- Add sha256 field to Windows PythonConfiguration (PyPy/GraalPy have
direct download URLs on Windows too)
- Pass sha256 to install_pypy() and install_graalpy() in windows.py
- Fix update_pythons.py: handle empty sha256 from CPython API (older
versions) by streaming download to compute it; fix condition to
check 'not sha256' rather than 'not in dict'
- Fix update_virtualenv.py: compute sha256 even when version unchanged
but sha256 is empty (first-time population)
- Fix update_python_build_standalone.py: resolve file path relative to
the script itself (not the installed package) so writes go to source
checkout, not the uv cache
- Populate actual sha256 values by running all three update scripts
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
Store SHA256 hashes when running update scripts and verify them
when downloading files at build time. This improves security by
detecting unexpected changes to downloaded artifacts.
Platforms covered: macOS (CPython, PyPy, GraalPy), iOS, Android,
virtualenv, and python-build-standalone. Windows (nuget) and
Linux (Docker) are excluded.
SHA256 sources per platform:
- macOS/iOS/Android CPython (python.org): sha256_sum from API
- GraalPy: .sha256 sidecar assets from GitHub releases
- python-build-standalone: SHA256SUMS file in release
- PyPy, BeeWare iOS, Maven (Chaquopy): stream-download and compute
Changes:
- cibuildwheel/util/file.py: add sha256 param to download()
- cibuildwheel/platforms/{macos,ios,android}.py: add sha256 to
PythonConfiguration and pass to download()
- cibuildwheel/venv.py: read sha256 from toml and pass to download()
- cibuildwheel/util/python_build_standalone.py: add sha256 to
PythonBuildStandaloneAsset and pass to download()
- cibuildwheel/resources/build-platforms.toml: add sha256 fields
- cibuildwheel/resources/virtualenv.toml: add sha256 field
- cibuildwheel/resources/python-build-standalone-releases.json: add sha256
- bin/update_pythons.py: compute/store sha256 per source strategy
- bin/update_virtualenv.py: compute sha256 by streaming download
- bin/update_python_build_standalone.py: parse SHA256SUMS file
Closes#908
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
* feat: add CPython 3.15 support for iOS
Assisted-by: OpenCode:Kimi-K2.6
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: copy in iOS support files
Assisted-by: Copilot:claude-sonnet-4.6
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: skip directories when copying iOS support files
When copying multiarch-specific support files (e.g. _cross_arm64_iphoneos.py),
the code was trying to copy all items in the directory including __pycache__
directories. The shutil.copy() function only works with files, not directories,
which caused an IsADirectoryError.
This fix adds a check to only copy files, skipping any directories like
__pycache__ that may have been created by Python imports.
Assisted-by: Copilot:claude-haiku-4.5
* fix: - in dir fine for now
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: apply review suggestions
Assisted-by: Copilot:claude-sonnet-4.6
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: only do this on 3.15+
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* Ensure target Python directory exists before build
Add assertion to check if target Python directory exists.
* fix(ios): use stdlib dir directly instead of copying to platform-config
Remove the _inject_support_files workaround for python.org 3.15+
distributions. Instead of copying sysconfig files from the stdlib into
a synthetic platform-config/ directory, pass the stdlib directory
directly to make_cross_venv.py.
make_cross_venv.py is updated to derive the multiarch tag from the
_sysconfigdata_ filename rather than assuming it comes from the
directory name.
Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
Assisted-by: OpenCode:Kimi-K2.6
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* Minor format cleanups on pre-commit skipped files.
* Clarify path names in make_cross_venv script.
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
* Add PEP 723 metadata for various `bin` scripts
* Use a subprocess to install chromium
* Regenerate image
* Update shebangs
Co-Authored-By: Henry Schreiner <HenrySchreinerIII@gmail.com>
* Add cibuildwheel local dependency for some scripts
Co-Authored-By: Henry Schreiner <HenrySchreinerIII@gmail.com>
* Remove `bin` dependency group fully
* Add CSS for styling the diagram
Co-Authored-By: Joe Rickerby <1244307+joerick@users.noreply.github.com>
* Restore image to original
* Install `uv` for PyLint to find it
* Drop setup-python too in favour of setup-uv
* Revert "Drop setup-python too in favour of setup-uv"
This reverts commit 663db5c253f18bd09229ea5dbf92f7f6aa8ebf1c.
