feat: bump deadline version to 0.60.4 and add optional console sign in deps by andychoquette · Pull Request #525 · aws-deadline/deadline-cloud-for-cinema-4d

andychoquette · 2026-08-13T19:37:44Z

What was the problem/requirement? (What/Why)

The submitter cannot use AWS Console sign-in. Attempting it fails with:

Signing in to the AWS Console sign-in profile <name> requires an additional
dependency. Install it with: pip install "deadline[console]"

Two independent causes:

The console extra was never requested, so awscrt was never installed. Console sign-in moves credential refresh into the calling process — the cached token in ~/.aws/login/cache/ is bound to a DPoP key, and botocore's LoginProvider signs those proofs in-process using awscrt. Without it, every API call raises MissingDependencyException, and deadline.client fails fast rather than letting the post-launch poll loop hang forever.
The floor was too low. Console sign-in landed in deadline 0.60.4 and nowhere earlier:

version extras AWS_CONSOLE_LOGIN preflight guard

0.60.1 – 0.60.3 gui, mcp absent absent

0.60.4 console, gui, mcp present present

So >= 0.60.1 could resolve to a version where deadline[console] is not even a valid request.

Note this is not specific to the manual install path — the official installer bundles whatever project.dependencies declares, so it shipped without awscrt too.

What was the solution? (How)

deadline[gui,console] >= 0.60.4, < 0.61 in both dependencies and optional-dependencies.gui. The < 0.61 cap is unchanged and matches the maya/nuke/houdini/blender integrations.
Added awscrt to NATIVE_DEPENDENCIES in scripts/deps_bundle.py.

That second change is the non-obvious half. awscrt wheels are not uniformly abi3: Python 3.10 gets _awscrt.cpython-310-<platform>.so while 3.11+ get _awscrt.abi3.so. Resolving it only in the base environment would ship whichever artifact the build host produced, so Cinema 4D 2024–2025 (Python 3.10) would have received an unloadable extension module — console sign-in would have worked on 2026 and broken on older versions, which is an unpleasant failure to diagnose from a bug report.

This makes the Cinema 4D floor stricter than the sibling integrations, which sit at >= 0.60.2. That is deliberate: those do not require the console extra, and this one does.

What is the impact of this change?

AWS Console sign-in works from the submitter. Raises the minimum deadline version from 0.60.1 to 0.60.4. No public interface, adaptor, schema, or job-bundle change. Customers are unaffected at resolve time since the installer bundles dependencies at build time.

How was this change tested?

Unit tests: yes. 363 passing, 6 skipped; hatch run lint and mypy clean. Added test_console_signin_dependencies.py (5 tests) covering the minimum version, the AWS_CONSOLE_LOGIN credentials source, that awscrt imports, that botocore.compat.EC is not None, and that _check_console_login_dependency does not raise. Confirmed these catch the regression: reverting to deadline[gui] >= 0.60.1 fails three of the five.
Integration tests: not applicable. Console sign-in needs an interactive browser OAuth handshake and Deadline Cloud Monitor, whereas CI authenticates by assuming a role, so credentials are host-provided and the console path is never exercised. The dependency guards above are the coverage that is actually possible.
Submitter changes: yes, dependencies only. Verified by hand on macOS with Cinema 4D 2026: sign-in with an AWS_CONSOLE_LOGIN profile succeeds and deadline auth status reports AUTHENTICATED. Also verified a real dependency-bundle build contains both awscrt artifacts (_awscrt.abi3.so and _awscrt.cpython-310-darwin.so), matching the existing xxhash pattern, and that a fresh resolve of .[gui] selects deadline 0.60.4, awscrt 0.36.0, and PySide6-Essentials 6.8.3.

Was this change documented?

No documentation change needed — no public interface or schema change. The rationale for the 0.60.4 floor and for adding awscrt to NATIVE_DEPENDENCIES is captured in comments at both edit sites, since neither is self-evident from the diff.

Is this a breaking change?

