- Add sha256 field to Windows PythonConfiguration (PyPy/GraalPy have
direct download URLs on Windows too)
- Pass sha256 to install_pypy() and install_graalpy() in windows.py
- Fix update_pythons.py: handle empty sha256 from CPython API (older
versions) by streaming download to compute it; fix condition to
check 'not sha256' rather than 'not in dict'
- Fix update_virtualenv.py: compute sha256 even when version unchanged
but sha256 is empty (first-time population)
- Fix update_python_build_standalone.py: resolve file path relative to
the script itself (not the installed package) so writes go to source
checkout, not the uv cache
- Populate actual sha256 values by running all three update scripts
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
Store SHA256 hashes when running update scripts and verify them
when downloading files at build time. This improves security by
detecting unexpected changes to downloaded artifacts.
Platforms covered: macOS (CPython, PyPy, GraalPy), iOS, Android,
virtualenv, and python-build-standalone. Windows (nuget) and
Linux (Docker) are excluded.
SHA256 sources per platform:
- macOS/iOS/Android CPython (python.org): sha256_sum from API
- GraalPy: .sha256 sidecar assets from GitHub releases
- python-build-standalone: SHA256SUMS file in release
- PyPy, BeeWare iOS, Maven (Chaquopy): stream-download and compute
Changes:
- cibuildwheel/util/file.py: add sha256 param to download()
- cibuildwheel/platforms/{macos,ios,android}.py: add sha256 to
PythonConfiguration and pass to download()
- cibuildwheel/venv.py: read sha256 from toml and pass to download()
- cibuildwheel/util/python_build_standalone.py: add sha256 to
PythonBuildStandaloneAsset and pass to download()
- cibuildwheel/resources/build-platforms.toml: add sha256 fields
- cibuildwheel/resources/virtualenv.toml: add sha256 field
- cibuildwheel/resources/python-build-standalone-releases.json: add sha256
- bin/update_pythons.py: compute/store sha256 per source strategy
- bin/update_virtualenv.py: compute sha256 by streaming download
- bin/update_python_build_standalone.py: parse SHA256SUMS file
Closes#908
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
* Add PEP 723 metadata for various `bin` scripts
* Use a subprocess to install chromium
* Regenerate image
* Update shebangs
Co-Authored-By: Henry Schreiner <HenrySchreinerIII@gmail.com>
* Add cibuildwheel local dependency for some scripts
Co-Authored-By: Henry Schreiner <HenrySchreinerIII@gmail.com>
* Remove `bin` dependency group fully
* Add CSS for styling the diagram
Co-Authored-By: Joe Rickerby <1244307+joerick@users.noreply.github.com>
* Restore image to original
* Install `uv` for PyLint to find it
* Drop setup-python too in favour of setup-uv
* Revert "Drop setup-python too in favour of setup-uv"
This reverts commit 663db5c253f18bd09229ea5dbf92f7f6aa8ebf1c.
* Make `uv` venv backend for nox optional again
---------
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
Co-authored-by: Joe Rickerby <1244307+joerick@users.noreply.github.com>
* chore: use SPEC 0 schedule for cibuildwheel
* remove support for {python} and {pip} in commands
* Remove specific Python versions from the update-dependencies job
The requirements pinning is done by uv now, so we don't need to
run the versions of Python to do the pinning anymore.
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
* feature: allow local runs on windows/macOS
Cache python installations to a user cache folder using platformdirs.
The build environment is now a virtual environment to allow proper isolation.
Allows to run tests in parallel.
Co-authored-by: Joe Rickerby <joerick@mac.com>
