build: Add a python script to test imports during the build (AcademySoftwareFoundation#1057)

### Add a python script to test imports during the build

### Linked issues
n/a

### Summarize your change.
Add build-time validation of Python package imports and clarify Python
test purposes.

### Describe the reason for the change.

When there are issues with package imports (ABI incompatibilities,
missing dependencies, etc.), we often find them out at runtime. This
change adds `test_python_imports.py `to detect import failures during
the build.

Additionally, renamed `test_python.py` to `test_python_distribution.py`
to better distinguish between:
- Import testing (validates pip-installed packages) 
- Distribution testing (validates relocatability and environment setup)

### Describe what you have tested and on which operating system.
MacOS

### Add a list of changes, and note any that might need special
attention during the review.

### If possible, provide screenshots.

---------

Signed-off-by: Cédrik Fuoco <cedrik.fuoco@autodesk.com>

Author: cedrik-fuoco-adsk

cmake/dependencies/python3.cmake

@@ -50,14 +50,6 @@ SET(_python3_download_hash
     "${RV_DEPS_PYTHON_DOWNLOAD_HASH}"
 )
 
-SET(_opentimelineio_download_url
-    "https://github.com/AcademySoftwareFoundation/OpenTimelineIO"
-)
-
-SET(_opentimelineio_git_tag
-    "v${_opentimelineio_version}"
-)
-
 SET(_pyside_archive_url
     "${RV_DEPS_PYSIDE_ARCHIVE_URL}"
 )
@@ -504,21 +496,40 @@ ADD_CUSTOM_COMMAND(
   DEPENDS ${_python3_target} ${${_python3_target}-build-deps-flag} ${_requirements_output_file} ${_requirements_input_file}
 )
 
-# Test the Python distribution after requirements are installed
+# Test Python package imports after requirements are installed. This validates that all pip-installed packages (numpy, opentimelineio, OpenGL, cryptography,
+# etc.) can be imported successfully and tests for ABI compatibility issues. Runs in-place using the built Python executable.
+SET(${_python3_target}-imports-test-flag
+    ${_install_dir}/${_python3_target}-imports-test-flag
+)
+
+SET(_test_python_imports_script
+    "${PROJECT_SOURCE_DIR}/src/build/test_python_imports.py"
+)
+
+ADD_CUSTOM_COMMAND(
+  COMMENT "Testing Python package imports (build-time validation)"
+  OUTPUT ${${_python3_target}-imports-test-flag}
+  COMMAND "${_python3_executable}" "${_test_python_imports_script}"
+  COMMAND cmake -E touch ${${_python3_target}-imports-test-flag}
+  DEPENDS ${${_python3_target}-requirements-flag} ${_test_python_imports_script}
+)
+
+# Test the Python distribution's relocatability and environment setup. This moves Python to a temporary location to ensure it works when relocated and validates
+# SSL_CERT_FILE setup via sitecustomize.py. Uses system Python to orchestrate the test (since the built Python gets moved during testing).
 SET(${_python3_target}-test-flag
     ${_install_dir}/${_python3_target}-test-flag
 )
 
 SET(_test_python_script
-    "${PROJECT_SOURCE_DIR}/src/build/test_python.py"
+    "${PROJECT_SOURCE_DIR}/src/build/test_python_distribution.py"
 )
 
 ADD_CUSTOM_COMMAND(
-  COMMENT "Testing Python distribution"
+  COMMENT "Testing Python distribution relocatability and environment"
   OUTPUT ${${_python3_target}-test-flag}
   COMMAND python3 "${_test_python_script}" --python-home "${_install_dir}" --variant "${CMAKE_BUILD_TYPE}"
   COMMAND cmake -E touch ${${_python3_target}-test-flag}
-  DEPENDS ${${_python3_target}-requirements-flag} ${_test_python_script}
+  DEPENDS ${${_python3_target}-imports-test-flag} ${_test_python_script}
 )
 
 IF(RV_TARGET_WINDOWS

cmake/scripts/strip_provenance_and_link.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+#
+# Copyright (C) 2026  Autodesk, Inc. All Rights Reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# strip_provenance_and_link.sh — macOS 26+ provenance-safe linker wrapper
+#
+# On macOS 26+, com.apple.provenance is kernel-enforced and irremovable. When multiple
+# processes write signed Mach-O files to the same directory concurrently (parallel linker
+# invocations, linker + file-copy custom commands, etc.), the kernel blocks the open()
+# with EPERM, causing "ld: open() failed, errno=1".
+#
+# Fix: link to a private temporary directory (no contention), then atomically move the
+# output to the real destination. Each link step gets its own temp dir, so there is zero
+# concurrent write contention regardless of Ninja parallelism.
+#
+# The -install_name / @rpath embedded in the binary comes from the -install_name flag,
+# not from the -o path, so moving the file afterward is safe.
+#
+# Usage: strip_provenance_and_link.sh <linker> [args...] -o <output> [more args...]
+
+# Find the -o argument and rewrite it to a temp directory.
+args=("$@")
+real_output=""
+
+for ((i=0; i<${#args[@]}; i++)); do
+  if [[ "${args[$i]}" == "-o" ]]; then
+    j=$((i+1))
+    real_output="${args[$j]}"
+    fname=$(basename "$real_output")
+
+    # Create a private temp dir for this link step.
+    tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/rv_link.XXXXXX")
+    trap "rm -rf '$tmpdir'" EXIT
+
+    # Rewrite -o to point to the temp dir.
+    args[$j]="${tmpdir}/${fname}"
+    break
+  fi
+done
+
+# Debug: verify this script version is actually running.
+echo "PROVENANCE_WRAPPER_V3: real_output=${real_output} tmpdir=${tmpdir} fname=${fname}" >&2
+
+# Run the linker, outputting to the private temp dir.
+"${args[@]}"
+status=$?
+
+if [[ $status -eq 0 && -n "$real_output" ]]; then
+  # Atomically move the output to the real destination.
+  # mv within the same filesystem is atomic; across filesystems it copies+deletes.
+  mv -f "${tmpdir}/${fname}" "${real_output}"
+  mv_status=$?
+  if [[ $mv_status -ne 0 ]]; then
+    echo "PROVENANCE_WRAPPER_V3: mv failed (status=$mv_status) from ${tmpdir}/${fname} to ${real_output}" >&2
+    status=$mv_status
+  fi
+fi
+
+exit $status

src/build/test_python.py src/build/test_python_distribution.pysrc/build/test_python.py renamed to src/build/test_python_distribution.py

