* feat: add SHA256 verification for direct downloads
Store SHA256 hashes when running update scripts and verify them
when downloading files at build time. This improves security by
detecting unexpected changes to downloaded artifacts.
Platforms covered: macOS (CPython, PyPy, GraalPy), iOS, Android,
virtualenv, and python-build-standalone. Windows (nuget) and
Linux (Docker) are excluded.
SHA256 sources per platform:
- macOS/iOS/Android CPython (python.org): sha256_sum from API
- GraalPy: .sha256 sidecar assets from GitHub releases
- python-build-standalone: SHA256SUMS file in release
- PyPy, BeeWare iOS, Maven (Chaquopy): stream-download and compute
Changes:
- cibuildwheel/util/file.py: add sha256 param to download()
- cibuildwheel/platforms/{macos,ios,android}.py: add sha256 to
PythonConfiguration and pass to download()
- cibuildwheel/venv.py: read sha256 from toml and pass to download()
- cibuildwheel/util/python_build_standalone.py: add sha256 to
PythonBuildStandaloneAsset and pass to download()
- cibuildwheel/resources/build-platforms.toml: add sha256 fields
- cibuildwheel/resources/virtualenv.toml: add sha256 field
- cibuildwheel/resources/python-build-standalone-releases.json: add sha256
- bin/update_pythons.py: compute/store sha256 per source strategy
- bin/update_virtualenv.py: compute sha256 by streaming download
- bin/update_python_build_standalone.py: parse SHA256SUMS file
Closes#908
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
* fix: populate sha256 in resource files and fix Windows PythonConfiguration
- Add sha256 field to Windows PythonConfiguration (PyPy/GraalPy have
direct download URLs on Windows too)
- Pass sha256 to install_pypy() and install_graalpy() in windows.py
- Fix update_pythons.py: handle empty sha256 from CPython API (older
versions) by streaming download to compute it; fix condition to
check 'not sha256' rather than 'not in dict'
- Fix update_virtualenv.py: compute sha256 even when version unchanged
but sha256 is empty (first-time population)
- Fix update_python_build_standalone.py: resolve file path relative to
the script itself (not the installed package) so writes go to source
checkout, not the uv cache
- Populate actual sha256 values by running all three update scripts
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
* fix: also include pyodide
Assisted-by: CopilotCLI:gpt-5.3-codex
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: PR review comments for cache verification and docs wording
Co-authored-by: henryiii <4616906+henryiii@users.noreply.github.com>
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: require sha256 for download configs
Require sha256 for URL-backed Python and virtualenv download configs. Update the GraalPy updater to refresh macOS x86_64 entries by selecting the latest release that still has a matching asset, and fill the two missing GraalPy checksums in build-platforms.toml.
Assisted-by: CopilotCLI:gpt-5.4
* ci: remove unit test for bin item
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* refactor: combine sha256 unit tests into test_sha256.py
Merge pyodide_test.py and python_build_standalone_test.py into a
single unit_test/test_sha256.py since both test sha256-related
behaviour.
Assisted-by: opencode:glm-5
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: henryiii <4616906+henryiii@users.noreply.github.com>
Since delvewheel is now the default repair-wheel-command on Windows,
update all places where auditwheel/delocate were referenced but
delvewheel was missing:
- diagram.html: add delvewheel repair block for Windows (was grouped
with ios/pyodide as optional dot)
- generate_schema.py: add Windows delvewheel default to the platform
loop so schema.json includes the default
- schema.json: regenerated with Windows delvewheel default
- options.md: add Windows to defaults list, remove outdated tip about
delvewheel being early-stage/optional, update examples
- contributing.md: add delvewheel to the tool list
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* feat: add CIBUILDWHEEL_BUILD_IDENTIFIER environment variable
Set `CIBUILDWHEEL_BUILD_IDENTIFIER` to the current build identifier
(e.g. `cp311-manylinux_x86_64`) in the environment for all per-build
steps: `before_build`, the build itself, `repair_command`,
`before_test`, and `test_command`.
This allows scripts and commands to inspect which build is currently
running, which is useful for e.g. writing per-build output files:
CIBW_TEST_COMMAND='pytest --junit-xml=results-$CIBUILDWHEEL_BUILD_IDENTIFIER.xml'
The variable is set after the user's environment overrides are applied
and is only available for per-build steps (not `before_all`, where no
single identifier applies). All six platforms are covered: linux, macOS,
Windows, pyodide, Android, and iOS.
