aws-deadline
diff --git a/‎hatch.toml‎
Lines changed: 4 additions & 0 deletions b/‎hatch.toml‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎pyproject.toml‎
Lines changed: 17 additions & 2 deletions b/‎pyproject.toml‎
Lines changed: 17 additions & 2 deletions
diff --git a/‎requirements-testing.txt‎
Lines changed: 3 additions & 0 deletions b/‎requirements-testing.txt‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎scripts/deps_bundle.py‎
Lines changed: 32 additions & 2 deletions b/‎scripts/deps_bundle.py‎
Lines changed: 32 additions & 2 deletions
diff --git a/‎test/installer/test_installer.py‎
Lines changed: 3 additions & 0 deletions b/‎test/installer/test_installer.py‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎test/unit/deadline_submitter_for_cinema4d/test_console_signin_dependencies.py‎
Lines changed: 137 additions & 0 deletions b/‎test/unit/deadline_submitter_for_cinema4d/test_console_signin_dependencies.py‎
Lines changed: 137 additions & 0 deletions
@@ -1,4 +1,8 @@
 [envs.default]
+# The unit tests exercise the submitter, which resolves through the gui extra -- that is
+# where the console extra and awscrt are declared, so the console sign-in dependency
+# tests need them present.
+features = ["gui"]
 pre-install-commands = [
   "pip install -r requirements-testing.txt"
 ]
 
@@ -30,15 +30,30 @@ classifiers = [
 ]
 
 dependencies = [
-    "deadline[gui] >= 0.60.1, < 0.61",
+    # 0.60.4 is the floor because AWS Console sign-in landed there and nowhere earlier:
+    # 0.60.1 through 0.60.3 have no AWS_CONSOLE_LOGIN credentials source, and do not
+    # declare a `console` extra at all.
+    #
+    # The console extra is deliberately NOT requested here. It is only needed by the
+    # submitter, and it pulls awscrt, a compiled wheel. These base dependencies are
+    # resolved into the adaptor package by scripts/create_adaptor_packaging_artifact.sh
+    # with --only-binary=:all: --platform <tag>, and no awscrt wheel satisfying the
+    # 0.28.4 floor exists for the macosx_10_9_x86_64 tag that script uses -- pip walks
+    # back to 0.25.7, which has no usable crypto support, so console sign-in would
+    # appear installed and silently not work. The adaptor never takes the console
+    # path anyway: it runs on a worker with host-provided credentials.
+    "deadline[gui] >= 0.60.4, < 0.61",
     "openjd-adaptor-runtime >= 0.7,< 0.10",
     # fonttools is Windows-only due to Cinema 4D technical limitations
     "fonttools >=4.59.2, <4.64; sys_platform == 'win32'",
 ]
 
 [project.optional-dependencies]
 gui = [
-    "deadline[gui] >= 0.60.1, < 0.61",
+    # The console extra pulls awscrt, which AWS Console sign-in requires: botocore's
+    # LoginProvider refreshes the DPoP-bound cached token in-process, and signing those
+    # proofs needs awscrt. Without it, sign-in fails on a pre-flight dependency check.
+    "deadline[gui,console] >= 0.60.4, < 0.61",
     "PySide6-Essentials == 6.8.3",  # Use 6.8 to align with VFXP 2026: https://vfxplatform.com/#reference-platform
 ]
 
 
@@ -17,3 +17,6 @@ deadline-cloud-test-fixtures >= 0.18.18
 # Drives the real submitter dialog via the OS accessibility tree.
 # Used by test/integ/.
 xa11y >= 0.13.0
+# Both are used by test_console_signin_dependencies.py, which parses pyproject.toml.
+packaging >= 22
+tomli == 2.*; python_version < "3.11"
@@ -14,7 +14,15 @@
 
 SUPPORTED_PYTHON_VERSIONS = ["3.10", "3.11", "3.12", "3.13"]
 SUPPORTED_PLATFORMS = ["Windows", "Linux", "Darwin"]
-NATIVE_DEPENDENCIES = ["xxhash", "psutil"]
+# Packages with compiled extension modules, fetched once per supported Python version so the
+# bundle carries a loadable artifact for each interpreter.
+#
+# awscrt is here because its wheels are not uniformly abi3: Python 3.10 gets
+# _awscrt.cpython-310-<platform>.so while 3.11+ get _awscrt.abi3.so. Resolving it only in
+# the base environment would ship whichever the build host produced, so Cinema 4D 2024-2025
+# (Python 3.10) would fail to import awscrt and AWS Console sign-in would break there while
+# working on 2026.
+NATIVE_DEPENDENCIES = ["xxhash", "psutil", "awscrt"]
 
