* Update dependencies
* restore graalpy windows workaround
* aand the other one
---------
Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
Architecture name lookup in `parse_config` was a case-sensitive StrEnum
lookup. Since the enum carries both lowercase `arm64` (macOS/Android) and
uppercase `ARM64` (Windows), `parse_config("arm64", "windows")` silently
returned the macOS member and later failed with a confusing "Invalid archs
option" error, while lowercase `amd64` failed to parse at all.
Resolve names case-insensitively, preferring a member valid for the target
platform before falling back to any case-insensitive match (which keeps the
clear ConfigurationError for genuinely invalid names).
Closes#2373
Assisted-by: ClaudeCode:claude-opus-4.8
* chore: minor cleanups and perf tweaks from code review
- util/file.py, util/python_build_standalone.py: use hashlib.file_digest
for streaming SHA-256 verification instead of loading whole archives
into memory with read_bytes()
- logger.py: convert colors/symbols properties to functools.cached_property
so the Colors/Symbols objects are constructed only once per Logger instance
- platforms/windows.py: remove redundant .strip() on where_pip (already
stripped at assignment)
- util/python_build_standalone.py: remove unreachable python_base_dir.exists()
guard (callers always pass a fresh temp subdirectory)
- util/file.py: add comment explaining the getattr shim for
tar_.extraction_filter and when it can be removed
Assisted-by: ClaudeCode:claude-fable-5
* revert: restore assertion to check python_base_dir existence
* Add FAQ section on caching cibuildwheel's downloaded tools
Adds a Tips entry covering:
- What cibuildwheel caches (CPython/PyPy installers, virtualenv,
python-build-standalone archives) and the default per-OS cache folder.
- How to override the cache location with ``CIBW_CACHE_PATH``.
- A worked GitHub Actions example pairing ``actions/cache`` with
``CIBW_CACHE_PATH`` so the cache survives between runs.
- A pointer to ``--clean-cache`` for invalidating stale entries.
Closes#1585.
Per @joerick's request in the issue ("a caching section in the FAQ
would be great, if you can contribute it") the scope is intentionally
narrow — just FAQ-level guidance. Platform-specific caching (e.g.
Windows NuGet, addressed in #2839) lives in the platforms doc.
* docs: bump actions/cache v4 to v5
* docs: move cache to runner.temp, add cache poisoning warning (review feedback)
Drops the GraalPy 3.11 / GraalPy 24.2 builds (gp311_242) as agreed in
pypa/cibuildwheel#2741: a ~6-month overlap after the GraalPy 25 (gp312)
release. GraalPy 3.12 (gp312_250) stays.
This also removes the GraalPy 24-only workarounds that were explicitly
marked "Remove when GraalPy 24.x is dropped":
- the Visual Studio compiler-discovery (vswhere) and build-isolation
(graalpython#491) workarounds in the Windows backend
- the issue-491 Windows skip/filter hacks in test_pep518 and
test_dependency_versions (added in the original GraalPy PR #1538 and
unneeded since GraalPy 25 per #2597)
The uv-doesn't-support-graalpy skip (#2754), the `graalpy` enable group,
and the generated constraints pins apply to all GraalPy and are kept.
Assisted-by: ClaudeCode:claude-opus-4.8
* chore: use ConfigurationError when package_dir is outside cwd
Replace a generic Exception with errors. ConfigurationError when package_dir is not inside the working directory. This makes the error type consistent with the project's error handling and allows the CLI to treat this as a fatal error with the expected exit behavior.
* test: merge linux package_dir test into linux_build_steps_test
Fold the standalone linux_build_test.py into the existing
linux_build_steps_test.py, which already covers the linux platform
build orchestration. Reuses the file's existing import boilerplate and
module-qualified build() call style.
Assisted-by: ClaudeCode:claude-opus-4.8
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Replace the explicit if/else used to resolve pinned container images with pinned_images.get(config_value, config_value) in the manylinux and musllinux loops inside _compute_build_options. This keeps behavior identical while reducing duplication and simplifying the code in cibuildwheel/options.py.
* ci: improve Azure test reliability
Azure has intermittent failures, often the macOS framework-Python
`posix_spawn: Undefined error: 0` spawn race under load, plus transient
download flakiness. Address both:
- Retry integration tests via pytest-rerunfailures (already required):
add `--reruns=2 --reruns-delay=5` to the serial and non-serial runs so a
single transient flake self-heals instead of failing the whole job.
