See for example on master: https://github.com/bitcoin-core/secp256k1/actions/runs/19143357521/job/54714339317#step:6:37 This happens only on MacOS so far, but we should see this on Linux soon, too.
lief is needed for symbol-check.py. Since lief is a library, we can’t use pipx and the clean way to solve this is to create a virtual environment for running the symbol-check.py script.
I suggest using uv, a modern Python package manager. It has support for declaring dependencies of single-file scripts in a comment, see https://docs.astral.sh/uv/guides/scripts/#running-a-script-without-dependencies . When you run the script, uv automatically creates a virtual environment and everything works out of the box. I think that’s the best solution for stuff like symbol-check.py.
We use uv in secp256k1lab and are happy with it, I’ve also used it in a few other projects. It has a few other advantages, e.g., it can manage Python installations which is useful if we ever need a specific Python version. Or we could use it to test our Python scripts on multiple Python versions easily. That’s what we do in secp256k1lab, and we use a GitHub Action to install it. (Note that using uv on CI does not force anyone to do the same. If you don’t want to use uv, you can still install lief manually and run the script.)