chore: Allow dependency rustworkx 0.14.x

[harryzcy]

User description

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Allow using rustworkx 0.13.x and 0.14.x.

rustworkx 0.13.0 doesn't provide a arm64 linux support with musl (musllinux2014_aarch64). Thus, installing requires a Rust compiler. rustworkx 0.14.x solves this (see Qiskit/rustworkx#1115).

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:

Updates the allowed version range for the rustworkx dependency from 0.13.x to include 0.14.x. This change is made to address an issue with arm64 linux support using musl in rustworkx 0.13.0, which is resolved in version 0.14.x. The update affects the Pipfile and Pipfile.lock files, adjusting the rustworkx version constraint and updating related dependencies.

Topic	Details
Dependency Update	Updates the rustworkx dependency version range to include 0.14.x Modified files (2) Pipfile.lock Pipfile Latest Contributors(2) User Commit Date omryMen chore-secrets-bump-det... November 21, 2024 tsmithv11 chore-general-bump-det... November 19, 2024

This pull request is reviewed by Baz. Join @harryzcy and the rest of your team on (Baz).

[IvanIsCoding]

Hi folks, just to give a little bit more of context to Chongyi's PR. From what I understood, many users use checkov in Docker containers with Alpine Linux, hence they need musl wheels. After checkov added a dependency for rustworkx, we got a couple requests and added musl x86 for our 0.13.x releases which covered most of the downloads.

However, one item we missed were musl aarch64 wheels. Althought not as common in production, this is a common scenario in development for Mac users with M series chips that use Alpine inside Docker. We started supporting this use with Qiskit/rustworkx#1008, which was only released in the 0.14.x wheels.

The diff of the PR is small but the consequence is that many Mac users will now be able to run Alpine-based Docker containers checkov.

[harryzcy]

Thanks for the comment @IvanIsCoding

super-linter which includes checkov is preparing for arm64/aarch64 support super-linter/super-linter#5070, thus would really appreciate the support for rustworkx's musl aarch64 wheels

[gruebel]

You also need to adjust the setup.py otherwise it won't work, because the Pipfile is for local development and running the UTs, but has no consequences on published package.

As mentioned in other issues and also in the docs, checkov is not supported on Alpine and it is highly not recommended to run bigger Python projects on Alpine, because of the possible incompatibility of C extensions and the increased buildtime.

[harryzcy]

You also need to adjust the setup.py otherwise it won't work, because the Pipfile is for local development and running the UTs, but has no consequences on published package.

It's updated.

[harryzcy]

@gruebel Can you help to review this again? Thanks

[harryzcy]

@gruebel Is there anything blocking that I need to help with? Can you allow the workflows to run so that I would know if there's any issues? Thanks

This PR will reduce build time on arm64 by a lot and is needed downstream.

[pazbechor]

@harryzcy
Thanks for the contribution ;)
Please resolve the conflicts so I'll run the workflows

[harryzcy]

@pazbechor Thank you! I just fixed the conflicts

[harryzcy]

@pazbechor @gruebel can you review the changes?

[harryzcy]

@harryzcy - Looks like there are conflicts again?

resolved

[mlschechter]

@harryzcy - Thanks! This is blocking my team unless we add a Rust installation to our GH workflow; not sure what changed, but this wasn't an issue in 3.2.254. Hopefully, we can get this merged soon 😁

[Frodothedwarf]

@harryzcy is this being actively resolved? Seems like I have an issue installing Checkov because of this.

[harryzcy]

@harryzcy is this being actively resolved? Seems like I have an issue installing Checkov because of this.

yep, I'm updating it. but looks like no one is reviewing it.

[harry1C-cw]

Any update on this? Currently blocked by this

[mlschechter]

@nimrodkor / @gruebel / @JamesWoolfenden - Is there anything that can be done to get this PR merged and released? Using Checkov for the latest versions (which in some cases is out of our control) requires Rust, and it seems like a relatively simple fix to make this update.

Thanks in advance!

[Nawazsherif]

Anyone looking into this pull request? We need this to be fixed to use checkov.

[aschleifer]

Can we actually bump rustworkx to 0.15.x as this would also add python 3.13 support for checkov? See Qiskit/rustworkx#1354 for details.

This is now a full blocker on using checkov on current python 3.13.

You also need to adjust the setup.py otherwise it won't work, because the Pipfile is for local development and running the UTs, but has no consequences on published package.

Just as a side note: This comment from earlier says the setup.py needs to be updated, but I don't see an update for this file in this PR. @harryzcy can you add this? Maybe this is blocking the merge?

[pazbechor]

As @gruebel wrote earlier - we should not merge this PR.
from my understanding, The main issue here is the musl vs. glibc Compatibility, and as checkov is not supported on Alpine, we should not make those adjustments.
Please reply!
Thanks for the contribution,
#6045 (comment)

[aschleifer]

As @gruebel wrote earlier - we should not merge this PR. from my understanding, The main issue here is the musl vs. glibc Compatibility, and as checkov is not supported on Alpine, we should not make those adjustments. Please reply! Thanks for the contribution, #6045 (comment)

But if you don't plan to merge this, how do you then plan to get checkov to work on python 3.13? To be frank I don't care about alpine or aarm64 support, but holding back the python version is just not the right way to go forward.

[pazbechor]

@aschleifer We will update regarding python 3.13,
@tsmithv11 can elaborate regarding it.

[aschleifer]

@pazbechor and @tsmithv11 I'm curious to hear how you want to provide python 3.13 support without updating rustworkx as it seems the version you are using from it right now is not compatible.

This is a major blocker for us as this either means we need to keep every devops and developer on python 3.12 or replace checkov with a different tool.

[tsmithv11]

We are planning to support Python 3.13 in the coming months and as part of that we'll have a thorough engineering review of all dependencies and conflicts.

[harryzcy]

@tsmithv11 It looks like PR that support Python 3.13 is merged, but rustworkx versions are not updated yet. Do you have plan to update that?