* Make `uv` venv backend for nox optional again
---------
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
Co-authored-by: Joe Rickerby <1244307+joerick@users.noreply.github.com>
* [pre-commit.ci] pre-commit autoupdate
updates:
- [github.com/astral-sh/ruff-pre-commit: v0.14.14 → v0.15.0](https://github.com/astral-sh/ruff-pre-commit/compare/v0.14.14...v0.15.0)
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Refactor test_command checks to use set syntax
* Apply suggestion from @henryiii
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* ci: avoid broken GraalPy release
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* ci: skip GraalPy when no release url available
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* Add Python 3.14 for Android
* Simplify GitHub Actions workflows
* Update tests
* Allow running `patchelf` even when the environment's `bin` directory is not on the PATH
* Search in both the environment's bin directory and the PATH
* Use `sysconfig.get_path`
* Fix lint warning
* Add Android to resource files
* Add Android to miscellaneous places
* Add Android documentation
* Docs cleanups
* Add Android platform module; implement top-level structure and target Python installation
* Implement setup_env and build_wheel
* lru-dict build working
* Alter prefix in sysconfigdata file; fix various issues with FLAGS variables
* Implement Android testing
* Add type annotations to _cross_venv
* Revert Python 3.8 to pip 25.0.1
* Make test-sources required on Android
* Add Android integration tests
* Test cleanups
* Add test of all available Python versions
* Update test-sources and test-command behavior to match iOS
* Documentation cleanups
* Replace Builder class with a set of global functions
* Rename "env" to "build_env"
* Remove Chaquopy repository from default pip command line
* Move native_platform to platforms module
* Fix parse_config_settings
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Add unit tests for parse_config_settings and arch_synonym
* Make `shell_prepared` arguments keyword-only, and add tests for the commands that use it
* Replace `importlib.util.spec_from_file_location` with `runpy.run_path`
* Use python-build-standalone
* Update Android Python
* Enable KVM in Linux CI
* Move KVM code to test_android.py
* Use Java 17 on Azure
* Install emulator if necessary before running -accel-check
* Free up additional disk space on Linux runners
* Add sudo
* Skip emulator tests on CI platforms that don't support it
* Download Android Python from Maven Central
* Free up more disk space on Linux runners
* fix: minor fixups
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* Set sysconfig._BASE_PREFIX to support sysconfig.get_path("include")
* Get ANDROID_API_LEVEL from the build environment, not cibuildwheel's own environment
* Correct relative path of test-sources
* Pass a CMake toolchain file to the build
* Add "repair" step which adds libc++ to the wheel when necessary
* Add missing needs_emulator decorator
* Provide useful error message if ANDROID_HOME is not set
* Remove use of HOST environment variable
* Update to Python 3.15.5
* Fix PyLint warnings, clarify comment
* Group common arguments into a dataclass
* Handle environment variables containing newlines
* Discourage the use of `pytest` test commands without `python -m`
* Use single quotes in user-visible messages
* Improve testing documentation
* Pass wheel filename to `log.build_end`
* In GitHub Actions example, skip Android tests on macOS
* Correct relative paths in `patchelf --set-rpath`
* Clarify `test-sources` docs
* Update to Python 3.13.5+20250722.214220
---------
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
Co-authored-by: Henry Schreiner <henryschreineriii@gmail.com>
* Fix a typo: pyoodide ➡️ pyodide
* Add `pyodide_build_version` attribute
* Add version to xbuildenv log step
* Add version to Emscripten log step
* Use `pyodide-build`'s version for updating constraints
* Bump Pyodide constraints by updating `pyodide-build`
* Add a schema for `pyodide-version`
* Update Pyodide constraints
* Bump `pyodide-build` to new 0.29.0
* Test out another Pyodide identifier
* Update outdated Pyodide constraints
* Add Pyodide version to temp directory name
* Remove Pyodide 0.26.1 from build configurations
* Retrieve + validate + install specific xbuildenvs
* Test wheel builds with Pyodide 0.26.2
* Add correct Pyodide version to identifier temp dir
* Don't pre-call Pyodide xbuildenv search
* Fetch just the stable Pyodide versions
* Refactor search + validation + install into one step
* Move all of it under a lock
* Reorder xbuildenv installation
* Add env and cwd to xbuildenv search call
* Temporarily lower to 0.26.2 target
* Separate out search, validate, install; again
* Run xbuildenv search in `CIBW_CACHE_PATH`
* Remove prior `PYODIDE_ROOT` env vars, copy envs
* Validate doesn't need to depend on searching
