* chore: faster mypy
This makes mypy around 26% faster from a cold cache.
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* chore: enable more mypy error codes
Turn on possibly-undefined, exhaustive-match, and other strict flags, and
fix what they report. Two real bugs: pyodide never set `repaired_wheel`
when it reused a compatible wheel, so the test step failed with a
NameError; the OCI shell read loop spun forever if the shell exited.
Assisted-by: ClaudeCode:claude-opus-5
* test: carry default OCI runtime into podman vfs test config
Podman ignores its usual config files when CONTAINERS_CONF is set, so it
falls back to the first runtime found on PATH. On current GitHub Ubuntu
runner images that is crun 1.14.1, which cannot parse the OCI spec v1.2.x
config that podman 5.8.4 generates ("crun: unknown version specified").
Query the default runtime path and set it in the generated config.
Assisted-by: ClaudeCode:claude-fable-5
* fix: annotate vfs config dict so mypy passes on Linux
mypy on macOS marks the rest of the function unreachable after the
darwin pytest.skip, so the strict index error only appears on Linux.
Assisted-by: ClaudeCode:claude-fable-5
* chore: minor cleanup of variable name
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* test: cover container shell exiting during call
Assisted-by: ClaudeCode:claude-opus-5
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* Add pyodide_315 support
Guarded by cpython_prerelease for the moment.
* Update
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Update constraints to pyodide-build 0.39.0
* Update to 315.0.0a2
* Remove example versions
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* fix: use exponential backoff when a download fails
The retry used a flat 3 second wait over 3 attempts, which covers only
about 6 seconds of downtime. A CI runner lost DNS for approximately a
minute and the PyPy download failed. Wait 3, 6, 12, 24, then 48 seconds
over 6 attempts.
Assisted-by: ClaudeCode:claude-opus-5
* ci: raise the uv HTTP retry count
uv stops after 3 retries, which was too few when a runner lost DNS for
approximately a minute during a test run.
Assisted-by: ClaudeCode:claude-opus-5
* fix: do not retry a download after a client error
A bad URL will not fix itself, and the longer backoff made the wait
before the report about 93 seconds. Report 4xx responses at once, and
keep retrying 5xx.
Assisted-by: ClaudeCode:claude-opus-5
* docs: add missing cp314-pyodide_wasm32 to build-id table
The build-id table in docs/options.md is hand-maintained, so a new
identifier can be missed when build-platforms.toml changes. Add a unit
test that checks every identifier appears in the table to guard against
this.
Assisted-by: ClaudeCode:claude-opus-4.8
* test: skip docs table check when docs/options.md is absent
Assisted-by: ClaudeCode:claude-opus-4.8
Since #2609, the pyodide platform required the 'pyodide-build' frontend,
but a global build-frontend setting (TOML or CIBW_BUILD_FRONTEND)
overrides the platform default, so previously-working configs like
build-frontend = "build" failed with a ConfigurationError. Even
"default" failed, since it was mapped to "build" before the check.
Resolve "default" to the platform default, and warn and use
pyodide-build when another frontend is set on pyodide, matching
pre-#2609 behavior where the frontend name only affected verbosity
flags.
Assisted-by: ClaudeCode:claude-opus-4.8
Architecture name lookup in `parse_config` was a case-sensitive StrEnum
lookup. Since the enum carries both lowercase `arm64` (macOS/Android) and
uppercase `ARM64` (Windows), `parse_config("arm64", "windows")` silently
returned the macOS member and later failed with a confusing "Invalid archs
option" error, while lowercase `amd64` failed to parse at all.
Resolve names case-insensitively, preferring a member valid for the target
platform before falling back to any case-insensitive match (which keeps the
clear ConfigurationError for genuinely invalid names).
Closes#2373
Assisted-by: ClaudeCode:claude-opus-4.8
Drops the GraalPy 3.11 / GraalPy 24.2 builds (gp311_242) as agreed in
pypa/cibuildwheel#2741: a ~6-month overlap after the GraalPy 25 (gp312)
release. GraalPy 3.12 (gp312_250) stays.
