FIX: PR #744 review — reconcile consolidate count (25->28 win-arm64), idempotent conda_builder, neutral TLS wording + }} brace escaping

Author: jahnvi480

OneBranchPipelines/jobs/consolidate-conda-artifacts-job.yml

@@ -13,16 +13,19 @@
 # package (which vendors the ODBC payload) is emitted per-Python by each build leg;
 # there is NO separate companion package:
 #   win-64        : 5 py x mssql-python                                       = 5
+#   win-arm64     : 3 py x mssql-python  (py3.12-3.14, cross-built on x64)    = 3
 #   osx-64        : 5 py x mssql-python  (Intel Mac, cross-built via Rosetta) = 5
 #   osx-arm64     : 5 py x mssql-python  (Apple Silicon, native)              = 5
 #   linux-64      : 5 py x mssql-python  (glibc x86_64 host, native)          = 5
 #   linux-aarch64 : 5 py x mssql-python  (x86_64 host + QEMU, best-effort)    = 5
 #   ------------------------------------------------------------------------------
-#   TOTAL (PyPI parity minus win-arm64 + musllinux)                          = 25
-# win-arm64 (no import-validation host on x64) and musllinux (no conda musl subdir)
-# are intentionally NOT conda-built. This job is BEST-EFFORT and never hard-fails on
-# a short set; the release pipeline's conda-release-step enforces the hard gate
-# (required subdirs present + complete Python matrix) before anything is published.
+#   TOTAL (PyPI parity minus musllinux)                                      = 28
+# win-arm64 is cross-built for py3.12-3.14 only (py3.10/3.11 have no win-arm64 deps
+# on Anaconda defaults); its runtime import is skipped on the x64 host, so its arch
+# is enforced by the PE-machine assert (assert_pe_machine.py). musllinux (no conda
+# musl subdir) is intentionally NOT conda-built. This job is BEST-EFFORT and never
+# hard-fails on a short set; the release pipeline's conda-release-step enforces the
+# hard gate (required subdirs present + complete Python matrix) before publish.
 parameters:
   - name: oneBranchType
     type: string

OneBranchPipelines/scripts/build-conda-packages.sh

@@ -139,6 +139,10 @@ echo "Using conda: $conda"
 # rides along so the RUNPATH audit reads .conda metadata from this same env.
 condaBuildEnv="conda_builder"
 echo "=== creating dedicated conda-build env ($condaBuildEnv: conda-build<26) ==="
+# Idempotent: a reused agent/workdir may already have this env, and a pre-existing
+# env makes `conda create` fail under `set -e`. Remove it first (best-effort, like
+# the verify envs below) so a rerun recreates cleanly.
+"$conda" env remove -y -n "$condaBuildEnv" 2>/dev/null || true
 "$conda" create -y -n "$condaBuildEnv" -c conda-forge --override-channels "conda-build<26" zstandard
 
 # ---------------------------------------------------------------------------

conda/tls_connect_probe.py

@@ -105,7 +105,7 @@ def describe(exc):
     low = msg.lower()
     for marker in _OPENSSL_UNREACHABLE_MARKERS:
         if marker in low:
-            return "OpenSSL backend unreachable -> " + msg[:300]
+            return "TLS handshake did not complete -> " + msg[:300]
     return msg[:300]
 
 
@@ -114,23 +114,32 @@ def _split_top_level(conn):
 
     An ODBC value wrapped in ``{...}`` may itself contain ``;`` (MS-ODBCSTR), so a
     naive ``split(';')`` would shred braced values. Track brace depth and break only
-    at depth 0.
+    at depth 0. Inside a braced value ``}}`` is an escaped literal ``}`` (MS-ODBCSTR),
+    NOT a close -- consume both and keep the depth so the value is not split early.
     """
     segments = []
     buf = ""
     depth = 0
-    for ch in conn.strip():
+    s = conn.strip()
+    i = 0
+    while i < len(s):
+        ch = s[i]
         if ch == "{":
             depth += 1
             buf += ch
         elif ch == "}":
+            if depth > 0 and i + 1 < len(s) and s[i + 1] == "}":
+                buf += "}}"  # escaped literal '}' inside a braced value; not a close
+                i += 2
+                continue
             depth = max(0, depth - 1)
             buf += ch
         elif ch == ";" and depth == 0:
             segments.append(buf)
             buf = ""
         else:
             buf += ch
+        i += 1
     segments.append(buf)
     return segments
 
@@ -279,7 +288,7 @@ def main():
     if tls_completed(outcome):
         print("TLS_OK (OpenSSL backend reachable; " + describe(outcome) + ")")
         return
-    sys.exit("TLS/OPENSSL BACKEND UNREACHABLE: " + describe(outcome))
+    sys.exit("TLS HANDSHAKE DID NOT COMPLETE: " + describe(outcome))
 
 
 if __name__ == "__main__":