Free threaded support

.github/workflows/ci.yml

@@ -56,6 +56,7 @@ jobs:
           - {VERSION: "3.13", NOXSESSION: "rust,tests", RUST: "beta"}
           - {VERSION: "3.13", NOXSESSION: "rust,tests", RUST: "nightly"}
           - {VERSION: "3.13", NOXSESSION: "tests-rust-debug"}
+          - {VERSION: "3.13t", NOXSESSION: "rust,tests"}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -137,6 +138,10 @@ jobs:
           NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
           # Needed until https://github.com/PyO3/pyo3/issues/5093
           PYO3_USE_ABI3_FORWARD_COMPATIBILITY: 1
+      - name: override cffi version in free-threaded environment
+        if: matrix.PYTHON.VERSION == '3.13t'
+        run: |
+          echo "PYTHON_GIL=0" >> $GITHUB_ENV
       - name: Tests
         run: |
             nox --no-install --  --color=yes --wycheproof-root=wycheproof --x509-limbo-root=x509-limbo ${{ matrix.PYTHON.NOXARGS }}

pyproject.toml

@@ -5,7 +5,7 @@ requires = [
     "maturin>=1.8.6,<2",
 
     # Must be kept in sync with `project.dependencies`
-    "cffi>=1.14; platform_python_implementation != 'PyPy'",
+    "cffi @ git+https://github.com/ngoldbaum/cffi-ft@upstream-pr",
     # Used by cffi (which import distutils, and in Python 3.12, distutils has
     # been removed from the stdlib, but installing setuptools puts it back) as
     # well as our build.rs for the rust/cffi bridge.
@@ -48,7 +48,7 @@ classifiers = [
 requires-python = ">=3.8,!=3.9.0,!=3.9.1"
 dependencies = [
     # Must be kept in sync with `build-system.requires`
-    "cffi>=1.14; platform_python_implementation != 'PyPy'",
+    "cffi @ git+https://github.com/ngoldbaum/cffi-ft@upstream-pr",
 ]
 
 [project.urls]

src/rust/cryptography-cffi/build.rs

@@ -78,8 +78,15 @@ fn main() {
         build.include(python_include);
     }
 
-    // Enable abi3 mode if we're not using PyPy.
-    if python_impl != "PyPy" {
+    let is_free_threaded = run_python_script(
+        &python,
+        "import sysconfig; print(bool(sysconfig.get_config_var('Py_GIL_DISABLED')), end='')",
+    )
+    .unwrap()
+        == "True";
+
+    // Enable abi3 mode if we're not using PyPy or the free-threaded build
+    if !(python_impl == "PyPy" || is_free_threaded) {
         // cp38 (Python 3.8 to help our grep when we some day drop 3.8 support)
         build.define("Py_LIMITED_API", "0x030800f0");
     }