Bump version: v4.0.0

Drops the GraalPy 3.11 / GraalPy 24.2 builds (gp311_242) as agreed in
pypa/cibuildwheel#2741: a ~6-month overlap after the GraalPy 25 (gp312)
release. GraalPy 3.12 (gp312_250) stays.

This also removes the GraalPy 24-only workarounds that were explicitly
marked "Remove when GraalPy 24.x is dropped":
- the Visual Studio compiler-discovery (vswhere) and build-isolation
  (graalpython#491) workarounds in the Windows backend
- the issue-491 Windows skip/filter hacks in test_pep518 and
  test_dependency_versions (added in the original GraalPy PR #1538 and
  unneeded since GraalPy 25 per #2597)

The uv-doesn't-support-graalpy skip (#2754), the `graalpy` enable group,
and the generated constraints pins apply to all GraalPy and are kept.

Assisted-by: ClaudeCode:claude-opus-4.8

.github/workflows/test.yml

@@ -139,7 +139,7 @@ jobs:
     # for oci_container unit tests
     - name: Set up QEMU
       if: runner.os == 'Linux'
-      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
     - name: Set up Xcode
       if: ${{ startsWith(matrix.os, 'macos-15') }}
@@ -283,7 +283,7 @@ jobs:
       run: uv sync --no-dev --group test
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
     - name: Run the emulation tests
       env:

.gitlab-ci.yml

@@ -1,5 +1,5 @@
 linux:
-  image: python:3.12
+  image: python:3.13
   services:
     - name: docker:dind
       entrypoint: ["env", "-u", "DOCKER_HOST"]
@@ -14,7 +14,7 @@ linux:
     # (comment the below line in a PR to debug a Gitlab-specific issue)
     PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
   rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
       variables:
         CIBW_ENABLE: "all"
   script:
@@ -25,28 +25,29 @@ linux:
     - python ./bin/run_tests.py
 
 windows:
-  image: mcr.microsoft.com/windows/servercore:1809
   variables:
     PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
-  before_script:
-    - choco install python -y --allow-downgrade --version 3.12.4
   rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
       variables:
-        CIBW_ENABLE: "all"
+        # Everything except graalpy. GraalPy is JVM-based and very slow to
+        # start; on the small (2-core) GitLab SaaS Windows runners,
+        # virtualenv's interpreter query for graalpy.exe times out, failing
+        # the build. (Other platforms run the full "all" group.)
+        CIBW_ENABLE: "cpython-prerelease pypy pypy-eol pyodide-eol pyodide-prerelease"
   script:
-    - py -m pip install -U pip
-    - py -m pip install -e. pytest-custom-exit-code --group test
-    - py bin\run_tests.py
+    - python -m pip install -U pip
+    - python -m pip install -e. pytest-custom-exit-code --group test
+    - python bin\run_tests.py
   tags:
     - saas-windows-medium-amd64
 
 macos:
-  image: macos-14-xcode-15
+  image: macos-15-xcode-16
   variables:
     PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
   rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
       variables:
         CIBW_ENABLE: "all"
   script:

.pre-commit-config.yaml

@@ -18,14 +18,14 @@ repos:
     exclude: ^cibuildwheel/resources/android/android.patch$
 
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: 0c7b6c989466a93942def1f84baf36ddfcd60c83  # frozen: v0.15.14
+  rev: 0671d8ab202c4ac093b78433ae5baf74f3fc7246  # frozen: v0.15.15
   hooks:
   - id: ruff-check
     args: ["--fix"]
   - id: ruff-format
 
 - repo: https://github.com/pre-commit/mirrors-mypy
-  rev: fc0f09a29bb495f4a91f00266155d6282d52485d  # frozen: v1.20.2
+  rev: d2823d321df3af8f878f7ee3414dc94d037145b9  # frozen: v2.1.0
   hooks:
   - id: mypy
     name: mypy 3.11 on cibuildwheel/
@@ -39,7 +39,6 @@ repos:
       - nox>=2025.2.9
       - orjson
       - packaging
-      - pyelftools
       - pygithub
       - pytest
       - rich

README.md

@@ -34,7 +34,6 @@ While cibuildwheel itself requires a recent Python version to run (we support th
 | PyPy 3.9 v7.3            | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 | PyPy 3.10 v7.3           | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 | PyPy 3.11 v7.3           | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
-| GraalPy 3.11 v24.2       | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | N/A                          | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 | GraalPy 3.12 v25.0       | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | N/A                          | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 
 <sup>**1** PyPy & GraalPy are only supported for manylinux wheels.</sup><br>
@@ -100,7 +99,7 @@ jobs:
       - uses: actions/setup-python@v6
 
       - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==4.0.0rc1
+        run: python -m pip install cibuildwheel==4.0.0
 
       - name: Build wheels
         run: python -m cibuildwheel --output-dir wheelhouse
@@ -152,6 +151,7 @@ The following diagram summarises the steps that cibuildwheel takes on each platf
 |  | [`before-all`](https://cibuildwheel.pypa.io/en/stable/options/#before-all) | Execute a shell command on the build system before any wheels are built. |
 |  | [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) | Execute a shell command preparing each wheel's build |
 |  | [`xbuild-tools`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-tools) | Binaries on the path that should be included in an isolated cross-build environment. |
+|  | [`xbuild-files`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files) | Platform-specific files in the build environment |
 |  | [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command) | Execute a shell command to repair each built wheel |
 |  | [`manylinux-*-image`<br>`musllinux-*-image`](https://cibuildwheel.pypa.io/en/stable/options/#linux-image) | Specify manylinux / musllinux container images |
 |  | [`container-engine`](https://cibuildwheel.pypa.io/en/stable/options/#container-engine) | Specify the container engine to use when building Linux wheels |
@@ -173,7 +173,7 @@ The following diagram summarises the steps that cibuildwheel takes on each platf
 |  | [`build-verbosity`](https://cibuildwheel.pypa.io/en/stable/options/#build-verbosity) | Increase/decrease the output of the build |
 
 
-<!--[[[end]]] (sum: b7YIjCyCkf) -->
+<!--[[[end]]] (sum: Of/28Z7Nut) -->
 
 These options can be specified in a pyproject.toml file, or as environment variables, see [configuration docs](https://cibuildwheel.pypa.io/en/latest/configuration/).
 
@@ -240,33 +240,60 @@ Changelog
 
 <!-- [[[cog from readme_changelog import mini_changelog; print(mini_changelog()) ]]] -->
 
-### v4.0.0rc1
+### v4.0.0
 
-_14 May 2026_
+_7 June 2026_
+
+See @henryiii's [release post](https://iscinumpy.dev/post/cibuildwheel-4-0-0/) for more info on new features!
 
