Intel macOS standalone builds fail on Apple Silicon with cryptography 49.0.0

[victorlin]

CI started failing 2 days ago in test-standalone / run-integration-tests, but only on Apple Silicon runners (macos-14, macos-15).

The failure is:

ImportError: dlopen(.../lib/cryptography/hazmat/bindings/_rust.abi3.so, ...):
Library not loaded: /usr/local/opt/openssl@3/lib/libssl.3.dylib

The timing lines up with the release of cryptography 49.0.0, which differs from previous versions in that it does not come with macOS x86_64 wheels, intentionally. The Intel (x86_64) standalone build therefore no longer gets a portable wheel and instead records a local build-machine dylib path.

Possible solutions

1. Temporarily pin cryptography <49.0.0 #536
2. Drop testing for macOS x86 on aarch64 #537
3. Adjust the PyOxidizer macOS build process to bundle or relink OpenSSL dylibs so source-built cryptography does not depend on Homebrew paths

[victorlin]

I'll make a PR for (1) soon as a short-term fix, but am leaning towards (2). Apple Silicon users should be using the native standalone executable anyways.

[joverlee521]

I think (2) makes sense. What does this entail other than dropping the tests?

[victorlin]

No other code changes needed. The installer script already prefers native standalone executables.¹ A note in changelog would be good. I'll make a PR.

¹ The only potential catch would have been if nextstrain update cli was supported pre-8.2.0. In that case, users would be stuck with the Intel executable as long as they used nextstrain update cli, which runs under Rosetta and would probably self-update to the Intel-based executable. Luckily the only installation path pre-8.2.0 is running the installer script manually, which under normal terminals will install the native executable. For users that are intentionally using the Intel executable with emulation for whatever reason, a changelog entry should suffice and I wouldn't classify this as "breaking" enough to warrant major version bump.