 PYSIDE6_VERSION = "6.8.3"
 PYSIDE6_PACKAGES = [f"PySide6-Essentials=={PYSIDE6_VERSION}", f"shiboken6=={PYSIDE6_VERSION}"]
@@ -152,10 +160,32 @@ def _get_package_version(package: str, install_path: Path) -> str:
     raise RuntimeError(f"Could not find version for package {package}")
 
 
+def _add_console_extra(requirement: str) -> str:
+    """Add deadline's `console` extra to a requirement string, preserving its specifier."""
+    match = re.fullmatch(
+        r"(?P<name>[A-Za-z0-9._-]+)(?:\[(?P<extras>[^\]]*)\])?(?P<spec>.*)", requirement
+    )
+    if not match or match.group("name").lower() != "deadline":
+        return requirement
+    extras = [extra for extra in (match.group("extras") or "").split(",") if extra]
+    if "console" not in extras:
+        extras.append("console")
+    return f"{match.group('name')}[{','.join(extras)}]{match.group('spec')}"
+
+
 def _build_base_environment(working_directory: Path, dependencies: list[Dependency]) -> Path:
     (working_directory / "base_env").mkdir()
     base_env_path = working_directory / "base_env"
-    dependencies_for_pip = [d.for_pip() for d in dependencies]
+    # The bundle is the submitter, which needs AWS Console sign-in. The console extra is
+    # requested here rather than declared in project.dependencies, because those are also
+    # resolved into the adaptor package, where a compiled awscrt wheel is both unusable and
+    # unavailable for one of the platform tags that build targets (see pyproject.toml).
+    #
+    # Requesting the extra rather than installing awscrt directly means the bundle tracks
+    # whatever the extra actually requires -- notably a botocore floor, since the console
+    # login provider lives in botocore, not in deadline -- and takes awscrt from the exact
+    # version botocore's crt extra pins, rather than resolving it independently and drifting.
+    dependencies_for_pip = [_add_console_extra(d.for_pip()) for d in dependencies]
     base_env_pip_args = [
         "pip",
         "install",
 
@@ -92,6 +92,9 @@ def _validate_files(installation_path: Path) -> None:
     assert "qtpy" in top_level_dir
     assert "xxhash" in top_level_dir
     assert "psutil" in top_level_dir
+    # awscrt reaches the bundle via deadline's console extra, requested by deps_bundle.py.
+    # Without it botocore reports CRT as unavailable and AWS Console sign-in fails.
+    assert "awscrt" in top_level_dir
 