 - 🌟 Adds wheel auditing with `abi3audit` as a default after the repair step, with new [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) and [`audit-command`](https://cibuildwheel.pypa.io/en/stable/options/#audit-command) options (#2805)
-- 🌟 Adds `pyemscripten` platform tag support (PEP 783), updates Pyodide to 314.0.0a1, and adds a `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) flag for building end-of-life Pyodide versions (#2812, #2848)
+- 🌟 Adds `pyemscripten` platform tag support (PEP 783), updates Pyodide to 314.0.0a2, and adds a `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) flag for building end-of-life Pyodide versions (#2812, #2848)
 - 🌟 Sets up `delvewheel` as the default [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command) for Windows, so extension module DLLs are now bundled automatically. Skip by setting it to empty if not needed. (#2831)
 - ✨ Adds CPython 3.15 support, under the [`enable` option](https://cibuildwheel.pypa.io/en/stable/options/#enable) `cpython-prerelease`. This version of cibuildwheel uses 3.15.0b1. (#2833, #2850)
 
-    _While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.14 will be available in cibuildwheel without the flag._ (#2390)
+    _While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.15 will be available in cibuildwheel without the flag._
+- ✨ Adds CPython 3.15 support for iOS and Android (#2857, #2858)
+- ✨ Adds Android improvements for building NumPy and related packages, including auditwheel support, pkg-config and Fortran configuration, and the [`xbuild-files`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files) option (#2695)
+- ✨ Adds `CIBUILDWHEEL_BUILD_IDENTIFIER` environment variable set to the current build identifier (e.g. `cp311-manylinux_x86_64`) during per-build steps (#2872)
 - ✨ Adds `{project}` and `{package}` placeholders to [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) (#2827)
 - ⚠️ Drops support for Python 3.8 (#2686)
 - ⚠️ Removes the experimental CPython 3.13 free-threading builds and the `cpython-freethreading` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) option. CPython 3.14+ free-threading support remains available without the enable flag. (#2684)
 - ⚠️ Drops support for Cirrus CI, which is shutting down June 1, 2026 (#2817)
+- ⚠️ Drops GraalPy 3.11 (gp311) support, as agreed in #2741, and removes GraalPy 24-only workarounds (#2895)
+- 🔐 Adds SHA256 verification for direct downloads of Python interpreters, virtualenv, and python-build-standalone assets (#2873)
+- 🔐 Adds tarfile extraction filter for safe archive extraction (#2856)
 - 🐛 Fixes `UV_PYTHON` not being set for [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) on Linux when using `uv` as the [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) (#2830)
+- 🐛 Fixes detection of musl libc when downloading python-build-standalone, which previously always selected the gnu asset on musl hosts like Alpine (#2889)
+- 🐛 Fixes [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) expansion when `{project}` or `{package}` contains spaces or backslashes (#2886)
+- 🐛 Prevents deadlock when `linux32` fails and forwards platform args to the sanity check (#2880, #2888)
+- 🐛 Fixes container resource leaks on start failure and during teardown (#2879, #2887)
+- 🐛 Removes potential partial cache-population in case of error (#2892)
+- 🐛 Raises a clear error when `ANDROID_API_LEVEL` is not an integer (#2891)
+- 🐛 Replaces assert with proper exception in python-build-standalone (#2859)
+- 🐛 Uses ConfigurationError when `package_dir` is outside cwd instead of a generic Exception (#2898)
+- 🛠 Updates dependencies and container pins (#2893, #2882, #2874, #2868, #2862, #2884, #2845, #2837, #2818, #2810, #2838, #2813)
 - 🛠 Updates Android to Python 3.13.13 and 3.14.4 (#2821)
 - 🛠 Applies Pyodide-specific patches to the Emscripten toolchain installation (#2800)
-- 🛠 Updates dependencies and container pins (#2845, #2837, #2821, #2818, #2810, #2838, #2813)
 - 🛠 Uses `python -V -V` for Windows build diagnostics (#2832)
+- 🛠 Simplifies pinned container image lookup (#2897)
+- 🛠 Minor fixups across error messages, OCI container, and options (#2860)
+- 💼 Adds PEP 723 metadata for `bin/` scripts and drops the `bin` dependency group (#2819)
+- 💼 Improves Azure test reliability with retries and caching (#2890)
+- 💼 Fixes Windows GitLab CI test running (#2870)
+- 💼 Updates CI action pins and dev dependencies (#2902, #2867, #2851, #2843, #2826, #2823, #2820, #2807)
+- 💼 Adds agent and copilot setup files (#2861)
+- 💼 Uses `if TYPE_CHECKING:` blocks (#2866, #2864)
+- 🧪 Fixes Android tests using the `uv` frontend (#2809)
+- 🧪 Fixes the update-dependencies workflow to use `uv` to run `nox` (#2808)
+- 🧪 Adds unit tests for `OCIContainer._get_platform_args` (#2878)
+- 📚 Updates documentation for delvewheel as the default Windows [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command), including the build diagram, schema defaults, and legal note (#2877, #2853, #2891)
 - 📚 Documents platform-specific [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) configuration (#2834)
 - 📚 Updates the "How it works" diagram with details of Android, iOS, and Pyodide builds (#2816)
 - 📚 Adds Pyodide icon and regenerates working examples data for Android, iOS, and Pyodide (#2815, #2811)
+- 📚 Adds intersphinx support for external documentation linking (#2871)
+- 📚 Adds instructions for building CUDA wheels and fixes manylinux container references in FAQ (#2896, #2900)
 - 📚 Links back to source in docs (#2806)
-- 💼 Adds PEP 723 metadata for `bin/` scripts and drops the `bin` dependency group (#2819)
-- 💼 Updates CI action pins and dev dependencies (#2851, #2843, #2826, #2823, #2820, #2807)
-- 🧪 Fixes Android tests using the `uv` frontend (#2809)
-- 🧪 Fixes the update-dependencies workflow to use `uv` to run `nox` (#2808)
+- 📚 Removes outdated numpy info (#2855)
 
 
 ### v3.4.1
@@ -311,7 +338,7 @@ _12 November 2025_
 - 🛠 Improve the handling of `test-command` on Android, enabling more options to be passed (#2590)
 - 📚 Docs improvements (#2618)
 
-<!-- [[[end]]] (sum: ZD0EjcyC0B) -->
+<!-- [[[end]]] (sum: B1EtXSS7u7) -->
 
 ---
 

azure-pipelines.yml

@@ -19,39 +19,54 @@ jobs:
 - job: tests
   strategy:
     matrix:
-      linux_311:
+      linux_313:
         imageName: "ubuntu-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "native"
-      android_311:
+      android_313:
         imageName: "ubuntu-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "android"
-      macos_311:
+      macos_313:
         imageName: "macos-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "native"
-      ios_311:
+      ios_313:
         imageName: "macos-14"  # See https://github.com/actions/runner-images/issues/12777
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "ios"
-      android_macos_311:
+      android_macos_313:
         imageName: "macos-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "android"
-      windows_311:
+      windows_313:
         imageName: "windows-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "native"
   timeoutInMinutes: 180
   pool:
     vmImage: $(imageName)
+  variables:
+    # Relocate cibuildwheel's download cache (interpreters) and the per-worker
+    # test pip caches (which live under it) to a stable, cacheable path.
+    CIBW_CACHE_PATH: $(Pipeline.Workspace)/.cibw-cache
 
   steps:
     - task: UsePythonVersion@0
       inputs:
         versionSpec: $(pythonVersion)
 
+    - task: Cache@2
+      displayName: 'Cache cibuildwheel downloads'
+      inputs:
+        # build-platforms.toml carries the interpreter pins; bump the version
+        # prefix to force a cold cache. restoreKeys lets a stale cache still seed
+        # a new run (cibuildwheel re-downloads only what's missing).
+        key: 'cibw-cache | v1 | "$(imageName)" | "$(testSelect)" | cibuildwheel/resources/build-platforms.toml'
+        restoreKeys: |
+          cibw-cache | v1 | "$(imageName)" | "$(testSelect)"
+        path: $(CIBW_CACHE_PATH)
+
     - task: JavaToolInstaller@0
       condition: and(eq(variables['testSelect'], 'android'), eq(variables['Agent.OS'], 'Linux'))
       inputs:

bin/generate_schema.py

@@ -15,6 +15,8 @@ parser = argparse.ArgumentParser(allow_abbrev=False)
 parser.add_argument("--schemastore", action="store_true", help="Generate schema_store version")
 args = parser.parse_args()
 