No. It raises a minimum dependency version but does not change the adaptor interface, the init-data or run-data schemas, or job-bundle compatibility. A job submitted with an older submitter still works with this adaptor.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…sign-in The submitter cannot use AWS Console sign-in. Attempting it fails with "Signing in to the AWS Console sign-in profile <name> requires an additional dependency". Two causes, both addressed here. The console extra was never requested, so awscrt was never installed. Console sign-in moves credential refresh into the calling process: the cached token is bound to a DPoP key and botocore's LoginProvider signs those proofs in-process, which needs awscrt. Requesting deadline[gui,console] pulls it in. The floor was also too low. Console sign-in landed in deadline 0.60.4 and nowhere earlier -- 0.60.1 through 0.60.3 have no AWS_CONSOLE_LOGIN credentials source and do not declare a console extra at all, so the previous ">= 0.60.1" range could resolve to a version where deadline[console] is not a valid request. Raised to ">= 0.60.4". Also added awscrt to the installer's NATIVE_DEPENDENCIES. Its wheels are not uniformly abi3: Python 3.10 gets _awscrt.cpython-310-<platform>.so while 3.11+ get _awscrt.abi3.so. Resolving it only in the base environment would ship whichever artifact the build host produced, so Cinema 4D 2024-2025 (Python 3.10) would have received an unloadable extension module and console sign-in would have broken there while working on 2026. Verified a built dependency bundle contains both awscrt artifacts, matching the existing xxhash pattern, and that a fresh resolve of .[gui] selects deadline 0.60.4, awscrt 0.36.0 and PySide6-Essentials 6.8.3. Note this raises the minimum deadline version from 0.60.1 to 0.60.4. Signed-off-by: andychoquette <78888816+andychoquette@users.noreply.github.com>

Console sign-in cannot be covered by the integration tests: it needs an interactive browser OAuth handshake and Deadline Cloud Monitor, while CI authenticates by assuming a role, so the credentials source is host-provided and the console path is never taken. What can break silently is the dependency requirements themselves, which is what these tests pin: - deadline is at least 0.60.4, below which there is no console sign-in support - AwsCredentialsSource.AWS_CONSOLE_LOGIN exists, which is how login_session profiles are recognised - awscrt is installed, and botocore.compat.EC is not None -- that symbol is awscrt.crypto.EC, or None when awscrt is missing or older than 0.28.4, and is the same check LoginProvider makes before accepting a login_session profile - _check_console_login_dependency does not raise, which is the guard the submitter actually hits when a user signs in Confirmed these catch the regression: reverting the dependency to "deadline[gui] >= 0.60.1" fails three of the five. Signed-off-by: andychoquette <78888816+andychoquette@users.noreply.github.com>

Addresses review feedback on the console sign-in dependency guards. The floor test asserted on the installed version, which cannot detect the regression it existed to prevent: with the requirement loosened back to ">= 0.60.1", pip still resolves the newest 0.60.x, so version("deadline") stays above the floor and the test passes. It also duplicated the floor as a second constant that could drift from pyproject.toml. Replaced with two tests that read this package's own declared Requires-Dist and assert on the requirement itself -- that it asks for the console extra, and that its specifier excludes 0.60.3, the highest release without console sign-in support. Reading the distribution metadata rather than parsing pyproject.toml keeps this stdlib-only on Python 3.10, where tomllib is unavailable. Also reduced the exposure to private deadline-cloud internals, so a patch release inside the floating ">= 0.60.4, < 0.61" range cannot turn a rename into an unrelated CI failure: - botocore.compat.EC is replaced by awscrt.crypto.EC, which is the public symbol that undocumented re-export conditionally imports, plus an explicit awscrt version assertion for the 0.28.4 floor - the _check_console_login_dependency and AwsCredentialsSource checks now skip rather than error if those private names move Confirmed the guards still bite: reverting the requirement to "deadline[gui] >= 0.60.1" fails five of the six, including both declared requirement tests with messages naming the offending specifier. Signed-off-by: andychoquette <78888816+andychoquette@users.noreply.github.com>