This also removes the GraalPy 24-only workarounds that were explicitly
marked "Remove when GraalPy 24.x is dropped":
- the Visual Studio compiler-discovery (vswhere) and build-isolation
(graalpython#491) workarounds in the Windows backend
- the issue-491 Windows skip/filter hacks in test_pep518 and
test_dependency_versions (added in the original GraalPy PR #1538 and
unneeded since GraalPy 25 per #2597)
The uv-doesn't-support-graalpy skip (#2754), the `graalpy` enable group,
and the generated constraints pins apply to all GraalPy and are kept.
Assisted-by: ClaudeCode:claude-opus-4.8
* chore: use ConfigurationError when package_dir is outside cwd
Replace a generic Exception with errors. ConfigurationError when package_dir is not inside the working directory. This makes the error type consistent with the project's error handling and allows the CLI to treat this as a fatal error with the expected exit behavior.
* test: merge linux package_dir test into linux_build_steps_test
Fold the standalone linux_build_test.py into the existing
linux_build_steps_test.py, which already covers the linux platform
build orchestration. Reuses the file's existing import boilerplate and
module-qualified build() call style.
Assisted-by: ClaudeCode:claude-opus-4.8
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* ci: improve Azure test reliability
Azure has intermittent failures, often the macOS framework-Python
`posix_spawn: Undefined error: 0` spawn race under load, plus transient
download flakiness. Address both:
- Retry integration tests via pytest-rerunfailures (already required):
add `--reruns=2 --reruns-delay=5` to the serial and non-serial runs so a
single transient flake self-heals instead of failing the whole job.
- Cap Azure at `--num-processes 3` to reduce concurrent process spawning
(the macOS runner was using 4 xdist workers), lowering the spawn-race
probability and peak resource pressure.
- Cache downloads across runs: relocate CIBW_CACHE_PATH to a stable path
and add a Cache@2 task (interpreter downloads + per-worker test pip
caches live under it), cutting the network-download flake surface.
- Bump the Azure host interpreter to 3.13.
Assisted-by: ClaudeCode:claude-opus-4.8
* ci: stabilize iOS tests, bound rerun cost
An iOS run on Azure (build 9043) hung for the full 40-min pytest timeout
on the second build config of test_ios_platforms, then reran twice
(reruns=2), blowing past the 180-min job cap with no useful signal. The
hang was a stuck simulator/xcodebuild on the second config, after the
first config had run.
- Shut down running simulators before each parametrized config via a
`clean_ios_simulators` fixture, so a simulator left booted/wedged by the
previous config isn't reused.
- Drop iOS reruns from 2 to 1. One retry still covers the documented
"fails the first time" simulator-boot flake, while halving the
worst-case retry cost (3x40=120min -> 2x40=80min) on a hang.
Assisted-by: ClaudeCode:claude-opus-4.8
* ci: don't limit num processes
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* ci: rerun OCI unit tests that pull from Docker Hub
test_local_image et al. occasionally fail on a transient Docker Hub
anonymous-pull blip ("unauthorized: authentication required") when
pulling debian:trixie-slim. The integration runs already self-heal via
pytest-rerunfailures, but the unit run had no reruns, so a single flake
failed the whole job. Mark the three network-dependent OCI tests
(test_local_image, test_enter_error, test_multiarch_image) flaky so they
retry instead of blanket-rerunning the suite.
Assisted-by: ClaudeCode:claude-opus-4.8
* Drop iOS clean step
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* ci: scope integration reruns to test_0_basic::test
Drop the blanket --reruns from the serial and non-serial integration
runs and instead mark test_0_basic.py::test as flaky, so only the known
flaky basic test is retried.
Assisted-by: ClaudeCode:claude-opus-4.8
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
`OCIContainer.__enter__` was hardened in #2879 to always clean up on
failure, but `__exit__` was left unguarded. If the container/bash had
already died, `bash_stdin.write("exit 0")` raises `BrokenPipeError`; if
bash refuses to exit, `process.wait(timeout=30)` raises `TimeoutExpired`.
Either propagated out of `__exit__` before `_remove_container()` ran,
leaking the container (and, on timeout, the `start` process too).
Wrap the teardown so a broken pipe or timeout instead forces the process
down (kill + wait) and always falls through to container removal, while
still respecting CIBW_DEBUG_KEEP_CONTAINER. Pipe closes are now also
guarded so a flush-on-close against a dead pipe can't mask cleanup.