+# The defaults in the schema are used by external tools for validation and IDE support. They
+# should match the values in defaults.toml, which are used by cibuildwheel itself.
 starter = """
 $schema: http://json-schema.org/draft-07/schema#
 $id: https://github.com/pypa/cibuildwheel/blob/main/cibuildwheel/resources/cibuildwheel.schema.json
@@ -200,6 +202,9 @@ properties:
   xbuild-tools:
     description: Binaries on the path that should be included in an isolated cross-build environment
     type: string_array
+  xbuild-files:
+    description: Platform-specific files in the build environment
+    type: string_table_array
   pyodide-version:
     type: string
     description: Specify the version of Pyodide to use
@@ -319,6 +324,7 @@ items:
         before-all: {"$ref": "#/$defs/inherit"}
         before-build: {"$ref": "#/$defs/inherit"}
         xbuild-tools: {"$ref": "#/$defs/inherit"}
+        xbuild-files: {"$ref": "#/$defs/inherit"}
         before-test: {"$ref": "#/$defs/inherit"}
         config-settings: {"$ref": "#/$defs/inherit"}
         container-engine: {"$ref": "#/$defs/inherit"}
@@ -374,14 +380,16 @@ oses = {
     "ios": as_object(not_linux),
 }
 
-oses["linux"]["properties"]["repair-wheel-command"] = {
+for os_name, command in [
+    ("linux", "auditwheel repair -w {dest_dir} {wheel}"),
+    ("windows", "delvewheel repair -w {dest_dir} -v {wheel}"),
+    ("macos", "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}"),
+    ("android", "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"),
+]:
+    oses[os_name]["properties"]["repair-wheel-command"] = {
         **schema["properties"]["repair-wheel-command"],
-    "default": "auditwheel repair -w {dest_dir} {wheel}",
-}
-oses["macos"]["properties"]["repair-wheel-command"] = {
-    **schema["properties"]["repair-wheel-command"],
-    "default": "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}",
-}
+        "default": command,
+    }
 
 del oses["linux"]["properties"]["dependency-versions"]
 

bin/run_example_ci_configs.py

@@ -3,6 +3,7 @@
 # /// script
 # dependencies = [
 #   "click",
+#   "jinja2",
 # ]
 # ///
 
@@ -39,13 +40,16 @@ def generate_project(path: Path, build_backend: BuildBackend) -> None:
     sys.path.insert(0, "")
     match build_backend:
         case "meson":
-            from test.test_projects.meson import new_meson_project as new_project  # noqa: PLC0415
+            from test.test_projects.meson import new_meson_project  # noqa: PLC0415
+
+            project = new_meson_project()
         case "setuptools":
-            from test.test_projects.setuptools import new_c_project as new_project  # noqa: PLC0415
+            from test.test_projects.setuptools import new_c_project  # noqa: PLC0415
+
+            project = new_c_project()
         case _:
             typing.assert_never(build_backend)
 
-    project = new_project()
     project.generate(path)
 
 

bin/update_python_build_standalone.py

@@ -3,6 +3,7 @@
 # /// script
 # dependencies = [
 #   "cibuildwheel",
+#   "requests",
 # ]
 #
 # [tool.uv.sources]
@@ -10,13 +11,23 @@
 # ///
 
 import json
+from pathlib import Path
+from typing import Final
+
+import requests
 
 from cibuildwheel.extra import github_api_request
 from cibuildwheel.util.python_build_standalone import (
     PythonBuildStandaloneAsset,
     PythonBuildStandaloneReleaseData,
 )
-from cibuildwheel.util.resources import PYTHON_BUILD_STANDALONE_RELEASES
+
+# Resolve path relative to this script so writes go to the source checkout,
+# not the uv-installed copy of the package.
+DIR: Final[Path] = Path(__file__).parent.parent.resolve()
+PYTHON_BUILD_STANDALONE_RELEASES: Final[Path] = (
+    DIR / "cibuildwheel/resources/python-build-standalone-releases.json"
+)
 
 
 def main() -> None:
@@ -34,8 +45,27 @@ def main() -> None:
         f"repos/astral-sh/python-build-standalone/releases/tags/{latest_tag}"
     )["assets"]
 
+    # Build a sha256 map from the SHA256SUMS file in the release
+    sha256_sums_urls = [
+        ga["browser_download_url"] for ga in github_assets if ga["name"] == "SHA256SUMS"
+    ]
+    name_to_sha256: dict[str, str] = {}
+    if sha256_sums_urls:
+        response = requests.get(sha256_sums_urls[0])
+        response.raise_for_status()
+        for line in response.text.splitlines():
+            parts = line.split()
+            if len(parts) == 2:
+                sha256_hex, filename = parts
+                # The filename may have a leading "./" or spaces - strip it
+                name_to_sha256[filename.lstrip("./")] = sha256_hex
+
     assets = [
-        PythonBuildStandaloneAsset(name=ga["name"], url=ga["browser_download_url"])
+        PythonBuildStandaloneAsset(
+            name=ga["name"],
+            url=ga["browser_download_url"],
+            sha256=name_to_sha256.get(ga["name"], ""),
+        )
         for ga in github_assets
         if ga["name"].endswith("install_only.tar.gz")
     ]

bin/update_pythons.py

@@ -15,12 +15,13 @@
 from __future__ import annotations
 
 import difflib
+import hashlib
 import logging
 import operator
 import re
 import tomllib
 from pathlib import Path
-from typing import Any, Final, Literal, TypedDict
+from typing import Any, Final, Literal, NotRequired, TypedDict
 from xml.etree import ElementTree as ET
 
 import click
@@ -56,11 +57,13 @@ class Config(TypedDict):
 
 class ConfigUrl(Config):
     url: str
+    sha256: NotRequired[str]
 
 
 class ConfigPyodide(Config):
     default_pyodide_version: str
     node_version: str
+    sha256: str
 
 
 # The following set of "Versions" classes allow the initial call to the APIs to
@@ -155,10 +158,6 @@ class GraalPyVersions:
             msg = f"GraalPy {arch} not found for {spec}!"
             raise RuntimeError(msg)
 
-        release = releases[-1]
-        version = release["python_version"]
-        gpversion = release["graalpy_version"]
-
         if "macosx" in identifier:
             arch = "x86_64" if "x86_64" in identifier else "arm64"
             platform = "macos"
@@ -171,19 +170,38 @@ class GraalPyVersions:
 
         arch = "amd64" if arch == "x86_64" else "aarch64"
         ext = "zip" if "win" in identifier else "tar.gz"
+        for release in reversed(releases):
+            version = release["python_version"]
+            gpversion = release["graalpy_version"]
             urls = [
                 rf["browser_download_url"]
                 for rf in release["assets"]
                 if rf["name"].endswith(f"{platform}-{arch}.{ext}")
                 and rf["name"].startswith(f"graalpy-{gpversion.major}")
             ]
-        if urls:
+            if not urls:
+                continue
+
             (url,) = urls
+            # Fetch sha256 from the ".sha256" sidecar asset in the same release.
+            sha256 = ""
+            sha256_asset_name = url.rsplit("/", 1)[-1] + ".sha256"
+            sha256_urls = [
+                rf["browser_download_url"]
+                for rf in release["assets"]
+                if rf["name"] == sha256_asset_name
+            ]
+            if sha256_urls:
+                sha256_response = requests.get(sha256_urls[0])
+                sha256_response.raise_for_status()
+                sha256 = sha256_response.text.strip().split()[0]
             return ConfigUrl(
                 identifier=identifier,
                 version=f"{version.major}.{version.minor}",
                 url=url,
+                sha256=sha256,
             )
+
         return None
 