     # Verify PySide6/shiboken6 are bundled and stripped correctly
     assert "PySide6" in top_level_dir
 
@@ -0,0 +1,137 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+"""Guards the dependency declarations that AWS Console sign-in depends on.
+
+Console sign-in is not exercised by the integration tests: it needs an interactive
+browser OAuth handshake and Deadline Cloud Monitor, while CI authenticates by
+assuming a role, so credentials are host-provided and the console path is never
+taken. What can break silently is the dependency declaration, which is what these
+tests pin.
+
+The declaration tests read ``pyproject.toml`` rather than installed distribution
+metadata. ``importlib.metadata`` reflects what was captured at install time, so an
+edit to ``pyproject.toml`` would not be seen until the environment is reinstalled --
+and "somebody edited that line" is precisely the regression being guarded.
+
+Scope matters as much as the versions. ``console`` belongs on the ``gui`` extra and
+not on the base dependencies: the base list is resolved into the adaptor package by
+``scripts/create_adaptor_packaging_artifact.sh`` under ``--only-binary=:all:
+--platform <tag>``, and no awscrt wheel meeting the floor exists for the
+``macosx_10_9_x86_64`` tag that script uses, so pip would silently walk back to a
+release with no usable crypto support.
+"""
+
+import sys
+from pathlib import Path
+
+import pytest
+from packaging.requirements import Requirement
+
+if sys.version_info >= (3, 11):
+    import tomllib
+else:  # pragma: no cover - exercised on Python 3.10 only
+    import tomli as tomllib
+
+PYPROJECT = Path(__file__).parents[3] / "pyproject.toml"
+
+# Console sign-in landed in deadline 0.60.4 and nowhere earlier: 0.60.1 through
+# 0.60.3 have no AWS_CONSOLE_LOGIN credentials source and do not declare a
+# `console` extra at all. 0.60.3 is the highest version that must be excluded.
+HIGHEST_DEADLINE_WITHOUT_CONSOLE_SIGNIN = "0.60.3"
+
+
+def _requirements(*table_path: str) -> list[Requirement]:
+    """Parse a requirement list out of pyproject.toml by table path."""
+    node = tomllib.loads(PYPROJECT.read_text(encoding="utf-8"))
+    for key in table_path:
+        assert key in node, f"pyproject.toml has no {'.'.join(table_path)}"
+        node = node[key]
+    return [Requirement(r) for r in node]
+
+
+def _named(requirements: list[Requirement], name: str) -> list[Requirement]:
+    return [r for r in requirements if r.name == name]
+
+
+@pytest.fixture
+def base_dependencies() -> list[Requirement]:
+    return _requirements("project", "dependencies")
+
+
+@pytest.fixture
+def gui_dependencies() -> list[Requirement]:
+    return _requirements("project", "optional-dependencies", "gui")
+
+
+def test_gui_extra_requests_the_console_extra(gui_dependencies):
+    """The submitter resolves through the gui extra, so console belongs there."""
+    deadline_reqs = _named(gui_dependencies, "deadline")
+    assert deadline_reqs, "the gui extra declares no requirement on deadline"
+    for req in deadline_reqs:
+        assert "console" in req.extras, f"missing console extra in: {req}"
+
+
+def test_base_dependencies_do_not_request_the_console_extra(base_dependencies):
+    """Keeps awscrt out of the adaptor package.
+
+    The base list is resolved into the adaptor artifact for three platform tags under
+    --only-binary=:all:. For macosx_10_9_x86_64 no awscrt wheel meets the floor, so pip
+    resolves backwards to one whose crypto support botocore will not accept -- the build
+    succeeds and console sign-in is quietly broken. The adaptor never signs in
+    interactively, so it has no use for the extra.
+    """
+    for req in _named(base_dependencies, "deadline"):
+        assert (
+            "console" not in req.extras
+        ), f"console extra leaks into the adaptor's dependency closure via: {req}"
+
+    # Copying the requirement in directly is the likelier mistake, and has the same effect.
+    assert not _named(
+        base_dependencies, "awscrt"
+    ), "awscrt must not be a base dependency; it would be resolved into the adaptor package"
+
+
+@pytest.mark.parametrize("table", ["base_dependencies", "gui_dependencies"])
+def test_deadline_floor_excludes_releases_without_console_signin(table, request):
+    """Guards the floor itself, not whatever a resolver happened to select.
+
+    An installed-version check cannot do this: with a loosened ">= 0.60.1"
+    requirement, pip still resolves the newest 0.60.x, so the regression passes
+    unnoticed.
+    """
+    for req in _named(request.getfixturevalue(table), "deadline"):
+        assert not req.specifier.contains(HIGHEST_DEADLINE_WITHOUT_CONSOLE_SIGNIN), (
+            f"allows deadline {HIGHEST_DEADLINE_WITHOUT_CONSOLE_SIGNIN}, which has no "
+            f"console sign-in support: {req}"
+        )
+
+
+def test_botocore_sees_awscrt():
+    """The load-bearing runtime check.
+
+    botocore binds EC only when has_minimum_crt_version((0, 28, 4)) passes, and
+    deadline.client refuses console sign-in when it is None. This is the exact
+    condition upstream branches on, so it fails whenever awscrt is missing, too old,
+    or disabled -- unlike importing awscrt.crypto.EC, which succeeds from 0.28.3 and
+    would pass while sign-in is still broken.
+    """
+    from botocore.compat import EC
+
+    assert EC is not None, "botocore does not see awscrt; console sign-in will fail"
+
+
+def test_console_login_preflight_is_reachable():
+    """Smoke test for the guard the submitter hits when a user signs in.
+
+    Deliberately not the file's guarantee: this helper returns normally both when
+    awscrt works and when botocore.compat cannot be imported at all, so "did not
+    raise" proves little. test_botocore_sees_awscrt carries that. Skipped rather than
+    failed if the private helper is renamed upstream, which is not a breaking change
+    within the floating requirement range.
+    """
+    loginout = pytest.importorskip("deadline.client.api._loginout")
+    check = getattr(loginout, "_check_console_login_dependency", None)
+    if check is None:
+        pytest.skip("upstream renamed the console-login preflight helper")
+
+    check("test-profile")
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,8 @@`
`1`	`1`	`[envs.default]`
	`2`	`+# The unit tests exercise the submitter, which resolves through the gui extra -- that is`
	`3`	`+# where the console extra and awscrt are declared, so the console sign-in dependency`
	`4`	`+# tests need them present.`
	`5`	`+features = ["gui"]`
`2`	`6`	`pre-install-commands = [`
`3`	`7`	`"pip install -r requirements-testing.txt"`
`4`	`8`	`]`