Closes#944, closes#2750
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: OpenCode:claude-sonnet-4.6
* fix: address review comment moving this for Android
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Use auditwheel on Android
* Add auditwheel command to defaults
* pkgconfig fixes
* Pre-import ctypes before monkey-patching in _cross_venv
* Set PKG_CONFIG and PKG_CONFIG_RELOCATE_PATHS variables
* Initial attempt at using mzakharo/android-gfortran
* Switch to using termux/ndk-toolchain-clang-with-flang
* Move PKG_CONFIG variables from build_env to android_env
* Simplify flang installation
* Add cross build files for NumPy
* Add ldpaths entry for libomp
* Add `--rm` to docker command line
* Make Rust and Fortran shims consistent
* Update documentation
* Default to API level 24 on all Python versions
* Clarify comments
* Cleanups
* Fix tests:
* Set up Android env after installing pkgconf
* Add tests for successfully using an older API level
* Previous commit's auditwheel failure is fixed in the auditwheel PR
* Update how-it-works diagram
* Add tests for repair errors
* Add more repair tests
* Add test for Meson and Fortran
* Add test for cross build files
* Improve test_api_level error message
* Add xbuild-files option
* use pypa/auditwheel@main
* Remove dependencies which are no longer needed
* Fix README
* Update to auditwheel 6.7.0
* Fix compatibility with pkgconf 2.5.1.post2
* Documentation clarifications
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Fortran shim improvements
* Add Jinja variables to new_meson_project
* Update run_example_ci_configs for changed new_meson_project signature
* Add missing dependency to run_example_ci_configs
---------
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Update dependencies
* Revert pip marker flattening for GraalPy 3.11 on Windows
* Revert pip marker flattening for GraalPy 3.12 on Windows
---------
Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
* WIP - initial punt at audit command
* Add `abi3audit` as a dependency
* Add helper functions to check stable ABI wheels
* Run `abi3audit` for macOS and Windows wheels
* Copy out of container for repairing?
* Add some notes that `cibuildwheel` runs `abi3audit`
* Add basic unit tests
* Add a basic C extension with `Py_LIMITED_API`
* Add a test project that violates Stable ABI
* Fix linux test
* Skip abi3 wheel tests for Pyodide
* Patch the correct subprocess module
* wrap cleanup of abi3audit dir
* Write the docs for the new options
* Move to above testing in docs
* Implement audit-requires and audit-command
* Some cleanups after self-review
* Add default value
* fix type errors
* the key is `audit-command`, not `audit`
* Add a variety of tests for audit requires options
* Add `test_audit_requires` similar to `test_test_requires`
* Add some configurability-related audit tests
* Fix parsing error with options docs leaving out commands
* Better way to extract version (maybe helps Pyodide?)
* Fix a case of unbound `use_uv`
* Standardise: rename to `abi3_wheel`
* Fix audit command run message
* Simplify custom audit command a bit
* Remove unnecessary skip for Pyodide
* Pyodide should have no default audit command
* More accurate skip messages for Pyodide skips
* Wheels are audited after they are repaired
* Regenerate constraints to include `abi3audit`
* Fix typos
* Some attempts for Windows fixes
* Check `pyvenv.cfg` instead of directory existence
* Add validation for lack of wheel placeholders
* Try yet another Windows `uv` fix
* Regenerate diagram and re-trigger Azure CI
* Add missing `import sys` for abi3 C extension tests
* Remove audit-command at the global level
* Clarify `abi3audit` pinning a little bit
* Regen constraints
* Discard changes to cibuildwheel/resources/constraints-pyodide312.txt
* Discard changes to cibuildwheel/resources/constraints-pyodide313.txt
* try opt-in uv again
* fix issue on windows on Python 3.13 related to nested venvs
On win / python 3.13, virtualenv creates a venv where the 'home'
points back to the venv that sys.executable was running in, rather
than the root install. that seemingly leads to problems with package
resolution, where pip.exe couldn't find the pip python package.
this appears to fix it!
* Update constraints
* chore: revert python-discovery bump
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: restore workaround for graalpy
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Agriya Khetarpal <74401230+agriyakhetarpal@users.noreply.github.com>
Co-authored-by: Henry Schreiner <henryfs@princeton.edu>
* Add a default repair wheel command for Windows
* Install `delvewheel` into Windows build tools
* Add delvewheel to constraints file
* Regenerate constraints
* Docs
* Suggest how to disable Windows wheel repair
* Add tests
* Run `delvewheel` with verbose mode as default
* Add note about telling delvewheel where to look
Suggested-by: Nils <nilsnolde@proton.me>
* Partially revert 81374bb8fc43acefed76cb13d761a9e6cf6afa58
* Add `pip` and `uv` cases for build installations
* Ignore `python-native.dll` for GraalPy
* Ignore MSVC DLLs, try Windows amd64 graalpy happy
* Fix last remaining Windows test failure (famous last words?)