 
@@ -298,12 +316,14 @@ class CPythonVersions:
             uri = self.versions_dict[new_version]
             files = [rf for rf in self.files_info if rf["release"] == uri]
 
-            urls = [rf["url"] for rf in files if file_ident in rf["url"]]
-            if urls:
+            matching = [rf for rf in files if file_ident in rf["url"]]
+            if matching:
+                rf = matching[0]
                 return ConfigUrl(
                     identifier=identifier,
                     version=f"{new_version.major}.{new_version.minor}",
-                    url=urls[0],
+                    url=rf["url"],
+                    sha256=rf.get("sha256_sum", ""),
                 )
 
         return None
@@ -420,6 +440,7 @@ class PyodideVersions:
             version=str(version),
             default_pyodide_version=release["version"],
             node_version=node_version,
+            sha256=release["sha256"],
         )
 
 
@@ -448,6 +469,16 @@ class AllVersions:
 
         self.pyodide = PyodideVersions()
 
+    def _stream_sha256(self, url: str) -> str:
+        """Download a file (streaming) and return its SHA256 hex digest."""
+        log.debug("Computing sha256 for %s by streaming download...", url)
+        response = requests.get(url, stream=True)
+        response.raise_for_status()
+        hasher = hashlib.sha256()
+        for chunk in response.iter_content(65536):
+            hasher.update(chunk)
+        return hasher.hexdigest()
+
     def update_config(self, config: MutableMapping[str, str]) -> None:
         identifier = config["identifier"]
         version = Version(config["version"])
@@ -465,8 +496,6 @@ class AllVersions:
                 elif "macosx_arm64" in identifier:
                     config_update = self.macos_pypy_arm64.update_version_macos(spec)
             elif identifier.startswith("gp"):
-                if "macosx_x86_64" in identifier:
-                    return
                 config_update = self.graalpy.update_version(identifier, spec)
         elif "t-win32" in identifier and identifier.startswith("cp"):
             config_update = self.windows_t_32.update_version_windows(spec)
@@ -505,6 +534,22 @@ class AllVersions:
             )
 
         assert config_update is not None, f"{identifier} not found!"
+
+        # Fill in sha256 for URL-based configs if not already provided by the
+        # update_version_* method (e.g. PyPy, BeeWare iOS, Maven have no sidecar).
+        # Also fills in sha256 when the CPython API doesn't return a sha256_sum
+        # (e.g. for older releases).
+        # Widen the type to allow arbitrary key access on the underlying dict.
+        config_update_dict: dict[str, str] = config_update  # type: ignore[assignment]
+        if "url" in config_update_dict and not config_update_dict.get("sha256"):
+            url = config_update_dict["url"]
+            existing_sha256 = config.get("sha256", "")
+            if url == config.get("url") and existing_sha256:
+                # URL unchanged — preserve the existing sha256
+                config_update_dict["sha256"] = existing_sha256
+            else:
+                config_update_dict["sha256"] = self._stream_sha256(url)
+
         if config_update != config:
             log.info("  Updated %s to %s", config, config_update)
             config.clear()

bin/update_virtualenv.py

@@ -4,6 +4,7 @@
 # dependencies = [
 #   "click",
 #   "packaging",
+#   "requests",
 #   "rich",
 #   "cibuildwheel",
 # ]
@@ -15,12 +16,14 @@
 
 import dataclasses
 import difflib
+import hashlib
 import logging
 import tomllib
 from pathlib import Path
 from typing import Final
 
 import click
+import requests
 import rich
 from packaging.version import Version
 from rich.logging import RichHandler
@@ -92,16 +95,29 @@ def update_virtualenv(force: bool, level: str) -> None:
     if latest_release.version > Version(local_version):
         version = latest_release.name
         url = latest_release.download_url
+        sha256 = ""  # recomputed below
     else:
         version = local_version
         url = default["url"]
+        sha256 = default["sha256"]
+
+    # Compute sha256 if not already stored (new version or first-time population)
+    if not sha256:
+        log.info("Computing sha256 for %s...", url)
+        response = requests.get(url, stream=True)
+        response.raise_for_status()
+        hasher = hashlib.sha256()
+        for chunk in response.iter_content(65536):
+            hasher.update(chunk)
+        sha256 = hasher.hexdigest()
 
     configurations["default"] = {
         "version": version,
         "url": url,
+        "sha256": sha256,
     }
     result_toml = "".join(
-        f'{key} = {{ version = "{value["version"]}", url = "{value["url"]}" }}\n'
+        f'{key} = {{ version = "{value["version"]}", url = "{value["url"]}", sha256 = "{value["sha256"]}" }}\n'
         for key, value in configurations.items()
     )
 

cibuildwheel/__init__.py

@@ -1 +1 @@
-__version__ = "4.0.0rc1"
+__version__ = "4.0.0"

cibuildwheel/extra.py

@@ -90,6 +90,7 @@ def github_api_request(path: str, *, max_retries: int = 3) -> dict[str, Any]:
 
 class PyodideXBuildEnvRelease(typing.TypedDict):
     version: str
+    sha256: str
     python_version: str
     emscripten_version: str
     min_pyodide_build_version: NotRequired[str]

cibuildwheel/frontend.py

@@ -62,7 +62,17 @@ def _split_config_settings(config_settings: str) -> list[str]:
 
 
 def prepare_config_settings(config_settings: str, *, project: PathOrStr, package: PathOrStr) -> str:
-    return prepare_command(config_settings, project=project, package=package)
+    # Substitute the {project}/{package} placeholders on each already-split
+    # token rather than on the raw string. A substituted path may contain
+    # spaces or backslashes (e.g. a Windows `{package}` path), and the result
+    # is later re-parsed with shlex.split (in _split_config_settings /
+    # parse_config_settings) — substituting on the whole string would let
+    # those characters be reinterpreted, splitting one setting into several or
+    # eating backslashes. shlex.join re-quotes each token so the round-trip is
+    # lossless.
+    settings = shlex.split(config_settings)
+    prepared = [prepare_command(setting, project=project, package=package) for setting in settings]
+    return shlex.join(prepared)
 
 
 # Based on build.__main__.main.

cibuildwheel/oci_container.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import contextlib
 import dataclasses
 import io
 import json
@@ -206,7 +207,6 @@ class OCIContainer:
 
     UTILITY_PYTHON = "/opt/python/cp39-cp39/bin/python"
 
-    process: subprocess.Popen[bytes]
     bash_stdin: IO[bytes]
     bash_stdout: IO[bytes]
 
@@ -226,6 +226,7 @@ class OCIContainer:
         self.oci_platform = oci_platform
         self.cwd = cwd
         self.name: str | None = None
+        self.process: subprocess.Popen[bytes] | None = None
         self.engine = engine
         self.host_tar_format = ""
         if sys.platform.startswith("darwin"):
@@ -257,10 +258,12 @@ class OCIContainer:
                 # this allows to run local only images
                 pull = "never"
         except subprocess.CalledProcessError:
+            # silently fallback to "--pull=always"
             pass
         return f"--platform={oci_platform.value}", f"--pull={pull}"
 
     def __enter__(self) -> Self:
+        assert self.process is None
         self.name = f"cibuildwheel-{uuid.uuid4()}"
 
