gotcha 608, 609: cmake-from-source needs openssl-devel; Upstream-Status bracket must stay on one line

Found while triaging PR #2434 (executorch): cibuildwheel building cmake
from source (no riscv64 wheel for the pinned version) fails configure
with "Could not find OpenSSL" until openssl-devel is installed; and
check_patch.py's Upstream-Status regex has no re.DOTALL, so a bracketed
Inappropriate reason wrapped across multiple lines fails the format
check even though it reads as correctly bracketed.

Author: luhenry

skills/python-project-porting/references/gotchas-index.md

@@ -968,6 +968,11 @@ The porting gotchas (551 of them) live in [`references/gotchas/`](gotchas/), spl
   `setup.py` command can gate on the tool's mere presence in `PATH` even when it never calls
   it, so gotcha 100's `yum install -y protobuf-compiler` still has to go in
   `CIBW_BEFORE_ALL_LINUX` (the valkey-glide-sync case).
+- **608** — `cmake` built from source as a `pip`-installed build dependency (no riscv64 wheel
+  published for the pinned version) needs `openssl-devel`: its own bootstrap's
+  `Utilities/cmcurl/CMakeLists.txt` runs `find_package(OpenSSL)` and the image ships no dev
+  headers by default — `CIBW_BEFORE_ALL_LINUX: dnf -y install openssl-devel` fixes it,
+  independent of gotcha 207's unrelated CMake-policy-floor case (the executorch case).
 
 ### Native dependencies & linking — [`gotchas/native-deps-and-linking.md`](gotchas/native-deps-and-linking.md)
 
@@ -1402,6 +1407,10 @@ The porting gotchas (551 of them) live in [`references/gotchas/`](gotchas/), spl
   (`Both project.license-files and tool.scikit-build.wheel.license-files are set`) when the project
   declares PEP 639 `project.license-files`; patch that list to a glob like `License*` that the sdist
   alone still matches (the cantera case).
+- **609** — `check_patch.py`'s `Upstream-Status: Inappropriate [...]` check has no `re.DOTALL`, so
+  it only reads the tag's first physical line; a bracketed reason wrapped across multiple
+  commit-message lines fails "Incorrect format" even though it looks correctly bracketed —
+  keep the whole `[reason]` on the tag's own line (the executorch case).
 
 ### Local validation & the aarch64/QEMU rehearsal — [`gotchas/local-validation-and-rehearsal.md`](gotchas/local-validation-and-rehearsal.md)
 

skills/python-project-porting/references/gotchas/licensing-and-gpl.md

@@ -39,6 +39,9 @@ To pull up one entry: `grep -n '^N\. ' references/gotchas/licensing-and-gpl.md`.
   `bdist_wheel` time, so a `setup.py` whose cmdclass `os.chdir()`s breaks a relative entry.
 - **590** — gotcha 538's `SKBUILD_WHEEL_LICENSE_FILES` override is refused when the project
   declares PEP 639 `project.license-files`; widen that list with a patch instead.
+- **609** — `check_patch.py`'s `Upstream-Status: Inappropriate [...]` regex only reads the
+  first physical line of the tag, so a reason wrapped across multiple commit-message lines
+  fails the check even though it looks bracketed.
 
