Problem

Native RHEL 10 s390x archive_dist_test can build cryptography from source even though a compatible hosted wheel is pinned in the root lock. The v9.0 rules_poetry importer skips URL-source variants and reads marker instead of Poetry 2.1's markers, so pip does not receive the hosted s390x artifact.

The resulting PEP 517 build resolves build-backend dependencies outside the application lock and can invoke maturin/puccinialin. Recent platformdirs rejects relative HOME=. and redirects cache writes to the account home, causing the reported sandbox permission failure during the 9.0.6 release build.

Fix

• v9.0: retain each package's URL variants, platform/group markers, and per-artifact hashes from poetry.lock. Require prebuilt cryptography wheels and reject direct source URLs for cryptography.
• Master: require cryptography's existing upstream/hosted wheels from uv.lock; fail source fallback during Bazel analysis.
• Resolve HOME, CARGO_HOME, platform cache paths, and Python temporary directories to absolute paths at action runtime, inside the disposable Bazel build directory. Preserve cleanup on success/failure and keep interrupted-build state inside Bazel's cleanup boundary.
• Reuse the root locks. Other packages retain their existing source-build behavior.

Validation

• Native RHEL 10 s390x Bazel wheel check passed on rhel10-zseries-large with cross compilation disabled.
• Bazel selected cryptography-44.0.2-cp37-abi3-manylinux_2_28_s390x.whl. SHA256 e033ed86e96fa4225a515497112bb951acceabf72fee66b19cee971bd11f196e exactly matches poetry.lock.
• Native wheel invocation
• Native v9.0-staging archive patch: the full archive-dist-test-stripped build passed, producing both distribution archives. Build invocation.
• The task subsequently failed in support-file archiving with UnboundLocalError for ZstdFile. Correct Poetry 2.1 marker handling excludes pyzstd on s390x, exposing an existing archiver fallback bug. Commit 5d4bc18d623 in the v9.0 draft checks the imported implementation before selecting zstd and preserves gzip fallback.
• Seven Bazel regression tests pass, including a test that fails before the archiver fix and passes afterward with missing or empty pyzstd modules. The required formatter passes.
• Replacement native v9.0-staging patch: started; full task revalidation pending.
• Six v9.0 regression tests and the master source-fallback/environment tests pass. Representative wheel installation and avro-python3 source builds pass.
• Master nightly archive patch: passed before the final cross-execution patch-context correction. The correction applies without fuzz to fresh verified upstream source, and both master regression tests pass.

Pull requests and backport

• Master draft PR
• v9.0 draft PR
• Request a v9.0 backport. The native s390x validation exercises the wheel path required by the hotfix release; no hotfix release build has been submitted.

Related investigation

• Previous sandbox fix: SERVER-129394
• platformdirs relative HOME issue

v9.0.7 hotfix

Hotfix draft PR targets v9.0.7-hotfix at base b85eeb43737fbf82af9d3278003d1463b2433cd6, preserving its four additional release fixes. All ten changed files exactly match the current v9.0-staging PR. All seven Bazel regression targets and the required formatter pass on the actual hotfix base. Test invocation.