         _check_engine_version(self.engine)
@@ -296,7 +299,17 @@ class OCIContainer:
                     ).strip()
                 else:
                     raise
-            simulate_32_bit = container_machine not in {"i686", "armv7l", "armv8l"}
+            if container_machine not in {"i686", "armv7l", "armv8l"}:
+                simulate_32_bit = True
+                # sanity check to ensure no deadlock waiting for container to start
+                call(
+                    *run_cmd,
+                    *platform_args,
+                    self.image,
+                    "linux32",
+                    "/bin/true",
+                    capture_stdout=True,
+                )
 
         shell_args = ["linux32", "/bin/bash"] if simulate_32_bit else ["/bin/bash"]
 
@@ -318,6 +331,7 @@ class OCIContainer:
             check=True,
         )
 
+        try:
             self.process = subprocess.Popen(
                 [
                     self.engine.name,
@@ -343,7 +357,15 @@ class OCIContainer:
                 # does not exist, podman does not. There does not seem to be a way
                 # to setup a workdir for a container running in podman.
                 self.call(["mkdir", "-p", os.fspath(self.cwd)], cwd="/")
-
+        except BaseException:
+            # clean-up
+            if self.process is not None:
+                if self.process.poll() is None:
+                    self.process.kill()
+                self.process.communicate()
+            self.process = None
+            self._remove_container()
+            raise
         return self
 
     def __exit__(
@@ -352,28 +374,51 @@ class OCIContainer:
         exc_val: BaseException | None,
         exc_tb: TracebackType | None,
     ) -> None:
+        assert self.process is not None
+        try:
+            # Ask bash to exit cleanly and wait for the `start` process to finish.
+            # If the container/bash has already died, the write raises
+            # BrokenPipeError; if bash refuses to exit, `wait` raises
+            # TimeoutExpired. Both are handled below so we always reach the
+            # cleanup in `finally` rather than leaking the process or container.
             self.bash_stdin.write(b"exit 0\n")
             self.bash_stdin.flush()
             self.process.wait(timeout=30)
-        self.bash_stdin.close()
-        self.bash_stdout.close()
 
             if self.engine.name == "podman":
-            # This works around what seems to be a race condition in the podman
-            # backend. The full reason is not understood. See PR #966 for a
-            # discussion on possible causes and attempts to remove this line.
-            # For now, this seems to work "well enough".
+                # This works around what seems to be a race condition in the
+                # podman backend. The full reason is not understood. See PR #966
+                # for a discussion on possible causes and attempts to remove this
+                # line. For now, this seems to work "well enough".
                 self.process.wait()
-
-        assert isinstance(self.name, str)
+        except (OSError, subprocess.TimeoutExpired):
+            # bash didn't shut down cleanly; force the process down so it isn't
+            # leaked, then continue to cleanup.
+            if self.process.poll() is None:
+                self.process.kill()
+                self.process.wait()
+        finally:
+            with contextlib.suppress(OSError):
+                self.bash_stdin.close()
+            with contextlib.suppress(OSError):
+                self.bash_stdout.close()
+            self.process = None
 
             keep_container = strtobool(os.environ.get("CIBW_DEBUG_KEEP_CONTAINER", ""))
             if not keep_container:
-            subprocess.run(
+                self._remove_container()
+
+    def _remove_container(self) -> None:
+        assert self.name is not None
+        result = subprocess.run(
             [self.engine.name, "rm", "--force", "-v", self.name],
             stdout=subprocess.DEVNULL,
             check=False,
         )
+        # only warn when not running in CI
+        if result.returncode != 0 and detect_ci_provider() is None:
+            msg = f"Failed to remove {self.name!r} container."
+            log.warning(msg)
         self.name = None
 
     def copy_into(self, from_path: Path, to_path: PurePath) -> None:

cibuildwheel/options.py

@@ -120,6 +120,7 @@ class BuildOptions:
     before_all: str
     before_build: str | None
     xbuild_tools: list[str] | None
+    xbuild_files: dict[str, list[str]]
     repair_command: str
     manylinux_images: dict[str, str] | None
     musllinux_images: dict[str, str] | None
@@ -772,6 +773,14 @@ class Options:
             if xbuild_tools == ["\u0000"]:
                 xbuild_tools = None
 
+            xbuild_files = parse_key_value_string(
+                self.reader.get(
+                    "xbuild-files",
+                    option_format=ShlexTableFormat(sep="; ", pair_sep=":", allow_merge=False),
+                ),
+                kw_arg_names=["*"],
+            )
+
             test_sources = shlex.split(
                 self.reader.get(
                     "test-sources", option_format=ListFormat(sep=" ", quote=shlex.quote)
@@ -871,11 +880,7 @@ class Options:
                         f"manylinux-{build_platform}-image", ignore_empty=True
                     )
                     self._check_pinned_image(config_value, pinned_images)
-                    if config_value in pinned_images:
-                        image = pinned_images[config_value]
-                    else:
-                        image = config_value
-                    manylinux_images[build_platform] = image
+                    manylinux_images[build_platform] = pinned_images.get(config_value, config_value)
 
                 for build_platform in MUSLLINUX_ARCHS:
                     pinned_images = all_pinned_container_images[build_platform]
@@ -883,11 +888,7 @@ class Options:
                         f"musllinux-{build_platform}-image", ignore_empty=True
                     )
                     self._check_pinned_image(config_value, pinned_images)
-                    if config_value in pinned_images:
-                        image = pinned_images[config_value]
-                    else:
-                        image = config_value
-                    musllinux_images[build_platform] = image
+                    musllinux_images[build_platform] = pinned_images.get(config_value, config_value)
 
             container_engine_str = self.reader.get(
                 "container-engine",
@@ -925,6 +926,7 @@ class Options:
                 before_all=before_all,
                 build_verbosity=build_verbosity,
                 xbuild_tools=xbuild_tools,
+                xbuild_files=xbuild_files,
                 repair_command=repair_command,
                 environment=environment,
                 dependency_constraints=dependency_constraints,

cibuildwheel/platforms/android.py

@@ -1,16 +1,13 @@
 from __future__ import annotations
 
-import csv
-import hashlib
 import os
 import platform
 import re
 import shlex
 import shutil
 import subprocess
-import sysconfig
+import sys
 from dataclasses import dataclass
-from os.path import relpath
 from pathlib import Path
 from pprint import pprint
 from runpy import run_path
@@ -19,9 +16,8 @@ from typing import Any
 
 from build import ProjectBuilder
 from build.env import IsolatedEnv
-from elftools.common.exceptions import ELFError
-from elftools.elf.elffile import ELFFile
 from filelock import FileLock
+from packaging.utils import canonicalize_name
 
 from cibuildwheel import errors, platforms  # pylint: disable=cyclic-import
 from cibuildwheel.architecture import Architecture, arch_synonym
@@ -34,7 +30,13 @@ from cibuildwheel.frontend import (
 from cibuildwheel.logger import log
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call, shell
-from cibuildwheel.util.file import CIBW_CACHE_PATH, copy_test_sources, download, move_file
+from cibuildwheel.util.file import (
+    CIBW_CACHE_PATH,
+    copy_test_sources,
+    download,
+    move_file,
+    remove_on_error,
+)
 from cibuildwheel.util.helpers import prepare_command
 from cibuildwheel.util.packaging import find_compatible_wheel
 from cibuildwheel.util.python_build_standalone import create_python_build_standalone_environment
@@ -42,10 +44,9 @@ from cibuildwheel.venv import constraint_flags, find_uv, virtualenv
 
 TYPE_CHECKING = False
 if TYPE_CHECKING:
-    from collections.abc import Iterable, Iterator, MutableMapping
-
     from cibuildwheel.options import BuildOptions, Options
     from cibuildwheel.selector import BuildSelector
+    from cibuildwheel.typing import PathOrStr
 