Add non-docker unit tests for the clean-exit, already-dead-bash, and
shutdown-timeout paths.
Assisted-by: ClaudeCode:claude-opus-4.8
* fix: detect musl libc when downloading python-build-standalone
`platform.libc_ver()` only ever reports glibc and returns `("", "")` on
musl systems, so `"musl" in platform.libc_ver()` was never true and musl
hosts (e.g. Alpine) always selected the `gnu` python-build-standalone
asset, which won't run.
Detect musl by shelling out to `ldd --version`, which prints "musl libc"
on musl-based systems. This probes the actual system loader rather than
the host Python's linkage, so it stays correct even when cibuildwheel
runs under a relocatable/statically-linked interpreter. Falls back to
glibc when `ldd` is unavailable.
Assisted-by: ClaudeCode:claude-opus-4.8
* test: add type annotations to satisfy mypy and ruff
Assisted-by: ClaudeCode:claude-opus-4.8
This was the case when running `nox -s tests -- --run-podman -v -s 'unit_test/oci_container_test.py::test_multiarch_image[podman-OCIPlatform.i386]'` on macOS arm64.
* fix: ensure clean-up on container start failure and warn on removal failure
Properly release resources on container start failure.
If we fail to remove the created container, warn when not running in CI.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: add unit tests for `OCIContainer._get_platform_args`
While this was already tested indirectly through `test_local_image`, this makes the behaviour check of `OCIContainer._get_platform_args` clear.
* fix: re-add `check=False` removed at some point in local testing
* feat: add SHA256 verification for direct downloads
Store SHA256 hashes when running update scripts and verify them
when downloading files at build time. This improves security by
detecting unexpected changes to downloaded artifacts.
Platforms covered: macOS (CPython, PyPy, GraalPy), iOS, Android,
virtualenv, and python-build-standalone. Windows (nuget) and
Linux (Docker) are excluded.
SHA256 sources per platform:
- macOS/iOS/Android CPython (python.org): sha256_sum from API
- GraalPy: .sha256 sidecar assets from GitHub releases
- python-build-standalone: SHA256SUMS file in release
- PyPy, BeeWare iOS, Maven (Chaquopy): stream-download and compute
Changes:
- cibuildwheel/util/file.py: add sha256 param to download()
- cibuildwheel/platforms/{macos,ios,android}.py: add sha256 to
PythonConfiguration and pass to download()
- cibuildwheel/venv.py: read sha256 from toml and pass to download()
- cibuildwheel/util/python_build_standalone.py: add sha256 to
PythonBuildStandaloneAsset and pass to download()
- cibuildwheel/resources/build-platforms.toml: add sha256 fields
- cibuildwheel/resources/virtualenv.toml: add sha256 field
- cibuildwheel/resources/python-build-standalone-releases.json: add sha256
- bin/update_pythons.py: compute/store sha256 per source strategy
- bin/update_virtualenv.py: compute sha256 by streaming download
- bin/update_python_build_standalone.py: parse SHA256SUMS file
Closes#908
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
* fix: populate sha256 in resource files and fix Windows PythonConfiguration
- Add sha256 field to Windows PythonConfiguration (PyPy/GraalPy have
direct download URLs on Windows too)
- Pass sha256 to install_pypy() and install_graalpy() in windows.py
- Fix update_pythons.py: handle empty sha256 from CPython API (older
versions) by streaming download to compute it; fix condition to
check 'not sha256' rather than 'not in dict'
- Fix update_virtualenv.py: compute sha256 even when version unchanged
but sha256 is empty (first-time population)
- Fix update_python_build_standalone.py: resolve file path relative to
the script itself (not the installed package) so writes go to source
checkout, not the uv cache
- Populate actual sha256 values by running all three update scripts
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
* fix: also include pyodide
Assisted-by: CopilotCLI:gpt-5.3-codex
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: PR review comments for cache verification and docs wording
Co-authored-by: henryiii <4616906+henryiii@users.noreply.github.com>
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: require sha256 for download configs
Require sha256 for URL-backed Python and virtualenv download configs. Update the GraalPy updater to refresh macOS x86_64 entries by selecting the latest release that still has a matching asset, and fill the two missing GraalPy checksums in build-platforms.toml.