@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+# *****************************************************************************
+# Copyright 2025 Autodesk, Inc. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# *****************************************************************************
+
+"""
+Test script to validate all Python package imports at build time.
+This catches issues like missing dependencies, ABI incompatibilities, and
+configuration problems (like OpenSSL legacy provider) before running the build.
+
+Package list is automatically generated from requirements.txt.in to prevent
+manual synchronization errors.
+"""
+
+import os
+import re
+import sys
+
+# Packages to skip from requirements.txt.in (e.g., build dependencies that don't need import testing).
+SKIP_IMPORTS = [
+    "pip",
+    "setuptools",
+    "wheel",
+]
+
+# Additional imports to test beyond what's in requirements.txt.in.
+# These test deeper functionality (e.g., sub-modules that verify OpenSSL legacy provider support).
+ADDITIONAL_IMPORTS = [
+    "cryptography.fernet",
+    "cryptography.hazmat.bindings._rust",
+]
+
+
+def parse_requirements(file_path):
+    """Parse requirements.txt.in and return list of package names.
+
+    Extracts package names from lines like:
+    - numpy==@_numpy_version@
+    - pip==24.0
+
+    Skips comments and empty lines.
+    """
+    packages = []
+    with open(file_path, encoding="utf-8") as f:
+        for line in f:
+            # Remove inline comments and whitespace
+            line = line.split("#", 1)[0].strip()
+            # Skip comments and empty lines
+            if not line or line.startswith("#"):
+                continue
+            # Handle VCS/URL form: name @ git+...
+            if " @ " in line:
+                packages.append(line.split(" @ ", 1)[0].strip())
+                continue
+            # Extract package name (before ==, <, >, etc.)
+            match = re.match(r"^([A-Za-z0-9_-]+)", line)
+            if match:
+                packages.append(match.group(1))
+    return packages
+
+
+def try_import(package_name):
+    """Try importing package, with fallback to stripped 'Py' prefix.
+
+    Handles cases where pip package name differs from import name:
+    - PyOpenGL -> OpenGL
+    - PyOpenGL_accelerate -> OpenGL_accelerate
+
+    Raises ImportError if both attempts fail.
+    """
+    try:
+        return __import__(package_name)
+    except ImportError:
+        if package_name.startswith("Py"):
+            # Try without "Py" prefix
+            return __import__(package_name[2:])
+        raise
+
+
+def test_imports():
+    """Test that all required packages can be imported."""
+    # No PATH manipulation needed.
+
+    # Get requirements.txt.in from same directory as this script
+    script_dir = os.path.dirname(os.path.abspath(__file__))
+    requirements_file = os.path.join(script_dir, "requirements.txt.in")
+
+    if not os.path.exists(requirements_file):
+        print(f"ERROR: Could not find {requirements_file}")
+        return 1
+
+    # Parse package list from requirements.txt.in
+    packages = parse_requirements(requirements_file)
+
+    # Build list of imports to test (packages from requirements.txt + additional imports)
+    imports_to_test = []
+    skipped_packages = []
+    for package in packages:
+        # Skip build dependencies and other packages that don't need import testing
+        if package not in SKIP_IMPORTS:
+            imports_to_test.append((package, "from requirements.txt"))
+        else:
+            skipped_packages.append(package)
+
+    # Add any additional imports (e.g., sub-modules for deeper testing)
+    for additional_import in ADDITIONAL_IMPORTS:
+        imports_to_test.append((additional_import, "additional import"))
+
+    failed_imports = []
+    successful_imports = []
+
+    print("=" * 80)
+    print("Testing Python package imports at build time")
+    print(f"Python: {sys.version}")
+    print(f"Platform: {sys.platform}")
+    print(f"Executable: {sys.executable}")
+    print(f"Source: {requirements_file}")
+    if skipped_packages:
+        print(f"Skipping: {', '.join(skipped_packages)}")
+
+    print("=" * 80)
+    print()
+
+    for module_name, description in imports_to_test:
+        try:
+            print(f"Testing {module_name:45} ({description})...", end=" ")
+            try_import(module_name)
+            print("OK")
+            successful_imports.append(module_name)
+        except Exception as e:
+            print("FAILED")
+            print(f"  Error: {type(e).__name__}: {e}")
+            failed_imports.append((module_name, e))
+
+            # Keep failure output minimal; detailed diagnostics removed.
+
+    print()
+    print("=" * 80)
+    print(f"Results: {len(successful_imports)} passed, {len(failed_imports)} failed")
+    print("=" * 80)
+
+    if failed_imports:
+        print()
+        print("FAILED IMPORTS:")
+        for module_name, error in failed_imports:
+            print(f"  - {module_name}: {type(error).__name__}: {error}")
+        print()
+        print("Build-time import test FAILED!")
+        print("One or more required Python packages could not be imported.")
+        print()
+        return 1
+    else:
+        print()
+        print("All Python package imports successful!")
+        return 0
+
+
+if __name__ == "__main__":
+    sys.exit(test_imports())