 RESOURCES_ANDROID = resources.PATH / "android"
 ANDROID_TRIPLET = {
@@ -72,6 +73,7 @@ class PythonConfiguration:
     version: str
     identifier: str
     url: str
+    sha256: str
 
     @property
     def arch(self) -> str:
@@ -145,9 +147,11 @@ def build(options: Options, tmp_path: Path) -> None:
             build_path.mkdir()
             python_dir = setup_target_python(config, build_path)
             build_env, android_env = setup_env(config, build_options, build_path, python_dir)
+
             state = BuildState(
                 config, build_options, build_path, python_dir, build_env, android_env
             )
+            setup_xbuild_files(state)
 
             compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
             if compatible_wheel:
@@ -162,7 +166,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 repaired_wheel = repair_wheel(state, built_wheel)
                 run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
 
-            test_wheel(state, repaired_wheel, build_frontend=build_options.build_frontend.name)
+            test_wheel(state, repaired_wheel)
 
             output_wheel: Path | None = None
             if compatible_wheel is None:
@@ -184,7 +188,8 @@ def setup_target_python(config: PythonConfiguration, build_path: Path) -> Path:
     python_tgz = CIBW_CACHE_PATH / config.url.rpartition("/")[-1]
     with FileLock(f"{python_tgz}.lock"):
         if not python_tgz.exists():
-            download(config.url, python_tgz)
+            with remove_on_error(python_tgz):
+                download(config.url, python_tgz, sha256=config.sha256)
 
     python_dir = build_path / "python"
     python_dir.mkdir()
@@ -194,6 +199,11 @@ def setup_target_python(config: PythonConfiguration, build_path: Path) -> Path:
     # updated to Python versions that include the fix.
     call("patch", "-p1", "-i", RESOURCES_ANDROID / "android.patch", cwd=python_dir)
 
+    # Work around https://github.com/python/cpython/issues/138800. This can be removed
+    # once we've updated to Python versions that include the fix.
+    pc_path = python_dir / f"prefix/lib/pkgconfig/python-{config.version}.pc"
+    pc_path.write_text(pc_path.read_text().replace("$(BLDLIBRARY)", f"-lpython{config.version}"))
+
     return python_dir
 
 
@@ -207,13 +217,7 @@ def setup_env(
     * android_env, which uses the environment while simulating running on Android.
     """
     log.step("Setting up build environment...")
-    build_frontend = build_options.build_frontend.name
-    use_uv = build_frontend in {"build[uv]", "uv"}
-    uv_path = find_uv()
-    if use_uv and uv_path is None:
-        msg = "uv not found"
-        raise AssertionError(msg)
-    pip = ["pip"] if not use_uv else [str(uv_path), "pip"]
+    use_uv, pip = find_pip(build_options)
 
     # Create virtual environment
     python_exe = create_python_build_standalone_environment(
@@ -228,8 +232,12 @@ def setup_env(
     )
     create_cmake_toolchain(config, build_path, python_dir, build_env)
 
+    # See platforms.md for the reason why we use this default API level.
+    build_env.setdefault("ANDROID_API_LEVEL", "24")
+
     # Apply custom environment variables, and check environment is still valid
     build_env = build_options.environment.as_dictionary(build_env)
+    build_env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
     build_env["PIP_DISABLE_PIP_VERSION_CHECK"] = "1"
     for command in ["python"] if use_uv else ["python", "pip"]:
         command_path = call("which", command, env=build_env, capture_stdout=True).strip()
@@ -245,14 +253,14 @@ def setup_env(
         else:
             call(command, "--version", env=build_env)
 
-    # Construct an altered environment which simulates running on Android.
-    android_env = setup_android_env(config, python_dir, venv_dir, build_env)
-
     # Install build tools
-    if build_frontend not in {"build", "build[uv]", "uv"}:
-        msg = "Android requires the build frontend to be 'build' or 'uv'"
-        raise errors.FatalError(msg)
-    call(*pip, "install", "build", *constraint_flags(dependency_constraint), env=build_env)
+    tools = ["auditwheel", "patchelf", "pkgconf"]
+    if build_options.build_frontend.name in {"build", "build[uv]"}:
+        tools.append("build")
+    call(*pip, "install", *tools, *constraint_flags(dependency_constraint), env=build_env)
+
+    # Construct an altered environment which simulates running on Android.
+    android_env = setup_android_env(config, python_dir, build_env)
 
     # Build-time requirements must be queried within android_env, because
     # `get_requires_for_build` can run arbitrary code in setup.py scripts, which may be
@@ -275,7 +283,12 @@ def setup_env(
         call(*pip, "install", *pb.build_system_requires, env=build_env)
 
     requires_for_build = pb.get_requires_for_build(
-        "wheel", parse_config_settings(build_options.config_settings)
+        "wheel",
+        parse_config_settings(
+            prepare_config_settings(
+                build_options.config_settings, project=".", package=build_options.package_dir
+            )
+        ),
     )
     if requires_for_build:
         call(*pip, "install", *requires_for_build, env=build_env)
@@ -343,8 +356,11 @@ def localized_vars(
             final = final.replace(orig_prefix, str(prefix))
 
         if key == "ANDROID_API_LEVEL":
-            if api_level := build_env.get(key):
-                final = int(api_level)
+            try:
+                final = int(build_env[key])
+            except ValueError as e:
+                msg = f"ANDROID_API_LEVEL: {e}. This variable must be an integer."
+                raise errors.FatalError(msg) from e
 
         # Build systems vary in whether FLAGS variables are read from sysconfig, and if so,
         # whether they're replaced by environment variables or combined with them. Even
@@ -367,15 +383,15 @@ def localized_vars(
 
 
 def setup_android_env(
-    config: PythonConfiguration, python_dir: Path, venv_dir: Path, build_env: dict[str, str]
+    config: PythonConfiguration, python_dir: Path, build_env: dict[str, str]
 ) -> dict[str, str]:
-    site_packages = next(venv_dir.glob("lib/python*/site-packages"))
+    site_packages = find_site_packages(build_env)
     for suffix in ["pth", "py"]:
         shutil.copy(RESOURCES_ANDROID / f"_cross_venv.{suffix}", site_packages)
 
     sysconfigdata_path = Path(
         shutil.copy(
-            next(python_dir.glob("prefix/lib/python*/_sysconfigdata_*.py")),
+            glob1(python_dir, "prefix/lib/python*/_sysconfigdata_*.py"),
             site_packages,
         )
     )
@@ -414,6 +430,17 @@ def setup_android_env(
     # Cargo target linker needs to be specified after CC is set
     setup_rust(config, python_dir, android_env)
 
+    # Create shims which install additional build tools on first use.
+    setup_fortran(android_env)
+
+    # `android.py env` returns PKG_CONFIG="pkg-config --define-prefix", but some build
+    # systems can't handle arguments in that variable. Since we have a known version
+    # of pkgconf, it's safe to use PKG_CONFIG_RELOCATE_PATHS instead.
+    android_env["PKG_CONFIG"] = call(
+        "which", "pkgconf-pypi", env=build_env, capture_stdout=True
+    ).strip()
+    android_env["PKG_CONFIG_RELOCATE_PATHS"] = "1"
+
     # Format the environment so it can be pasted into a shell when debugging.
     for key, value in sorted(android_env.items()):
         if os.environ.get(key) != value:
@@ -422,11 +449,7 @@ def setup_android_env(
     return android_env
 
 
-def setup_rust(
-    config: PythonConfiguration,
-    python_dir: Path,
-    env: MutableMapping[str, str],
-) -> None:
+def setup_rust(config: PythonConfiguration, python_dir: Path, env: dict[str, str]) -> None:
     cargo_target = android_triplet(config.identifier)
 