Assisted-by: CopilotCLI:gpt-5.4
* ci: remove unit test for bin item
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* refactor: combine sha256 unit tests into test_sha256.py
Merge pyodide_test.py and python_build_standalone_test.py into a
single unit_test/test_sha256.py since both test sha256-related
behaviour.
Assisted-by: opencode:glm-5
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: henryiii <4616906+henryiii@users.noreply.github.com>
* Use auditwheel on Android
* Add auditwheel command to defaults
* pkgconfig fixes
* Pre-import ctypes before monkey-patching in _cross_venv
* Set PKG_CONFIG and PKG_CONFIG_RELOCATE_PATHS variables
* Initial attempt at using mzakharo/android-gfortran
* Switch to using termux/ndk-toolchain-clang-with-flang
* Move PKG_CONFIG variables from build_env to android_env
* Simplify flang installation
* Add cross build files for NumPy
* Add ldpaths entry for libomp
* Add `--rm` to docker command line
* Make Rust and Fortran shims consistent
* Update documentation
* Default to API level 24 on all Python versions
* Clarify comments
* Cleanups
* Fix tests:
* Set up Android env after installing pkgconf
* Add tests for successfully using an older API level
* Previous commit's auditwheel failure is fixed in the auditwheel PR
* Update how-it-works diagram
* Add tests for repair errors
* Add more repair tests
* Add test for Meson and Fortran
* Add test for cross build files
* Improve test_api_level error message
* Add xbuild-files option
* use pypa/auditwheel@main
* Remove dependencies which are no longer needed
* Fix README
* Update to auditwheel 6.7.0
* Fix compatibility with pkgconf 2.5.1.post2
* Documentation clarifications
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Fortran shim improvements
* Add Jinja variables to new_meson_project
* Update run_example_ci_configs for changed new_meson_project signature
* Add missing dependency to run_example_ci_configs
---------
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
* WIP - initial punt at audit command
* Add `abi3audit` as a dependency
* Add helper functions to check stable ABI wheels
* Run `abi3audit` for macOS and Windows wheels
* Copy out of container for repairing?
* Add some notes that `cibuildwheel` runs `abi3audit`
* Add basic unit tests
* Add a basic C extension with `Py_LIMITED_API`
* Add a test project that violates Stable ABI
* Fix linux test
* Skip abi3 wheel tests for Pyodide
* Patch the correct subprocess module
* wrap cleanup of abi3audit dir
* Write the docs for the new options
* Move to above testing in docs
* Implement audit-requires and audit-command
* Some cleanups after self-review
* Add default value
* fix type errors
* the key is `audit-command`, not `audit`
* Add a variety of tests for audit requires options
* Add `test_audit_requires` similar to `test_test_requires`
* Add some configurability-related audit tests
* Fix parsing error with options docs leaving out commands
* Better way to extract version (maybe helps Pyodide?)
* Fix a case of unbound `use_uv`
* Standardise: rename to `abi3_wheel`
* Fix audit command run message
* Simplify custom audit command a bit
* Remove unnecessary skip for Pyodide
* Pyodide should have no default audit command
* More accurate skip messages for Pyodide skips
* Wheels are audited after they are repaired
* Regenerate constraints to include `abi3audit`
* Fix typos
* Some attempts for Windows fixes
* Check `pyvenv.cfg` instead of directory existence
* Add validation for lack of wheel placeholders
* Try yet another Windows `uv` fix
* Regenerate diagram and re-trigger Azure CI
* Add missing `import sys` for abi3 C extension tests
* Remove audit-command at the global level
* Clarify `abi3audit` pinning a little bit
* Regen constraints
* Discard changes to cibuildwheel/resources/constraints-pyodide312.txt
* Discard changes to cibuildwheel/resources/constraints-pyodide313.txt
* try opt-in uv again
* fix issue on windows on Python 3.13 related to nested venvs
On win / python 3.13, virtualenv creates a venv where the 'home'
points back to the venv that sys.executable was running in, rather
than the root install. that seemingly leads to problems with package
resolution, where pip.exe couldn't find the pip python package.
this appears to fix it!
