`Python-bundle-PyPI` provides `cffi` but its dependency chain requires `cffi`

[xdelaruelle]

Python-bundle-PyPI EB file is providing the cffi software but it requires cryptography which in turns requires cffi.

Even if things are working, it creates a non-optimal dependency DAG, that could lead to potential issue if the cffi loaded by cryptography is not the same version as the one provided by Python-bundle-PyPI.

Looking at the recent toolchains:

• Python-bundle-PyPI-2023.06-GCCcore-12.3.0.eb: Python-bundle-PyPI/2023.06 provides cffi/1.15.1 and loads cryptography/41.0.1 which loads cffi/1.15.1
• Python-bundle-PyPI-2023.10-GCCcore-13.2.0.eb: Python-bundle-PyPI/2023.10 provides cffi/1.16.0 and loads cryptography/41.0.5 which loads cffi/1.15.1
• Python-bundle-PyPI-2024.06-GCCcore-13.3.0.eb: Python-bundle-PyPI/2024.06 provides cffi/1.16.0 and loads cryptography/42.0.8 which loads cffi/1.16.0
• Python-bundle-PyPI-2025.04-GCCcore-14.2.0.eb: Python-bundle-PyPI/2025.04 provides cffi/1.17.1 and loads cryptography/44.0.2 which loads cffi/1.17.1
• Python-bundle-PyPI-2025.07-GCCcore-14.3.0.eb: Python-bundle-PyPI/2025.07 provides cffi/1.17.1 and loads cryptography/45.0.5 which loads cffi/1.17.1

So with Python-bundle-PyPI-2023.10-GCCcore-13.2.0.eb we are in a situation where the cffi loaded by cryptography is different than the one provided.

As cffi needs to be a standalone installation, to fullfil needs of standalone software like cryptography, it may be simpler for Python-bundle-PyPI not to provide cffi but requires it. With this strategy, users will get their cffi loaded when loading Python-bundle-PyPI and one installation will be saved: no need to build cffi within Python-bundle-PyPI anymore.

[boegel]

@xdelaruelle Thanks for the report.

As discussed in Slack, there likely are additional cases in which we "shadow" extension version through either exts_list or (build)dependencies.
In some cases, that'll be deliberate, especially when it happens via builddependencies (like loading a newer setuptools when installing xarray, see #23320).

For cffi, it seems like we can relatively easily avoid juggling two versions, so we should indeed change this.