     # CARGO_BUILD_TARGET is the variable used by Cargo and setuptools_rust
@@ -450,13 +473,83 @@ def setup_rust(
         shim_path.chmod(0o755)
 
 
+def setup_fortran(env: dict[str, str]) -> None:
+    # In case there's any autodetection based on the executable name, use the same name
+    # as the real executable (see fortran_shim.run_flang)
+    shim_in = RESOURCES_ANDROID / "fortran_shim.py"
+    shim_out = Path(env["VIRTUAL_ENV"]) / "bin/flang-new"
+
+    # The hashbang line runs the shim in cibuildwheel's own virtual environment, so it
+    # has access to utility functions for downloading and caching files.
+    shim_out.write_text(f"#!{sys.executable}\n\n" + shim_in.read_text())
+    shim_out.chmod(0o755)
+    env["FC"] = str(shim_out)
+
+
+def setup_xbuild_files(state: BuildState) -> None:
+    _, pip = find_pip(state.options)
+    xbf_dir = state.build_path / "xbuild_files"
+    xbf_dir.mkdir()
+
+    for requirement in call(*pip, "freeze", env=state.build_env, capture_stdout=True).splitlines():
+        name, _, _ = requirement.strip().partition("==")
+        xbuild_files = state.options.xbuild_files.get(canonicalize_name(name), [])
+        if xbuild_files:
+            log.step(f"Installing xbuild-files for {name}...")
+            pip_install_android(state, xbf_dir, "--no-deps", requirement)
+            for xbf in xbuild_files:
+                if (xbf_dir / xbf).exists():
+                    shutil.copy(
+                        xbf_dir / xbf,
+                        find_site_packages(state.build_env) / xbf,
+                    )
+                else:
+                    log.warning(f"{xbf_dir / xbf} does not exist")
+
+
+def pip_install_android(state: BuildState, target: Path, *args: PathOrStr) -> None:
+    use_uv, pip = find_pip(state.options)
+    call(
+        *pip,
+        "install",
+        "--only-binary=:all:",
+        *(["--python-platform", android_triplet(state.config.identifier)] if use_uv else []),
+        "--target",
+        target,
+        *args,
+        env=state.android_env,
+    )
+
+
+def find_site_packages(env: dict[str, str]) -> Path:
+    return glob1(Path(env["VIRTUAL_ENV"]), "lib/python*/site-packages")
+
+
+def glob1(base: Path, pattern: str) -> Path:
+    results = list(base.glob(pattern))
+    if len(results) != 1:
+        msg = f"{base} contains {len(results)} paths matching '{pattern}'; expected 1"
+        raise errors.FatalError(msg)
+    return results[0]
+
+
+def find_pip(build_options: BuildOptions) -> tuple[bool, list[str]]:
+    use_uv = build_options.build_frontend.name in {"build[uv]", "uv"}
+    uv_path = find_uv()
+    if use_uv and uv_path is None:
+        msg = "uv not found"
+        raise AssertionError(msg)
+    pip = ["pip"] if not use_uv else [str(uv_path), "pip"]
+    return use_uv, pip
+
+
 def before_build(state: BuildState) -> None:
     if state.options.before_build:
         log.step("Running before_build...")
         shell_prepared(
             state.options.before_build,
             build_options=state.options,
-            env=state.build_env,
+            env=state.android_env,
         )
 
 
@@ -507,15 +600,10 @@ def build_wheel(state: BuildState) -> Path:
                 env=state.android_env,
             )
         case x:
-            msg = f"Invalid build backend {x!r}"
-            raise AssertionError(msg)
-
-    built_wheels = list(built_wheel_dir.glob("*.whl"))
-    if len(built_wheels) != 1:
-        msg = f"{built_wheel_dir} contains {len(built_wheels)} wheels; expected 1"
+            msg = f"Android requires the build frontend to be 'build' or 'uv', not {x!r}"
             raise errors.FatalError(msg)
-    built_wheel = built_wheels[0]
 
+    built_wheel = glob1(built_wheel_dir, "*.whl")
     if built_wheel.name.endswith("none-any.whl"):
         raise errors.NonPlatformWheelError()
     return built_wheel
@@ -527,9 +615,20 @@ def repair_wheel(state: BuildState, built_wheel: Path) -> Path:
     repaired_wheel_dir.mkdir()
 
     if state.options.repair_command:
+        # Tell auditwheel the locations of compiler libraries.
+        toolchain = Path(state.android_env["CC"]).parent.parent
+        triplet = android_triplet(state.config.identifier)
+        ldpaths = ":".join(
+            str(glob1(toolchain, pattern))
+            for pattern in [
+                f"lib/clang/*/lib/linux/{triplet.split('-')[0]}",  # libomp
+                f"sysroot/usr/lib/{triplet}",  # libc++_shared
+            ]
+        )
         shell(
             prepare_command(
                 state.options.repair_command,
+                ldpaths=ldpaths,
                 wheel=built_wheel,
                 dest_dir=repaired_wheel_dir,
                 package=state.options.package_dir,
@@ -538,14 +637,15 @@ def repair_wheel(state: BuildState, built_wheel: Path) -> Path:
             env=state.build_env,
         )
     else:
-        repair_default(state.android_env, built_wheel, repaired_wheel_dir)
+        shutil.move(built_wheel, repaired_wheel_dir)
 
     repaired_wheels = list(repaired_wheel_dir.glob("*.whl"))
     if len(repaired_wheels) == 0:
         raise errors.RepairStepProducedNoWheelError()
     if len(repaired_wheels) != 1:
-        msg = f"{repaired_wheel_dir} contains {len(repaired_wheels)} wheels; expected 1"
-        raise errors.FatalError(msg)
+        raise errors.RepairStepProducedMultipleWheelsError(
+            [rw.name for rw in repaired_wheels],
+        )
     repaired_wheel = repaired_wheels[0]
 
     if repaired_wheel.name.endswith("none-any.whl"):
@@ -553,119 +653,12 @@ def repair_wheel(state: BuildState, built_wheel: Path) -> Path:
     return repaired_wheel
 