* Update constraints
* chore: revert python-discovery bump
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: restore workaround for graalpy
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Agriya Khetarpal <74401230+agriyakhetarpal@users.noreply.github.com>
Co-authored-by: Henry Schreiner <henryfs@princeton.edu>
* Add a default repair wheel command for Windows
* Install `delvewheel` into Windows build tools
* Add delvewheel to constraints file
* Regenerate constraints
* Docs
* Suggest how to disable Windows wheel repair
* Add tests
* Run `delvewheel` with verbose mode as default
* Add note about telling delvewheel where to look
Suggested-by: Nils <nilsnolde@proton.me>
* Partially revert 81374bb8fc43acefed76cb13d761a9e6cf6afa58
* Add `pip` and `uv` cases for build installations
* Ignore `python-native.dll` for GraalPy
* Ignore MSVC DLLs, try Windows amd64 graalpy happy
* Fix last remaining Windows test failure (famous last words?)
* Update constraints
* Drop workaround unneeded with delvewheel v1.12.1
* Update docs/options.md
Co-authored-by: Aohan Dang <adang1345@gmail.com>
* Drop `test_delvewheel_default_on_windows`
* Partially revert "Update constraints"
This partially reverts commit 2dc4c0f4951858959e213463d90431a5ca03b96f.
* Add a test case when repair command is `""`
* Add back test that checks delvewheel run/disable
* Add a C project with a missing DLL
* Add tests for `missing_dll_project`
* Partially undo virtualenv/python-discovery update
* Fix test
* Discard changes to cibuildwheel/resources/constraints-pyodide312.txt
* Discard changes to cibuildwheel/resources/constraints-pyodide314.txt
* Fix bad merge of constraints
* Discard changes to cibuildwheel/resources/constraints-pyodide313.txt
* Manually add more GraalPy pip markers
* Dependency parsing was too naïve
* Maybe a better way to invoke the compiler on Windows
* Can we get away without a DLL?
---------
Co-authored-by: Aohan Dang <adang1345@gmail.com>
Free-Threading Python 3.13 was experimental.
Now that Python 3.14 has been released with explicit support, we can schedule removal of Python 3.13 free-threading.
2026-04-02 14:39:47 +01:00
Henry Schreinerandpre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* tests: fully type the test suite
* chore: require more typing
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* chore: clean up config a bit
* chore: add an extra check
* Apply suggestions from code review
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* Add test-execution-args option.
* Add usage of test-execution-args.
* Add CI configuration to use test-execution-args.
* Document the test-execution-args setting.
* Simplify code using or syntax instead of inline if.
Co-authored-by: Malcolm Smith <smith@chaquo.com>
* Clarified some Android-specific terminology, and added details about the default args to the test runner.
* Switch to a dict-based test-execution configuration
* Add tests for test-execution parsing.
* Add all the files before pushing...
* Add note about default Android version for testbed.
* Improve description of test-execution setting.
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Switch to using test-runtime.
---------
Co-authored-by: Malcolm Smith <smith@chaquo.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Add Python 3.14 for Android
* Simplify GitHub Actions workflows
* Update tests
* Allow running `patchelf` even when the environment's `bin` directory is not on the PATH
* Search in both the environment's bin directory and the PATH
* Use `sysconfig.get_path`
* Fix lint warning
* Add `clean_cache` to command-line arguments
* Add `--clean-cache` to parser
* Add logic
* Add test to clean cache when it exists
* Ad test to run cache cleaning when none exists
* Add test to run cache cleaning on unwritable path
* Use `main()` instead
* tests: move command tests
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* Create cibuildwheel cache sentinel file
* Add sentinel to existing tests + add new test
* Add signature and switch to `CACHEDIR.TAG`
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Another instance to replace with `CACHEDIR.TAG`
* Verify `CACHEDIR.TAG` signature
* Simplify code branching and control flow
* Add test
* Add link to `CACHEDIR.TAG` specification
* Write with UTF-8 encoding
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* fix doctest
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Add xdoctest to CI
* Add doctests to run tests
* Replace test map with new native method
* Forgot key for arm64
* Allow doctests to be filtered on circleci
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
Henry Schreiner