Repository: beeware/briefcase

Issue:
Cannot package `setuptools>=73.0.0` for universal builds for macOS
### Describe the bug

The Aug 19 release of `setuptools==73.0.0` started including `dist-info` directories for the vendored packages. One of the vendored copies of `packaging` (since there's more than one...) does not contain a `WHEEL` file.

### Steps to reproduce

Add `setuptools==73.0.1` to `requires` and run `briefcase build` on macOS.

### Expected behavior

Seemingly malformed `dist-info` directories are ignored....or at least don't crash the build.

### Screenshots

_No response_

### Environment

- Operating System: Sonoma
- Python version: any
- Software versions:
  - Briefcase: `0.3.20.dev166+ge29943e7`

### Logs

https://gist.github.com/mribbons/1155fe873e6d7e5c46628767009b4ad4

### Additional context

_No response_

Discussion:

Patch:
diff --git a/automation/pyproject.toml b/automation/pyproject.toml
index 272a64a0..822bbb3f 100644
--- a/automation/pyproject.toml
+++ b/automation/pyproject.toml
@@ -1,7 +1,7 @@
 [build-system]
 requires = [
     # keep versions in sync with ../pyproject.toml
-    "setuptools==73.0.1",
+    "setuptools==71.1.0",
     "setuptools_scm==8.1.0",
     "setuptools_dynamic_dependencies @ git+https://github.com/beeware/setuptools_dynamic_dependencies",
 ]
diff --git a/changes/1970.bugfix.rst b/changes/1970.bugfix.rst
new file mode 100644
index 00000000..6010aab5
--- /dev/null
+++ b/changes/1970.bugfix.rst
@@ -0,0 +1,1 @@
+Packages that include ``.dist-info`` content in vendored dependencies are now ignored as part of the binary widening process on macOS. If a binary package has vendored subpackages, it is assumed that the top-level package includes the vendored packages' files in its wheel manifest.
diff --git a/changes/1971.misc.rst b/changes/1971.misc.rst
deleted file mode 100644
index 08cd276c..00000000
--- a/changes/1971.misc.rst
+++ /dev/null
@@ -1,1 +0,0 @@
-The pinned dependencies in pyproject.toml and tox.ini were updated to their latest versions.
diff --git a/pyproject.toml b/pyproject.toml
index e3a766d1..2ddcbb41 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,7 +1,7 @@
 [build-system]
 requires = [
     # keep versions in sync with automation/pyproject.toml
-    "setuptools==73.0.1",
+    "setuptools==71.1.0",
     "setuptools_scm==8.1.0",
 ]
 build-backend = "setuptools.build_meta"
diff --git a/src/briefcase/platforms/macOS/utils.py b/src/briefcase/platforms/macOS/utils.py
index 16c90b1c..d0862461 100644
--- a/src/briefcase/platforms/macOS/utils.py
+++ b/src/briefcase/platforms/macOS/utils.py
@@ -41,7 +41,7 @@ class AppPackagesMergeMixin:
             are in the install path that are non-universal and non-pure.
         """
         binary_packages = []
-        for distinfo in install_path.glob("**/*.dist-info"):
+        for distinfo in install_path.glob("*.dist-info"):
             # Read the WHEEL file in the dist-info folder.
             # Use this to determine if the wheel is "pure", and the tag
             # for the wheel.
diff --git a/tox.ini b/tox.ini
index a620fc3c..00acabf0 100644
--- a/tox.ini
+++ b/tox.ini
@@ -88,7 +88,7 @@ commands =
 [testenv:towncrier{,-check}]
 skip_install = True
 deps =
-    towncrier==24.8.0
+    towncrier==23.11.0
 commands =
     check  : python -m towncrier.check --compare-with origin/main
     !check : python -m towncrier {posargs}


Test patch:
diff --git a/tests/platforms/macOS/test_AppPackagesMergeMixin__find_binary_packages.py b/tests/platforms/macOS/test_AppPackagesMergeMixin__find_binary_packages.py
index 9a7c145c..7f808857 100644
--- a/tests/platforms/macOS/test_AppPackagesMergeMixin__find_binary_packages.py
+++ b/tests/platforms/macOS/test_AppPackagesMergeMixin__find_binary_packages.py
@@ -37,6 +37,17 @@ def test_find_binary_packages(dummy_command, tmp_path):
         "binary-package-2",
         version="3.4.6",
         tag="macOS_13_arm64",
+        extra_content=[
+            # A vendored, but incomplete .dist-info folder. See #1970
+            ("vendored/nested-incomplete.dist-info/LICENSE", "Nested License", 0o644),
+        ],
+    )
+    # A vendored .dist-info folder. This *isn't* found and processed.
+    create_installed_package(
+        tmp_path / "app-packages/binary-package-2/vendored",
+        "nested-package",
+        version="9.9.9",
+        tag="macOS_13_arm64",
     )
 
     binary_packages = dummy_command.find_binary_packages(