* Add file lock when searching xbuildenvs
* Test the original version: 0.26.1
* Update Pyodide constraints
* Update constraints for `pyodide-build` 0.29.0 again
* Bump Pyodide from version 0.26.1 ➡️ version 0.26.4
* Add note on compatibility for macOS + other archs
* Note Pyodide version for Pyodide identifier
* Docs about `CIBW_PYODIDE_VERSION`
* Don't fetch just the stable versions
* Discard a variable that's not used later
* Rename `search_xbuildenv` ➡️ `get_xbuildenv_versions`
* `validate_xbuildenv` ➡️ `validate_xbuildenv_version`
* Replace ordered comment, add newline
* Replace sentence on macOS support
Co-Authored-By: Hood Chatham <roberthoodchatham@gmail.com>
* Capitalise: "pyodide" ➡️ "Pyodide"
Co-Authored-By: Hood Chatham <roberthoodchatham@gmail.com>
* "work" ➡️ "may succeed"
Co-Authored-By: Hood Chatham <roberthoodchatham@gmail.com>
* Add another job to test a custom Pyodide version
* Handle "v"-prefixed + non-prefixed versions
* Convert to a proper toml-able option, and remove some hardcoded versions
This removes the enscripten and pyodide-build version specs from
pyproject.toml - pyodide-build is spec'd in the constraints file, and
the emscripten version can be read from the pyodide-build output.
* Add a schema entry
* Add docs for CIBW_PYODIDE_VERSION
* Rephrase
* Add tests for pyodide-version
* Apply suggestions from code review
* Add python_build_standalone util
* Hook up to python-build-standalone, removing dependency on host python
* Remove python hard-code in action.yml
* Add log step
* Add workaround for https://github.com/pyodide/pyodide-build/issues/143
* Add emscripten pytest test
* Remove unneeded checks
* Fix a pytest invoke for emscripten
* Generate pyodide-build constraints from the pinned pyodide version
* Remove pyodide python-build-standalone workaround
* Fixup paths from newer version of pyodide-build
* Fix/skip some failing tests
* Use `python -m pytest` on pyodide, even on Linux
* Docs fixes
* Don't call the github API at runtime, cache the release assets instead
* Ignore pylint false positive
* Add version auto-updating for pyodide
* Add support for pyodide 3.13.
* Fix tests for multiple pyodide wheels
* Remove workaround for unreleased pyodide-build
* Rename to "test_pyodide"
* Fix pathname confusion
* Remove extra github actions job
* Fix expectation for test_abi_none
* Fix the custom_repair_wheel test to actually have clashing names
* Fix pinned version test
* Document test-command limitation
* Remove pyodide 0.28.0a1 for now
* Update constraints files
* Docs/test fixes post removing pyodide cp313
* Fix ABI test expectation
* Docs improvements
* Improve some comments
* Remove logic duplication
* remove pyodide special casing
* Refactor constraints code to use a utility script, circumventing import issues
* chore: nicer nox env
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* fix: typo in variable name found by copilot
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* Apply suggestions from code review
* Some more Pyodide version updates in the docs section
* We haven't released Pyodide v0.27.6 yet
* Back to the Github URL for cross-build-environments
* `pyodide-build`, not `emsdk` for Windows skips
Co-Authored-By: Hood Chatham <roberthoodchatham@gmail.com>
* Move to a separate `_json_request` function
Co-Authored-By: Hood Chatham <roberthoodchatham@gmail.com>
* Rename "retries" ➡️ "retry_count"
* Add some type hints
* Copy env vars before `UV_CUSTOM_COMPILE_COMMAND`
* Use `HTTPError.headers.get` instead
* Remove extra end quote
* Change download tests URL to `https://badssl.com/`
Co-Authored-By: Joe Rickerby <1244307+joerick@users.noreply.github.com>
* Download size changes, too
* Use jsdelivr for Github asset mirroring
* Bump to Pyodide v0.27.6
* Fix unit tests
* Move to pyodide v0.27.6 again
* Bump to pyodide-build 0.30.4
* Use new URL for cross-build environments metadata
Co-authored-by: Joe Rickerby <joerick@mac.com>
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Hood Chatham <roberthoodchatham@gmail.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
Co-authored-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Joe Rickerby <1244307+joerick@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Properly close files used for testing
* Add support for GraalPy
* Help GraalPy discover build tools on Windows
* Expect manylinux-interpreters ensure graalpy* warning in pip
* Workaround GraalPy bugs on Windows
* Workaround oracle/graalpython#491 also when uv is not available
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Update azure-pipelines.yml
* Update azure-pipelines.yml
* refacotor: use pathlib.write_text
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* Include GraalPy in docker_warmup and remove workaround for installing it late
---------
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* Add support for building iOS wheels.
