
upstream cryptography wheel toolchain (maturin, Rust, and static OpenSSL),
and the proposed Azure Pipelines pool is not yet configured.
ARM64 dependency-lock verification, because cryptography 51 and the
compatible pyOpenSSL release do not yet exist.

History Notes

N/A

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

azure-pipelines · 2026-10-08T12:57:39Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

microsoft-github-policy-service · 2026-10-08T12:58:01Z

Thank you for your contribution René Dudfield (@illume)! We will review the pull request and get back to you soon.

Aditya Pujara (a0x1ab) · 2026-10-08T13:15:45Z

/azp run

azure-pipelines · 2026-10-08T13:16:04Z

Azure Pipelines: Successfully started running 3 pipeline(s).

René Dudfield (illume) · 2026-10-08T13:27:32Z

/azp run

azure-pipelines · 2026-10-08T13:27:40Z

Commenter does not have sufficient privileges for PR 34195 in repo Azure/azure-cli

Aditya Pujara (a0x1ab) · 2026-10-08T14:18:46Z

/azp run

azure-pipelines · 2026-10-08T14:19:05Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Yong Zhang (yonzhan) · 2026-10-08T22:10:05Z

Please fix CI issues

René Dudfield (illume) · 2026-10-20T07:16:22Z

I checked https://github.com/pyca/cryptography/tags no new release yet.

Aditya Pujara (a0x1ab) · 2026-10-20T07:18:58Z

/azp run

azure-pipelines · 2026-10-20T07:19:15Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Model the dependency versions needed for native Windows ARM64 packaging across the generated platform locks. Keeping the three lock files aligned avoids platform-specific resolution drift while the packaging work is developed.

Teach the Windows builder to select the ARM64 CPython runtime and emit an ARM64 MSI with architecture-specific product metadata. Update install tests and documentation to use the native Program Files location. WiX 3.14 is required because the previous WiX 3.10 toolset cannot build ARM64 Windows Installer packages.

Add proposed native Windows ARM64 matrix entries for dependency validation, MSI and ZIP packaging, and installation tests. Keep existing x86 and x64 jobs on their current pool and preserve architecture-specific artifacts. Extend the packaging regression test so future pipeline edits cannot silently drop ARM64 coverage.

Add Debug and Release ARM64 mappings to the Windows solution so local and IDE builds select the ARM64 WiX project configuration consistently with the command-line packaging flow.

Pin and verify the SHA-256 digest of the WiX 3.14.1 archive before extraction. The build downloads executable packaging tools, so a corrupted or replaced archive must fail rather than enter the release toolchain.

Use psutil 7.2.2 only on Windows ARM64, where it provides a native wheel. Keep Windows x86 on 6.1.0 because newer psutil releases no longer publish a win32 wheel and the existing x86 MSI must remain buildable.

Select the future cryptography and pyOpenSSL pair only on Windows ARM64. Keep the current pair for other Windows architectures because cryptography 50 and later no longer publish win32 wheels. This preserves the existing x86 MSI while preparing ARM64 for the first cryptography release that publishes native wheels.

Restore the released dependency locks and compile-time gate ARM64 pipeline entries behind a disabled parameter. Cryptography 51, its compatible pyOpenSSL release, and the native Windows ARM64 pool are not available yet. The gate keeps normal development and CI environments resolvable while retaining the packaging and test wiring for later activation.

Version the local WiX cache directory. The builder reuses an existing cache, so sharing the old path could silently run WiX 3.10 and fail to produce a valid ARM64 package.

Detect an installed ARM64 product from the x64 MSI and require it to be removed first. Windows ARM64 can run the x64 package under emulation, and both architectures use the native Program Files path. Because the products have separate upgrade codes, allowing both would let the x64 installer overwrite files without a coordinated MSI upgrade.

René Dudfield (illume) · 2026-10-20T07:46:41Z

Tried to fix CI errors, added commit message bodies, and then rebased on current dev.

