pipx install fails on Python 3.14/3.15 because yara-python 4.5.4 has no wheels and its source build fails against OpenSSL 4 #1008

Summary

SkillSpector now declares support for Python 3.15 (#863, #864, included in the 2.14.0 release candidate in #959), but it cannot be installed on Python 3.14 or 3.15 from the published yara-python release. The latest yara-python on PyPI (4.5.4) has no wheels for those Python versions, and its source build fails when the build environment has OpenSSL 4 headers (for example, Homebrew on macOS).

The requires-python bump is necessary but not sufficient to make 3.14 and 3.15 installable.

Environment

• macOS (arm64), Homebrew
• Python 3.15 (/opt/homebrew/opt/python@3.15)
• OpenSSL 4 headers in /opt/homebrew/include/openssl
• pipx 1.18.11 (uses uv)
• SkillSpector v2.13.3 (and the commit ID 1883ccf973b4bf48a3c320b0513d80b163d7cddb which is the 2.14.0 RC)

Steps to reproduce

pipx install "git+https://github.com/NVIDIA/SkillSpector.git@v2.13.3"

Note: on v2.13.3, requires-python = ">=3.12,<3.15" would normally reject Python 3.15 first. I got to the build step because pipx used a 3.15 interpreter. The same yara-python failure applies to 2.14.0 because main and ca22d27 (#959) both keep requires-python = ">=3.12,<3.16" and yara-python>=4.5.0.

Actual result

error: Failed to build `yara-python==4.5.4`
  ...
  yara/libyara/modules/pe/authenticode-parser/authenticode.c:81:47: error: incomplete definition of type 'ASN1_STRING' (aka 'struct asn1_string_st')
  ...
  5 warnings and 16 errors generated.
hint: `yara-python` (v4.5.4) was included because `skillspector` (v2.13.3) depends on `yara-python`

Cause

1. yara-python 4.5.4 is the newest release on PyPI. It ships wheels for cp39 to cp313 only, so Python 3.14 and 3.15 fall back to the sdist.
2. The sdist build fails against OpenSSL 4 because ASN1_STRING and ASN1_OCTET_STRING are now opaque types, and 4.5.4's bundled authenticode parser reads their fields directly.
3. SkillSpector requires yara-python>=4.5.0, which resolves to 4.5.4. A constraint on the SkillSpector side cannot select a newer release because none exists on PyPI.

The upstream VirusTotal/yara-python repository has tags v4.5.5 and v4.5.8 that are not on PyPI. v4.5.8 builds successfully in the environment above.

Workaround

Install yara-python from the git tag first, then install SkillSpector (this requires a C compiler and the Python headers):

pipx install \
  --preinstall "yara-python @ git+https://github.com/VirusTotal/yara-python.git@v4.5.8" \
  "git+https://github.com/NVIDIA/SkillSpector.git@<ref>"

Using Python 3.12 or 3.13 also avoids the problem, because yara-python 4.5.4 has wheels for those versions.

Suggested actions

• Document that Python 3.14 and 3.15 currently need a yara-python build from source or git until a newer release is on PyPI, and that 3.12 or 3.13 is the zero-friction option.
• Track an upstream yara-python release that publishes 3.14 and 3.15 wheels and includes the OpenSSL 4 fix, then raise the yara-python lower bound once it exists.
• Consider noting this limitation in the 2.14.0 release notes, which currently list Python 3.15 support (feat: support Python 3.15 #864) without this caveat.

Related

• Support Python 3.15 #863, feat: support Python 3.15 #864 (Python 3.15 support)
• SkillSpector 2.14.0 release #959 (2.14.0 release candidate)