* Replace use of system() in test binary module.
* Restored the 'minimal' approach of the minimal examples.
* Split out platform details into standalone pages, and expand iOS platform details.
* More doc corrections.
* Bump support package to include fix for python/cpython#130292
* Ensure iOS tests are all run on the same xdist worker.
* More iOS documentation tweaks.
* Factor out common xcode version test utility.
* Simplify iOS to a single platform with an expanded interpretation of arch.
* I guess I should update the iOS tests as well...
* Additional safety for missing iOS test output.
* Remove DYLD_LIBRARY_PATH from the iOS environment.
* Make test-sources mandatory for iOS builds.
* Updates and clarifications to documentation.
* Clarify what a slice is.
* Normalize use of underscores in platform name.
* Modify auto target to be matching CPU only.
* Use consistent ordering of platforms in examples.
* Use consistent naming in iOS archiectures.
* Placate the linter.
* Miscellaneous cleanups picked up by @joerick's review.
* Correct the list of expected wheels.
* Correct which 'native' we're actually checking.
* Correct the docs links so they're all relative.
* Correct the identification of free threaded builds.
* Use target instead of host to describe the platform we're building for.
* Rework iOS test to remove issue with log completeness.
* Convert errors to FatalError
Co-authored-by: Matthieu Darbois <mayeut@users.noreply.github.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Removed a repeated check for a valid python.
* Update bin/update_pythons.py to update iOS support packages.
* Document that iOS CI is available on other platforms.
* Restore a comment needed for some platforms.
* Small cleanups identified in code review
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Simplify logic to appease linter.
* Modify dependency constraint handling to use new API.
* Cosmetic change to trigger a CI rebuild.
---------
Co-authored-by: Matthieu Darbois <mayeut@users.noreply.github.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
* chore: use SPEC 0 schedule for cibuildwheel
* remove support for {python} and {pip} in commands
* Remove specific Python versions from the update-dependencies job
The requirements pinning is done by uv now, so we don't need to
run the versions of Python to do the pinning anymore.
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
* add support for building wheels for windows on arm64
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Fix main_platform_test.py
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Remove unrequired explicit nuget source
* add python arm64 3.9.9 version
* extend update_pythons.py to add win/arm64 support
* update documentation for new win/arm64 platform
* style: include ARM64 in literal
* Fix python 3.9 identifier for win_arm64
* Fix table layout issues in README and add note about arm64 pip issue
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* chore: update packaging dev requirement
Requires packaging>=21.0
This allows to simplify a bit `bin/update_pythons.py` with regards to typing.
* update packaging dev requirement for pre-commit
* Add CPython 3.10 support
* Fix logger displaying CPython 3.1 instead of 3.10
* Fix tests failing with CPython 3.10
* Use pytest instead of nose
* feat: --pre flag
Apply suggestions from code review
Co-authored-by: Matthieu Darbois <mayeut@users.noreply.github.com>
* fix: update Python update script to process beta versions
* refactor: prerelease-pythons
* Use `strtobool` to parse `CIBW_PRERELEASE_PYTHONS` env var
* Update python version filtering for universal2 & arm64
* Filter out CPython 3.10 and above for `test_manylinuxXXXX_only[manylinux1]` test
* Use CIBW_BUILD filtering rather than CIBW_SKIP for test_docker_images
* Use skip_patterns to filter out pre-releases
* Use `prerelease_pythons` instead of `pre`
* Reword `CIBW_PRERELEASE_PYTHONS` doc per review.
* Use `CIBW_PRERELEASE_PYTHONS: True` for usage example.
* Update `cibuildwheel --help` doc
* docs: add note on spec.filter
* Clean up the BuildSelector __repr__ by refactoring
* fix: remove platform variants for CIBW_PRERELEASE_PYTHONS
* docs: mention the flag
Co-authored-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
* fix: `bin/update_pythons.py` to work properly with PyPy `win_amd64`
* refactor: use the same pattern for all python updates
* follow up to #671, for the record.
Henry Schreiner