Make the WiX download follow GitHub release redirects and fail on HTTP errors before verifying or extracting the archive. In cmd.exe, `if errorlevel 1` means the exit code is greater than or equal to 1, so it catches values such as 1 and 3. It is also evaluated when the statement executes. By contrast, `%errorlevel%` inside a parenthesized block is expanded when the entire block is parsed. The previous checks could therefore read a stale value, ignore checksum and unzip failures, and fail later when MSBuild could not find Heat.exe.

Gleb Khmyznikov (khmyznikov) · 2026-10-20T20:53:29Z

René Dudfield (@illume) you'll have to bump some deps but you can use conda to get missing packages:

conda install bcrypt==5.0.0
conda install cryptography==49.0.0
conda install psutil==7.2.2

microsoft-github-policy-service Bot requested review from ZelinWang (wangzelin007) and Yong Zhang (yonzhan) October 8, 2026 12:57

microsoft-github-policy-service Bot added the customer-reported Issues that are reported by GitHub users external to the Azure organization. label Oct 8, 2026

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot Packaging act-platform-engineering-squad labels Oct 8, 2026

Yong Zhang (yonzhan) requested review from mansoor sarfraz (msarfraz) and Naga Nandyala (naga-nandyala) October 8, 2026 22:09

Yong Zhang (yonzhan) assigned mansoor sarfraz (msarfraz) Oct 8, 2026

Yong Zhang (yonzhan) added this to the Backlog milestone Oct 8, 2026

René Dudfield (illume) force-pushed the feature/windows-arm64-packaging branch from 16157d0 to 8f4cedc Compare October 20, 2026 07:17

René Dudfield (illume) added 7 commits October 20, 2026 09:40

{Packaging} Prepare dependencies for Windows ARM64

464f2b9

Model the dependency versions needed for native Windows ARM64 packaging across the generated platform locks. Keeping the three lock files aligned avoids platform-specific resolution drift while the packaging work is developed.

{Packaging} Add Windows ARM64 solution configurations

6337476

Add Debug and Release ARM64 mappings to the Windows solution so local and IDE builds select the ARM64 WiX project configuration consistently with the command-line packaging flow.

{Packaging} Verify WiX 3.14 build tools

b2271f3

Pin and verify the SHA-256 digest of the WiX 3.14.1 archive before extraction. The build downloads executable packaging tools, so a corrupted or replaced archive must fail rather than enter the release toolchain.

{Packaging} Preserve psutil support for Windows x86

11ae7d8

Use psutil 7.2.2 only on Windows ARM64, where it provides a native wheel. Keep Windows x86 on 6.1.0 because newer psutil releases no longer publish a win32 wheel and the existing x86 MSI must remain buildable.

René Dudfield (illume) added 3 commits October 20, 2026 09:40

{Packaging} Isolate the WiX 3.14 tool cache

7944fd3

Version the local WiX cache directory. The builder reuses an existing cache, so sharing the old path could silently run WiX 3.10 and fail to produce a valid ARM64 package.

René Dudfield (illume) force-pushed the feature/windows-arm64-packaging branch from 8f4cedc to 4a8ba74 Compare October 20, 2026 07:41

René Dudfield (illume) force-pushed the feature/windows-arm64-packaging branch from 4a8ba74 to 0cf1ed8 Compare October 20, 2026 07:54

Conversation

René Dudfield (illume) commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ️✔️ All clear

Uh oh!

azure-pipelines Bot commented Oct 8, 2026

Uh oh!

microsoft-github-policy-service Bot commented Oct 8, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 8, 2026

Uh oh!

azure-pipelines Bot commented Oct 8, 2026

Uh oh!

René Dudfield (illume) commented Oct 8, 2026

Uh oh!

azure-pipelines Bot commented Oct 8, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 8, 2026

Uh oh!

azure-pipelines Bot commented Oct 8, 2026

Uh oh!

Yong Zhang (yonzhan) commented Oct 8, 2026

Uh oh!

René Dudfield (illume) commented Oct 20, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 20, 2026

Uh oh!

azure-pipelines Bot commented Oct 20, 2026

Uh oh!

René Dudfield (illume) commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Gleb Khmyznikov (khmyznikov) commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

René Dudfield (illume) commented Oct 8, 2026 •

edited

Loading

René Dudfield (illume) commented Oct 20, 2026 •

edited

Loading