* Update constraints
* Drop workaround unneeded with delvewheel v1.12.1
* Update docs/options.md
Co-authored-by: Aohan Dang <adang1345@gmail.com>
* Drop `test_delvewheel_default_on_windows`
* Partially revert "Update constraints"
This partially reverts commit 2dc4c0f4951858959e213463d90431a5ca03b96f.
* Add a test case when repair command is `""`
* Add back test that checks delvewheel run/disable
* Add a C project with a missing DLL
* Add tests for `missing_dll_project`
* Partially undo virtualenv/python-discovery update
* Fix test
* Discard changes to cibuildwheel/resources/constraints-pyodide312.txt
* Discard changes to cibuildwheel/resources/constraints-pyodide314.txt
* Fix bad merge of constraints
* Discard changes to cibuildwheel/resources/constraints-pyodide313.txt
* Manually add more GraalPy pip markers
* Dependency parsing was too naïve
* Maybe a better way to invoke the compiler on Windows
* Can we get away without a DLL?
---------
Co-authored-by: Aohan Dang <adang1345@gmail.com>
* Update dependencies
* fix: revert pip upgrade on graalpy for now
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* fix: older pip for graalpy on Windows
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
Co-authored-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Update dependencies
* revert pyodide changes
those will be handled in #2812
---------
Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
Co-authored-by: Malcolm Smith <smith@chaquo.com>
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
* Update diagram with details of Android, iOS, and Pyodide builds
* Update diagram as well
* Simplify
Co-Authored-By: Malcolm Smith <smith@chaquo.com>
* Improve WCAG for some text elements
* Update diagram snapshot
* Modernise image generation script and rerun
---------
Co-authored-by: Malcolm Smith <smith@chaquo.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
* fix: drop Cirrus CI (going away June 1, 2026)
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* Restore missing note
* Update CI services documentation for Cirrus CI
Removed official support for Cirrus CI due to end-of-life.
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* Create greyed-out Pyodide icon
* Add Pyodide icon to NumPy and scikit-learn
* Add new Pyodide data to projects fields
* Allow local SVG usage if missing in simple-icons
* Fix deprecated `login_or_token` argument
* Regenerate working examples with Android, iOS, and Pyodide data
* Add Pyodide to the "Usage" table
* Add ⚠️⁵ to the table indicating Pyodide being untested
* add pybase64 to the list of projects building pyodide wheels
* Update and format table + maybe this looks nicer
* Downscale Pyodide SVG to 16px width
* Reformat tables and superscript references a bit more
---------
Co-authored-by: Matthieu Darbois <mayeut@users.noreply.github.com>
* tests: fully type the test suite
* chore: require more typing
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* [2.x] Update virtualenv URLs to avoid blob URLs
It looks like many people are hitting the HTTP 429 for old versions of cibuildwheel. These hosted versions of virtualenv should work, let's see...
* Write the correct version strings
* ci: some updates based on main branch
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* ci: move to using latest images
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* chore: fix up style checks
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* ci: newer azure images too
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* tests: use new SSL test from main
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* Drop `build`'s installation from Pyodide build tools
---------
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Agriya Khetarpal <74401230+agriyakhetarpal@users.noreply.github.com>
* Add an integration test with the meson backend
* Modify script to allow testing of the GHA action on a PR
* Try adding cython to languages in meson config
* Revert "Try adding cython to languages in meson config"
This reverts commit 50378a1c7e38665492ad0c683b178e4d96928e1e.
* Pass --vsenv to meson on windows
As seen here https://github.com/matplotlib/matplotlib/blob/9957c394bd01deb7a9bd9cb27804f447a52dc522/.github/workflows/cibuildwheel.yml#L114
* Disable win32 builds for the meson test
* Move the windows-specific config into the test project definition
This is so it can be tested with bin/run_example_ci_configs.py
* Add some docs to the FAQ about meson on windows
* Update bin/run_example_ci_configs.py
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
---------
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* Bump to actions/checkout v6 everywhere
* Add a note about security
* Not persisting credentials is still valuable
* Fix bad indentation
* Improve wording, remove link to PyPA guides
Co-Authored-By: Joe Rickerby <1244307+joerick@users.noreply.github.com>
---------
Co-authored-by: Joe Rickerby <1244307+joerick@users.noreply.github.com>
Stop testing on Travis CI.
References to Travis CI are removed from docs.
Travis CI specifics are kept as-is in cibuildwheel itself (mostly logging stuff).
