cvehound-spatch 1.3.2.post3

Same coccinelle 1.3.2 build as 1.3.2.post2 — no patch changes — this release adds a wheel for macOS, so pip install 'cvehound[spatch]' gets a prebuilt binary there too instead of falling back to PATH.

macOS arm64 wheels

Wheels now ship for macOS arm64 (macosx_11_0_arm64) alongside Linux x86_64/aarch64 (manylinux_2_28). There is no container to build portably against on macOS, so build.sh runs directly on the host and Homebrew-installs whatever autogen and opam need; it rejects the build on the same grounds as Linux — anything linked beyond the platform's own libc, or Python support — and on macOS it additionally rejects a binary whose LC_BUILD_VERSION disagrees with the deployment target the wheel tag promises, or whose ad-hoc signature doesn't verify. CI verifies each platform's wheel against its own runner; macOS has no Linux-style "older/newer than the build image" pair, since the wheel's floor there is a deployment target, not a userland version that could disagree.

OCaml built --without-zstd

From OCaml 5.1 the runtime links libzstd wherever configure finds it, and a wheel can't ship a Homebrew dylib alongside it — this surfaced as /opt/homebrew/opt/zstd in otool -L. The manylinux image happens to carry no zstd headers, so the Linux build was getting the same result by luck; asking for ocaml-option-no-compression explicitly makes the invariant hold on both platforms. Nothing is given up: compressed marshalling was opt-in, and this build ships none of the artifacts zstd would have shrunk.

Wheels for Linux x86_64/aarch64 (manylinux_2_28) and macOS arm64 (macosx_11_0_arm64). Needs pip 20.3 or newer to install, and diff on the system at run time.

pip install 'cvehound[spatch]'