 ---
 
@@ -749,3 +752,20 @@ To pull up one entry: `grep -n '^N\. ' references/gotchas/licensing-and-gpl.md`.
     - **When `pyproject.toml` is generated** (cantera renders
       `interfaces/python_sdist/pyproject.toml.in` in `scons sdist`), patch the template in the
       upstream checkout before the sdist is built, not the extracted sdist.
+
+609. **`check_patch.py`'s `Upstream-Status: Inappropriate [...]` regex only reads the first
+    physical line of the tag, so a reason wrapped across multiple commit-message lines fails
+    the check even though it looks bracketed on inspection (the executorch case).** The
+    script matches the tag line with `re.MULTILINE` but no `re.DOTALL`, so `^Upstream-Status:
+    *(.*)$` stops at the first `\n`; a value like `Inappropriate [only relevant to a
+    distributor …` that closes its `]` two lines further down never reaches the
+    `^\[.+\]$` check against the *whole* reason — only its first line is tested, which has
+    no closing bracket at all, so it fails as "Incorrect format" even though every other
+    detail (the type name, the brackets once joined) is correct.
+    - **Keep the entire bracketed reason on the tag's own line.** Every other `Inappropriate`
+      patch in this repo (`grep -rn 'Upstream-Status: Inappropriate' patches/`) does this;
+      wrap the surrounding commit-message prose instead, and only fold the reason itself if
+      it still fits `Upstream-Status: Inappropriate [...]` as one line.
+    - **Reproduce locally before a CI cycle**: paste the patch's commit message through the
+      same two `re.search` calls `check_upstream_status()` uses — a one-line repro is faster
+      than waiting on `check_patches` to fail again.

skills/python-project-porting/references/gotchas/manylinux-image-and-toolchain.md

@@ -116,6 +116,9 @@ To pull up one entry: `grep -n '^N\. ' references/gotchas/manylinux-image-and-to
 - **599** — `PROTOC_INCLUDE` (gotcha 100) is not free: it replaces protoc's implicit `-I.`, so a
   `build.rs` that passes a bare `compile_protos("x.proto")` then fails "does not reside within any
   --proto_path"; CRB protoc finds `/usr/include` on its own, so leave it unset there.
+- **608** — `cmake` built from source as a build dependency (no riscv64 wheel yet for the
+  required version) needs `openssl-devel` installed — its own CMake bootstrap looks for
+  OpenSSL for `cmcurl` and the image ships no dev headers by default.
 ---
 
 26. **The riscv64 runners ship GCC 13; some packages need GCC 14 or later.** The compiler
@@ -1837,3 +1840,25 @@ To pull up one entry: `grep -n '^N\. ' references/gotchas/manylinux-image-and-to
      gate all the way through before assuming a host-side pre-step satisfies it: a
      presence check and an actual invocation impose different requirements on where the
      tool has to live.
+
+608. **`cmake` built from source as a `pip`-installed build dependency needs `openssl-devel`
+     installed in the container — its own bootstrap looks for OpenSSL for `Utilities/cmcurl`,
+     and the manylinux_riscv64 image ships no development headers by default (the executorch
+     case; see `build-executorch.yml`).** cibuildwheel resolves `cmake` (a declared
+     `build-system.requires`) from our registry first; when no riscv64 wheel is published for
+     the pinned version, pip falls back to building CMake's own sdist from source, and that
+     build runs CMake's bundled bootstrap CMakeLists, not the project's. That bootstrap's
+     `find_package(OpenSSL)` fails with `Could not find OpenSSL … (missing:
+     OPENSSL_CRYPTO_LIBRARY OPENSSL_INCLUDE_DIR)` at `Utilities/cmcurl/CMakeLists.txt` — the
+     image carries `openssl-libs` (the runtime `.so`) but not the `-devel` headers/archive
+     `find_package` needs, the same shape as gotcha 46/51 for other host tooling gaps.
+     - **The fix is a one-line `CIBW_BEFORE_ALL_LINUX: dnf -y install openssl-devel`**,
+       independent of anything the *project's own* `pyproject.toml` sets for its own build —
+       this OpenSSL gap belongs to `cmake`'s bootstrap, not to executorch's extensions.
+     - **This is different from gotcha 207**: 207 is a CMake new enough to enforce a policy
+       floor a vendored dependency's `cmake_minimum_required` violates; this is CMake itself
+       having no riscv64 wheel to install and needing to compile, which pulls in its own
+       unrelated native dependency (OpenSSL) that the image doesn't have by default. Check
+       which failure you have from the CMake **configure** log path before reaching for either
+       fix: `Utilities/cmcurl/CMakeLists.txt` (this gotcha) vs a vendored third-party
+       `CMakeLists.txt` three levels down (207).