Addresses review feedback. The console extra was added to the base dependencies, which resolve into the adaptor package. That is both wrong in scope and actively harmful. scripts/create_adaptor_packaging_artifact.sh installs this package with --only-binary=:all: --platform <tag> and no --no-deps, for manylinux2014_x86_64, win_amd64 and macosx_10_9_x86_64. No awscrt wheel meeting the 0.28.4 floor exists for the macOS x86_64 tag, because current releases target macosx_10_15_universal2 -- so pip walks backwards and resolves 0.25.7. That has no crypto support botocore will accept, so the build succeeds and console sign-in is silently broken. Verified by resolving each of the three tags directly. The adaptor also has no use for it: it runs on a worker with host-provided credentials and never takes the interactive sign-in path. Upstream keeps console opt-in for this reason, noting awscrt is a compiled wheel and the library is imported from embedded application Pythons. So console and a direct "awscrt >= 0.28.4" now live on the gui extra, which is what the submitter resolves through. The floor is declared rather than left to whatever deadline[console] permits: botocore binds its EC symbol only when has_minimum_crt_version((0, 28, 4)) passes, so awscrt 0.28.3 imports awscrt.crypto.EC fine while console sign-in stays broken. Because get_dependencies reads project.dependencies only, the installer bundle would otherwise lose awscrt entirely. deps_bundle.py now installs it explicitly, in the same spirit as PySide6 -- another submitter-only compiled dependency declared in the gui extra. It runs before _download_native_dependencies, which pins native packages to the versions resolved in the base environment. The unit test environment gains the gui extra so it exercises the submitter's real dependency set, and tomli is declared for Python 3.10 where tomllib is absent. Also corrects the tests: - they read pyproject.toml rather than installed distribution metadata, which is captured at install time and therefore blind to the edit being guarded until the environment is reinstalled - the console-extra assertion is scoped to the gui extra, with a separate test asserting the base dependencies do NOT request it, rather than demanding it on every deadline requirement - botocore.compat.EC is restored as the load-bearing runtime check. The preflight helper returns normally both when awscrt works and when botocore.compat cannot be imported, so "did not raise" proved little; it is kept as a smoke test - the awscrt comment no longer claims crypto.EC first appears in 0.28.4; it exists from 0.28.3 and botocore's version gate is what matters Confirmed each guard bites independently: putting console back in the base list, dropping it from the gui extra, and lowering the awscrt floor each fail exactly one test. Signed-off-by: andychoquette <78888816+andychoquette@users.noreply.github.com>

The comments claimed the direct "awscrt >= 0.28.4" requirement exists because deadline[console] would otherwise permit something too low. That is not true: the console extra requires botocore[crt] >= 1.42.89, and botocore's crt extra pins awscrt to an exact version per release -- 1.42.89 pins 0.31.2, and every later release in the range pins newer. A normal install therefore satisfies the floor transitively, and this declaration is not what enforces it. It is still worth declaring, for a different reason: scripts/deps_bundle.py installs awscrt directly rather than through botocore[crt], so the bundled submitter has no transitive guarantee at all. Stating the same constraint in both places keeps the two install paths in agreement. Corrected in all three places that made the claim: the gui extra comment, the AWSCRT_REQUIREMENT comment, and the test docstring. Signed-off-by: andychoquette <78888816+andychoquette@users.noreply.github.com>

…scrt Addresses review feedback. Installing awscrt separately was the wrong mechanism. _build_base_environment is fed project.dependencies, which deliberately no longer request the console extra, so the bundle was resolving deadline[gui] and then installing awscrt in a second, unconstrained pip invocation. That hardcoded an assumption that the console extra's closure is exactly awscrt, and it was wrong in two observable ways: - deadline declares botocore ONLY in the console extra (botocore[crt] >= 1.42.89). Resolving deadline[gui] alone left botocore to arrive via boto3, so the floor the console login provider needs was satisfied by luck rather than by constraint. - botocore's crt extra pins awscrt to an exact version per release. Resolving awscrt separately drifted from it: a built bundle shipped awscrt 0.36.2 alongside a botocore that pins 0.36.0. The base environment now requests the console extra directly, inheriting the version specifier from the declared deadline requirement, so the bundle tracks the extra rather than a guess about it. A rebuilt bundle ships awscrt 0.36.0, matching what botocore pins, with both per-interpreter artifacts intact. That also removes the duplicated floor: AWSCRT_REQUIREMENT and the direct "awscrt >= 0.28.4" in the gui extra had to agree with nothing keeping them in sync, and the direct declaration could not do what its comment claimed anyway -- a >= floor cannot raise a version against botocore's exact ==, it can only turn a too-low pin into a resolution failure. Both are gone; the floor is guaranteed transitively. Also from review: - the base-dependency guard now also rejects a bare awscrt requirement, which is the likelier mistake than re-adding the extra and has the identical effect - test/installer/test_installer.py asserts awscrt reaches the shipped bundle, alongside the existing xxhash and psutil checks -- two steps could previously drop it without failing the build - packaging is declared in requirements-testing.txt, since the dependency tests import it unconditionally and it was only present transitively Signed-off-by: andychoquette <78888816+andychoquette@users.noreply.github.com>

andychoquette added 2 commits August 13, 2026 11:51

andychoquette changed the title ~~Feat/deadline console extra~~ feat: bump deadline version to 0.60.4 and add optional console sign in deps Aug 13, 2026

Merge branch 'mainline' into feat/deadline-console-extra

9bfb1d3

github-actions Bot added the waiting-on-maintainers Waiting on the maintainers to review. label Aug 13, 2026