AppInspect fail to validate an add-on new version .. ERROR: Found AArch64-incompatible binary file

[sbel]

The latest appinspect tool (splunk-appinspect inspect ....) returns a failure on our Add-on ..which is using cffi backend cpython.  below is the text form of error message .. included a screenshot of the failure. 

Our App/Add-on is using this module for a long time .. multiple old versions  have it.. and we never seen this failure before. 

We have got this package from the wheelodex (URL included below) to enable the support for

python3-cffi

URL : https://www.wheelodex.org/projects/cffi/wheels/cffi-1.17.1-cp39-cp39-manylinux_2_17_aarch64.manylinu...

A default value of 25 for max-messages will be used.
Binary file standards 
    Check that every binary file is compatible with AArch64. 
        FAILURE: Found AArch64-incompatible binary file. Remove or 
            rebuild the file to be AArch64-compatible. File: 
            linux_x86_64/bin/lib/_cffi_backend.cpython-39-x86_64-linux-gnu.so 
            File: 
            linux_x86_64/bin/lib/_cffi_backend.cpython-39-x86_64-linux-gnu.so 

 Even the old version of apps that are published and available on splunk appstore are running into this failure.   Any insights on how to get this addressed ??

[id]

Appreciate your reply @marnall. After updating the package to use the one built for AArch64, "_cffi_backend.cpython-39-aarch64-linux-gnu.so", the same error still appears.  

One interesting observation here, older versions of the package that we previously used appear in the error logs after running "splunk-appinspect inspect". These older versions were deleted and replaced with "_cffi_backend.cpython-39-aarch64-linux-gnu.so", and yet after rebuilding and running "inspect", they still appear in the error logs. 

        FAILURE: Found AArch64-incompatible binary file. Remove or 
            rebuild the file to be AArch64-compatible. File: 
            linux_x86_64/bin/lib/_cffi_backend.cpython-38-x86_64-linux-gnu.so 
            File: 
            linux_x86_64/bin/lib/_cffi_backend.cpython-38-x86_64-linux-gnu.so 
        FAILURE: Found AArch64-incompatible binary file. Remove or 
            rebuild the file to be AArch64-compatible. File: 
            linux_x86_64/bin/lib/_cffi_backend.cpython-39-x86_64-linux-gnu.so 
            File: 
            linux_x86_64/bin/lib/_cffi_backend.cpython-39-x86_64-linux-gnu.so 

Could this be an issue with Splunk Appinspect? What would be some possible explanations for why this is happening? 

[marnall]

That is odd. I don't know how AppInspect works internally so I could not say for sure it is an issue with AppInspect. Are you able to find any mention of these files with text searches? It is indeed very strange that it would complain about these files after they are deleted and replaced.

[id]

@marnall After replacing the package, the files mentioned in the error message are deleted. So as expected, no mentions of the older package version appear in our code after the older version is deleted & replaced.

We're not sure why we're still facing this issue, and I'm wondering if this issue can be attributed to AppInspect in some way?

[marnall]

It seems to be unhappy that the file "linux_x86_64/bin/lib/_cffi_backend.cpython-39-x86_64-linux-gnu.so" is built for AMD64, not AArch64. Are you able to install and use "_cffi_backend.cpython-39-aarch64-linux-gnu.so" instead?