- Cap Azure at `--num-processes 3` to reduce concurrent process spawning
(the macOS runner was using 4 xdist workers), lowering the spawn-race
probability and peak resource pressure.
- Cache downloads across runs: relocate CIBW_CACHE_PATH to a stable path
and add a Cache@2 task (interpreter downloads + per-worker test pip
caches live under it), cutting the network-download flake surface.
- Bump the Azure host interpreter to 3.13.
Assisted-by: ClaudeCode:claude-opus-4.8
* ci: stabilize iOS tests, bound rerun cost
An iOS run on Azure (build 9043) hung for the full 40-min pytest timeout
on the second build config of test_ios_platforms, then reran twice
(reruns=2), blowing past the 180-min job cap with no useful signal. The
hang was a stuck simulator/xcodebuild on the second config, after the
first config had run.
- Shut down running simulators before each parametrized config via a
`clean_ios_simulators` fixture, so a simulator left booted/wedged by the
previous config isn't reused.
- Drop iOS reruns from 2 to 1. One retry still covers the documented
"fails the first time" simulator-boot flake, while halving the
worst-case retry cost (3x40=120min -> 2x40=80min) on a hang.
Assisted-by: ClaudeCode:claude-opus-4.8
* ci: don't limit num processes
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* ci: rerun OCI unit tests that pull from Docker Hub
test_local_image et al. occasionally fail on a transient Docker Hub
anonymous-pull blip ("unauthorized: authentication required") when
pulling debian:trixie-slim. The integration runs already self-heal via
pytest-rerunfailures, but the unit run had no reruns, so a single flake
failed the whole job. Mark the three network-dependent OCI tests
(test_local_image, test_enter_error, test_multiarch_image) flaky so they
retry instead of blanket-rerunning the suite.
Assisted-by: ClaudeCode:claude-opus-4.8
* Drop iOS clean step
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* ci: scope integration reruns to test_0_basic::test
Drop the blanket --reruns from the serial and non-serial integration
runs and instead mark test_0_basic.py::test as flaky, so only the known
flaky basic test is retried.
Assisted-by: ClaudeCode:claude-opus-4.8
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
`OCIContainer.__enter__` was hardened in #2879 to always clean up on
failure, but `__exit__` was left unguarded. If the container/bash had
already died, `bash_stdin.write("exit 0")` raises `BrokenPipeError`; if
bash refuses to exit, `process.wait(timeout=30)` raises `TimeoutExpired`.
Either propagated out of `__exit__` before `_remove_container()` ran,
leaking the container (and, on timeout, the `start` process too).
Wrap the teardown so a broken pipe or timeout instead forces the process
down (kill + wait) and always falls through to container removal, while
still respecting CIBW_DEBUG_KEEP_CONTAINER. Pipe closes are now also
guarded so a flush-on-close against a dead pipe can't mask cleanup.
Add non-docker unit tests for the clean-exit, already-dead-bash, and
shutdown-timeout paths.
Assisted-by: ClaudeCode:claude-opus-4.8
* fix: minor 4.0 issues in android validation, docs, and docstring
- android: raise a clear FatalError when ANDROID_API_LEVEL is not an
integer, instead of an uncaught ValueError deep in localized_vars
- docs: note that delvewheel is the default Windows repair-wheel-command
since 4.0 and how to skip it for platform-tagged wheels with no
extension module; update the now-outdated FAQ wording
- venv: fix _parse_pip_constraint_for_virtualenv docstring to say
marker-bearing constraints are evaluated against the host's default
environment (not skipped) when marker_env is None
Assisted-by: ClaudeCode:claude-opus-4.8
* fix: use int() with original error for ANDROID_API_LEVEL validation
Handle ANDROID_API_LEVEL validation via try/except around int() so the
original exception message is surfaced, and so non-ASCII Unicode digits
(which isdigit() accepts but int() may reject) are handled correctly.
Assisted-by: ClaudeCode:claude-opus-4.8
* refactor: address reivew by moving error catch
Assisted-by: ClaudeCode:claude-opus-4.8
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: detect musl libc when downloading python-build-standalone
`platform.libc_ver()` only ever reports glibc and returns `("", "")` on
musl systems, so `"musl" in platform.libc_ver()` was never true and musl
hosts (e.g. Alpine) always selected the `gnu` python-build-standalone
asset, which won't run.
