az extension add -n containerapp fails on 32-bit Windows az since google-auth 2.54.0 (2026-06-12): cryptography sdist build required

### Describe the bug

Since 2026-06-12 ~18:02 UTC, az extension add -n containerapp fails with An error occurred. Pip failed with status code 1. on any az whose bundled Python is 32-bit Windows due to an upstream dependancy change

~~containerapp → kubernetes==24.2.0 → google-auth (unpinned)
google-auth 2.54.0 (released 2026-06-12 18:02 UTC) promoted cryptography>=38.0.3 from an optional extra to a hard dependency
cryptography publishes no win32 wheels (only win_amd64), so pip on 32-bit Python falls back to the sdist
building cryptography from source requires a Rust toolchain → Preparing metadata (pyproject.toml) exited with 1 → MetadataGenerationFailed~~

**_update_**
_Been troubleshooting a workaround for our hosted agents and realised I pointed at the wrong change sorry. I believe the change is cryptography 49.0.0 (released 2026-06-12 20:01 UTC), which drops its win32 .whl (cryptography-48.0.0-cp39-abi3-win32.whl / cp311-abi3-win32.whl). This results in pip selecting the 49.0.0 sdist on 32-bit CLI installs and attempting a source build, which fails in the maturin backend looking for a Rust toolchain
constraining google-auth<2.54.0 still fails identically (pip still resolves cryptography 49.0.0 → sdist → Rust)
constraining cryptography<49 succeeds: pip resolves cryptography-48.0.1-cp311-abi3-win32.whl and the extension installs cleanly_

--debug excerpt:
Removed cryptography>=38.0.3 from .../cryptography-49.0.0.tar.gz
(from google-auth>=1.0.1->kubernetes==24.2.0->containerapp==1.2.0b4) from build tracker
pip._internal.exceptions.MetadataGenerationFailed: metadata generation failed

### Related command

On 32-bit az (e.g. 2.64.0, Python 3.11.8 ... 32 bit (Intel)), with the extension not yet installed:

az extension add -n containerapp --debug

### Errors

installing containerapp extension
ERROR: An error occurred. Pip failed with status code 1. Use --debug for more information.
##[error]containerapp extension install failed
##[error]Script failed with exit code: 1