Detect musl by shelling out to `ldd --version`, which prints "musl libc"
on musl-based systems. This probes the actual system loader rather than
the host Python's linkage, so it stays correct even when cibuildwheel
runs under a relocatable/statically-linked interpreter. Falls back to
glibc when `ldd` is unavailable.
Assisted-by: ClaudeCode:claude-opus-4.8
* test: add type annotations to satisfy mypy and ruff
Assisted-by: ClaudeCode:claude-opus-4.8
The linux32 sanity check added in #2880 omitted `*platform_args`, unlike
the surrounding `uname -m` probes and the `create` command. On the i386
fallback path `platform_args` is reassigned to AMD64, so without
forwarding it the check could run against a different image variant than
the one actually built (e.g. on a multi-platform/containerd backend),
making the check meaningless or pulling the wrong variant.
Assisted-by: ClaudeCode:claude-opus-4.8
* Try to fix the problem with py trying to execute the shebang
* run whenever the branch name starts with gitlab
* Modernise GitLab CI config
- Windows: remove stale servercore:1809 image and choco install
(runners are now Windows 2022 VMs with Python 3.13 pre-installed)
- macOS: update deprecated macos-14-xcode-15 to macos-15-xcode-16
- Linux: bump Python image from 3.12 to 3.13
- All jobs: also run on gitlab* branches with CIBW_ENABLE=all
Generated with the help of AI (Amp/Claude Opus 4.7)
Amp-Thread-ID: https://ampcode.com/threads/T-019e6496-f89a-74e7-9f6b-655574290e68
Co-authored-by: Amp <amp@ampcode.com>
* ci: exclude graalpy on GitLab Windows runners
GraalPy is JVM-based and slow to start; on the small (2-core) GitLab
SaaS Windows runners, virtualenv's interpreter query for graalpy.exe
times out, failing test_0_basic::test[pip]. Restrict the Windows job's
CIBW_ENABLE to all groups except graalpy (other platforms keep "all").
CIBW_ENABLE rather than CIBW_SKIP is used so the test's expected-wheel
set (derived from CIBW_ENABLE) stays consistent with what is built.
Assisted-by: ClaudeCode:claude-opus-4.8
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Amp <amp@ampcode.com>
Co-authored-by: Henry Schreiner <henryfs@princeton.edu>
This was the case when running `nox -s tests -- --run-podman -v -s 'unit_test/oci_container_test.py::test_multiarch_image[podman-OCIPlatform.i386]'` on macOS arm64.
* fix: ensure clean-up on container start failure and warn on removal failure
Properly release resources on container start failure.
If we fail to remove the created container, warn when not running in CI.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: add unit tests for `OCIContainer._get_platform_args`
While this was already tested indirectly through `test_local_image`, this makes the behaviour check of `OCIContainer._get_platform_args` clear.
* fix: re-add `check=False` removed at some point in local testing
* feat: add SHA256 verification for direct downloads
Store SHA256 hashes when running update scripts and verify them
when downloading files at build time. This improves security by
detecting unexpected changes to downloaded artifacts.
Platforms covered: macOS (CPython, PyPy, GraalPy), iOS, Android,
virtualenv, and python-build-standalone. Windows (nuget) and
Linux (Docker) are excluded.
SHA256 sources per platform:
- macOS/iOS/Android CPython (python.org): sha256_sum from API
- GraalPy: .sha256 sidecar assets from GitHub releases
- python-build-standalone: SHA256SUMS file in release
- PyPy, BeeWare iOS, Maven (Chaquopy): stream-download and compute
Changes:
- cibuildwheel/util/file.py: add sha256 param to download()
- cibuildwheel/platforms/{macos,ios,android}.py: add sha256 to
PythonConfiguration and pass to download()
- cibuildwheel/venv.py: read sha256 from toml and pass to download()
- cibuildwheel/util/python_build_standalone.py: add sha256 to
PythonBuildStandaloneAsset and pass to download()
- cibuildwheel/resources/build-platforms.toml: add sha256 fields
- cibuildwheel/resources/virtualenv.toml: add sha256 field
- cibuildwheel/resources/python-build-standalone-releases.json: add sha256
- bin/update_pythons.py: compute/store sha256 per source strategy
- bin/update_virtualenv.py: compute sha256 by streaming download
- bin/update_python_build_standalone.py: parse SHA256SUMS file
Closes#908
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
* fix: populate sha256 in resource files and fix Windows PythonConfiguration
- Add sha256 field to Windows PythonConfiguration (PyPy/GraalPy have
direct download URLs on Windows too)
- Pass sha256 to install_pypy() and install_graalpy() in windows.py
- Fix update_pythons.py: handle empty sha256 from CPython API (older
versions) by streaming download to compute it; fix condition to
check 'not sha256' rather than 'not in dict'
- Fix update_virtualenv.py: compute sha256 even when version unchanged
but sha256 is empty (first-time population)
- Fix update_python_build_standalone.py: resolve file path relative to
the script itself (not the installed package) so writes go to source
checkout, not the uv cache
- Populate actual sha256 values by running all three update scripts
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6
* fix: also include pyodide
Assisted-by: CopilotCLI:gpt-5.3-codex
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: PR review comments for cache verification and docs wording
Co-authored-by: henryiii <4616906+henryiii@users.noreply.github.com>
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* fix: require sha256 for download configs
Require sha256 for URL-backed Python and virtualenv download configs. Update the GraalPy updater to refresh macOS x86_64 entries by selecting the latest release that still has a matching asset, and fill the two missing GraalPy checksums in build-platforms.toml.
Assisted-by: CopilotCLI:gpt-5.4
* ci: remove unit test for bin item
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* refactor: combine sha256 unit tests into test_sha256.py
Merge pyodide_test.py and python_build_standalone_test.py into a
single unit_test/test_sha256.py since both test sha256-related
behaviour.
Assisted-by: opencode:glm-5
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: henryiii <4616906+henryiii@users.noreply.github.com>
Since delvewheel is now the default repair-wheel-command on Windows,
update all places where auditwheel/delocate were referenced but
delvewheel was missing:
- diagram.html: add delvewheel repair block for Windows (was grouped
with ios/pyodide as optional dot)
- generate_schema.py: add Windows delvewheel default to the platform
loop so schema.json includes the default
- schema.json: regenerated with Windows delvewheel default
- options.md: add Windows to defaults list, remove outdated tip about
delvewheel being early-stage/optional, update examples
- contributing.md: add delvewheel to the tool list
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* feat: add CIBUILDWHEEL_BUILD_IDENTIFIER environment variable
Set `CIBUILDWHEEL_BUILD_IDENTIFIER` to the current build identifier
(e.g. `cp311-manylinux_x86_64`) in the environment for all per-build
steps: `before_build`, the build itself, `repair_command`,
`before_test`, and `test_command`.
This allows scripts and commands to inspect which build is currently
running, which is useful for e.g. writing per-build output files:
CIBW_TEST_COMMAND='pytest --junit-xml=results-$CIBUILDWHEEL_BUILD_IDENTIFIER.xml'
The variable is set after the user's environment overrides are applied
and is only available for per-build steps (not `before_all`, where no
single identifier applies). All six platforms are covered: linux, macOS,
Windows, pyodide, Android, and iOS.
Closes#944, closes#2750
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: OpenCode:claude-sonnet-4.6
* fix: address review comment moving this for Android
Assisted-by: OpenCode:glm-5.1
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Use auditwheel on Android
* Add auditwheel command to defaults
* pkgconfig fixes
* Pre-import ctypes before monkey-patching in _cross_venv
* Set PKG_CONFIG and PKG_CONFIG_RELOCATE_PATHS variables
* Initial attempt at using mzakharo/android-gfortran
* Switch to using termux/ndk-toolchain-clang-with-flang
* Move PKG_CONFIG variables from build_env to android_env
* Simplify flang installation
* Add cross build files for NumPy
* Add ldpaths entry for libomp
* Add `--rm` to docker command line
* Make Rust and Fortran shims consistent
* Update documentation
* Default to API level 24 on all Python versions
* Clarify comments
* Cleanups
* Fix tests:
* Set up Android env after installing pkgconf
* Add tests for successfully using an older API level
* Previous commit's auditwheel failure is fixed in the auditwheel PR
* Update how-it-works diagram
* Add tests for repair errors
* Add more repair tests
* Add test for Meson and Fortran
* Add test for cross build files
* Improve test_api_level error message
* Add xbuild-files option
* use pypa/auditwheel@main
* Remove dependencies which are no longer needed
* Fix README
* Update to auditwheel 6.7.0
* Fix compatibility with pkgconf 2.5.1.post2
* Documentation clarifications
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Fortran shim improvements
* Add Jinja variables to new_meson_project
* Update run_example_ci_configs for changed new_meson_project signature
* Add missing dependency to run_example_ci_configs
---------
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
Co-authored-by: Joe Rickerby <joerick@mac.com>
Malcolm Smith