### Issue script & Debug output

> Preparing metadata (pyproject.toml): finished with status 'error'
> error: metadata-generation-failed
System.Management.Automation.RemoteException
> Encountered error while generating package metadata.
System.Management.Automation.RemoteException
See above for output.
System.Management.Automation.RemoteException
> note: This is an issue with the package mentioned above, not pip.
hint: See above for details.
Exception information:
Traceback (most recent call last):
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\operations\build\metadata.py", line 35, in generate_metadata
distinfo_dir = backend.prepare_metadata_for_build_wheel(metadata_dir)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\utils\misc.py", line 727,
in prepare_metadata_for_build_wheel
return super().prepare_metadata_for_build_wheel(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_vendor\pyproject_hooks\_impl.py",
line 186, in prepare_metadata_for_build_wheel
return self._call_hook('prepare_metadata_for_build_wheel', {
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_vendor\pyproject_hooks\_impl.py",
line 311, in _call_hook
self._subprocess_runner(
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\utils\subprocess.py", line
237, in runner
call_subprocess(
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\utils\subprocess.py", line
209, in call_subprocess
> raise error
> pip._internal.exceptions.InstallationSubprocessError: Preparing metadata (pyproject.toml) exited with 1
System.Management.Automation.RemoteException
The above exception was the direct cause of the following exception:
System.Management.Automation.RemoteException
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\cli\base_command.py", line
105, in _run_wrapper
status = _inner_run()
^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\cli\base_command.py", line
96, in _inner_run
return self.run(options, args)
^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\cli\req_command.py", line
67, in wrapper
return func(self, options, args)
^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\commands\install.py", line
379, in run
requirement_set = resolver.resolve(
^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\resolver.py", line 95, in resolve
result = self._result = resolver.resolve(
^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_vendor\resolvelib\resolvers.py",
line 546, in resolve
state = resolution.resolve(requirements, max_rounds=max_rounds)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_vendor\resolvelib\resolvers.py",
line 427, in resolve
failure_causes = self._attempt_to_pin_criterion(name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_vendor\resolvelib\resolvers.py",
line 239, in _attempt_to_pin_criterion
criteria = self._get_updated_criteria(candidate)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_vendor\resolvelib\resolvers.py",
line 230, in _get_updated_criteria
self._add_to_criteria(criteria, requirement, parent=candidate)
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_vendor\resolvelib\resolvers.py",
line 173, in _add_to_criteria
if not criterion.candidates:
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_vendor\resolvelib\structs.py", line
156, in __bool__
return bool(self._sequence)
^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\found_candidates.py", line 174, in __bool__
return any(self)
^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\found_candidates.py", line 162, in
return (c for c in iterator if id(c) not in self._incompatible_ids)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\found_candidates.py", line 53, in _iter_built
candidate = func()
^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\factory.py", line 186, in
_make_candidate_from_link
base: Optional[BaseCandidate] = self._make_base_candidate_from_link(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\factory.py", line 232, in
_make_base_candidate_from_link
self._link_candidate_cache[link] = LinkCandidate(
^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\candidates.py", line 303, in __init__
super().__init__(
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\candidates.py", line 158, in __init__
self.dist = self._prepare()
^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\candidates.py", line 235, in _prepare
dist = self._prepare_distribution()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\resolution\resolvelib\candidates.py", line 314, in
_prepare_distribution
return preparer.prepare_linked_requirement(self._ireq, parallel_builds=True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\operations\prepare.py",
line 527, in prepare_linked_requirement
return self._prepare_linked_requirement(req, parallel_builds)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\operations\prepare.py",
line 642, in _prepare_linked_requirement
dist = _get_prepared_distribution(
^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\operations\prepare.py",
line 72, in _get_prepared_distribution
abstract_dist.prepare_distribution_metadata(
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\distributions\sdist.py",
line 69, in prepare_distribution_metadata
self.req.prepare_metadata()
> File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\req\req_install.py", line
575, in prepare_metadata
self.metadata_directory = generate_metadata(
^^^^^^^^^^^^^^^^^^
> File "C:\Program Files (x86)\Microsoft
SDKs\Azure\CLI2\Lib\site-packages\pip\_internal\operations\build\metadata.py", line 37, in generate_metadata
> raise MetadataGenerationFailed(package_details=details) from error
> pip._internal.exceptions.MetadataGenerationFailed: metadata generation failed
> Removed cryptography>=38.0.3 from https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5ae
c3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz (from
google-auth>=1.0.1->kubernetes==24.2.0->containerapp==1.2.0b4) from build tracker
'C:\\Users\\nicholas.macdonald\\AppData\\Local\\Temp\\9\\pip-build-tracker-ysikuwvm'
> Removed build tracker: 'C:\\Users\\nicholas.macdonald\\AppData\\Local\\Temp\\9\\pip-build-tracker-ysikuwvm'
System.Management.Automation.RemoteException
> DEBUG: cli.azure.cli.core.extension.operations: Command '['C:\\Program Files (x86)\\Microsoft
SDKs\\Azure\\CLI2\\python.exe', '-m', 'pip', 'install', '--target', 'C:\\temp\\azrepro\\cliextensions\\containerapp',
'C:\\Users\\NICHOL~1.MAC\\AppData\\Local\\Temp\\9\\tmpu50l2ch6\\containerapp-1.2.0b4-py2.py3-none-any.whl', '-vv',
'--disable-pip-version-check', '--no-cache-dir']' returned non-zero exit status 1.
> DEBUG: cli.azure.cli.core.extension.operations: Pip failed so deleting anything we might have installed at
C:\temp\azrepro\cliextensions\containerapp
> DEBUG: cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py",
line 666, in execute
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py",
line 733, in _run_jobs_serially
> File
"D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/extension/operations.py", line
172, in _add_whl_ext
> knack.util.CLIError: An error occurred. Pip failed with status code 1. Use --debug for more information.
System.Management.Automation.RemoteException
> ERROR: cli.azure.cli.core.azclierror: An error occurred. Pip failed with status code 1. Use --debug for more
information.
> ERROR: az_command_data_logger: An error occurred. Pip failed with status code 1. Use --debug for more information.
DEBUG: cli.knack.cli: Event: Cli.PostExecute []
INFO: az_command_data_logger: exit code: 1
INFO: cli.__main__: Command ran in 165.251 seconds (init: 0.286, invoke: 164.965)

### Expected behavior

Extension installs without system changes required

### Environment Summary

azure-cli 2.64.0 *

core 2.64.0 *
telemetry 1.1.0

Dependencies:
msal 1.30.0
azure-mgmt-resource 23.1.1

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\nicholas.macdonald\.azure\cliextensions'

Python (Windows) 3.11.8 (tags/v3.11.8:db85d51, Feb 6 2024, 21:52:07) [MSC v.1937 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal

### Additional context

_No response_