 
-def repair_default(
-    android_env: dict[str, str], built_wheel: Path, repaired_wheel_dir: Path
-) -> None:
-    """
-    Adds libc++ to the wheel if anything links against it. In the future this should be
-    moved to auditwheel and generalized to support more libraries.
-    """
-    if (match := re.search(r"^(.+?)-", built_wheel.name)) is None:
-        msg = f"Failed to parse wheel filename: {built_wheel.name}"
-        raise errors.FatalError(msg)
-    wheel_name = match[1]
-
-    unpacked_dir = repaired_wheel_dir / "unpacked"
-    unpacked_dir.mkdir()
-    shutil.unpack_archive(built_wheel, unpacked_dir, format="zip")
-
-    # Some build systems are inconsistent about name normalization, so don't assume the
-    # dist-info name is identical to the wheel name.
-    record_paths = list(unpacked_dir.glob("*.dist-info/RECORD"))
-    if len(record_paths) != 1:
-        msg = f"{built_wheel.name} contains {len(record_paths)} dist-info/RECORD files; expected 1"
-        raise errors.FatalError(msg)
-
-    old_soname = "libc++_shared.so"
-    paths_to_patch = []
-    for path, elffile in elf_file_filter(
-        unpacked_dir / filename
-        for filename, *_ in csv.reader(record_paths[0].read_text().splitlines())
-    ):
-        if (dynamic := elffile.get_section_by_name(".dynamic")) and any(  # type: ignore[no-untyped-call]
-            tag.entry.d_tag == "DT_NEEDED" and tag.needed == old_soname
-            for tag in dynamic.iter_tags()
-        ):
-            paths_to_patch.append(path)
-
-    if not paths_to_patch:
-        shutil.copyfile(built_wheel, repaired_wheel_dir / built_wheel.name)
-    else:
-        # Android doesn't support DT_RPATH, but supports DT_RUNPATH since API level 24
-        # (https://github.com/aosp-mirror/platform_bionic/blob/master/android-changes-for-ndk-developers.md).
-        if int(sysconfig_print('get_config_vars()["ANDROID_API_LEVEL"]', android_env)) < 24:
-            msg = f"Adding {old_soname} requires ANDROID_API_LEVEL to be at least 24"
-            raise errors.FatalError(msg)
-
-        toolchain = Path(android_env["CC"]).parent.parent
-        src_path = toolchain / f"sysroot/usr/lib/{android_env['CIBW_HOST_TRIPLET']}/{old_soname}"
-
-        # Use the same library location as auditwheel would.
-        libs_dir = unpacked_dir / (wheel_name + ".libs")
-        libs_dir.mkdir()
-        new_soname = soname_with_hash(src_path)
-        dst_path = libs_dir / new_soname
-        shutil.copyfile(src_path, dst_path)
-        call(which("patchelf"), "--set-soname", new_soname, dst_path)
-
-        for path in paths_to_patch:
-            call(which("patchelf"), "--replace-needed", old_soname, new_soname, path)
-            call(
-                which("patchelf"),
-                "--set-rpath",
-                f"${{ORIGIN}}/{relpath(libs_dir, path.parent)}",
-                path,
-            )
-        call(which("wheel"), "pack", unpacked_dir, "-d", repaired_wheel_dir)
-
-
-# If cibuildwheel was called without activating its environment, its scripts directory
-# will not be on the PATH.
-def which(cmd: str) -> str:
-    scripts_dir = sysconfig.get_path("scripts")
-    result = shutil.which(cmd, path=scripts_dir + os.pathsep + os.environ["PATH"])
-    if result is None:
-        msg = f"Couldn't find {cmd!r} in {scripts_dir} or on the PATH"
-        raise errors.FatalError(msg)
-    return result
-
-
-def elf_file_filter(paths: Iterable[Path]) -> Iterator[tuple[Path, ELFFile]]:
-    """Filter through an iterator of filenames and load up only ELF files"""
-    for path in paths:
-        if not path.name.endswith(".py"):
-            try:
-                with open(path, "rb") as f:
-                    candidate = ELFFile(f)  # type: ignore[no-untyped-call]
-                    yield path, candidate
-            except ELFError:
-                pass  # Not an ELF file
-
-
-def soname_with_hash(src_path: Path) -> str:
-    """Return the same library filename as auditwheel would"""
-    shorthash = hashlib.sha256(src_path.read_bytes()).hexdigest()[:8]
-    src_name = src_path.name
-    base, ext = src_name.split(".", 1)
-    if not base.endswith(f"-{shorthash}"):
-        return f"{base}-{shorthash}.{ext}"
-    else:
-        return src_name
-
-
-def test_wheel(state: BuildState, wheel: Path, *, build_frontend: str) -> None:
+def test_wheel(state: BuildState, wheel: Path) -> None:
     test_command = state.options.test_command
     if not (test_command and state.options.test_selector(state.config.identifier)):
         return
 
     log.step("Testing wheel...")
-    use_uv = build_frontend in {"build[uv]", "uv"}
-    uv_path = find_uv()
-    if use_uv and uv_path is None:
-        msg = "uv not found"
-        raise AssertionError(msg)
-    pip = ["pip"] if not use_uv else [str(uv_path), "pip"]
-
     native_arch = arch_synonym(platform.machine(), platforms.native_platform(), "android")
     if state.config.arch != native_arch:
         log.warning(
@@ -678,31 +671,17 @@ def test_wheel(state: BuildState, wheel: Path, *, build_frontend: str) -> None:
         shell_prepared(
             state.options.before_test,
             build_options=state.options,
-            env=state.build_env,
-        )
-
-    platform_args = (
-        ["--python-platform", android_triplet(state.config.identifier)]
-        if use_uv
-        else [
-            "--platform",
-            sysconfig_print("get_platform()", state.android_env).replace("-", "_"),
-        ]
+            env=state.android_env,
         )
 
     # Install the wheel and test-requires.
     site_packages_dir = state.build_path / "site-packages"
     site_packages_dir.mkdir()
-    call(
-        *pip,
-        "install",
-        "--only-binary=:all:",
-        *platform_args,
-        "--target",
+    pip_install_android(
+        state,
         site_packages_dir,
         f"{wheel}{state.options.test_extras}",
         *state.options.test_requires,
-        env=state.android_env,
     )
 
     # Copy test-sources.
@@ -772,13 +751,3 @@ def test_wheel(state: BuildState, wheel: Path, *, build_frontend: str) -> None:
         *test_args,
         env=state.build_env,
     )
-
-
-def sysconfig_print(method_call: str, env: dict[str, str]) -> str:
-    return call(
-        "python",
-        "-c",
-        f'import sysconfig; print(sysconfig.{method_call}, end="")',
-        env=env,
-        capture_stdout=True,
-    )

cibuildwheel/platforms/ios.py

@@ -25,7 +25,13 @@ from cibuildwheel.logger import log
 from cibuildwheel.platforms.macos import install_cpython as install_build_cpython
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call, shell, split_command
-from cibuildwheel.util.file import CIBW_CACHE_PATH, copy_test_sources, download, move_file
+from cibuildwheel.util.file import (
+    CIBW_CACHE_PATH,
+    copy_test_sources,
+    download,
+    move_file,
+    remove_on_error,
+)
 from cibuildwheel.util.helpers import prepare_command, unwrap_preserving_paragraphs
 from cibuildwheel.util.packaging import find_compatible_wheel
 from cibuildwheel.venv import constraint_flags, virtualenv
@@ -46,6 +52,8 @@ class PythonConfiguration:
     identifier: str
     url: str
     build_url: str
+    build_sha256: str
+    sha256: str
 
     @property
     def sdk(self) -> str:
@@ -78,7 +86,7 @@ def all_python_configurations() -> list[PythonConfiguration]:
     # configuration.
     macos_python_configs = resources.read_python_configs("macos")
 
-    def build_url(config_dict: dict[str, str]) -> str:
+    def build_python_config(config_dict: dict[str, str]) -> dict[str, str]:
         # The iOS identifier will be something like cp313-ios_arm64_iphoneos.
         # Drop the iphoneos suffix, then replace ios with macosx to yield
         # cp313-macosx_arm64, which will be a macOS build identifier.
@@ -87,18 +95,22 @@ def all_python_configurations() -> list[PythonConfiguration]:
         matching = [
             config for config in macos_python_configs if config["identifier"] == macos_identifier
         ]
-        return matching[0]["url"]
+        return matching[0]
 
     # Load the platform configuration
     full_python_configs = resources.read_python_configs("ios")
     # Build the configurations, annotating with macOS URL details.
-    return [
+    python_configurations = []
+    for item in full_python_configs:
+        build_config = build_python_config(item)
+        python_configurations.append(
             PythonConfiguration(
                 **item,
-            build_url=build_url(item),
+                build_url=build_config["url"],
+                build_sha256=build_config["sha256"],
             )
-        for item in full_python_configs
-    ]
+        )
+    return python_configurations
 
 
 def get_python_configurations(
@@ -133,8 +145,9 @@ def install_target_cpython(tmp: Path, config: PythonConfiguration, free_threadin
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             downloaded_tar_gz = tmp / ios_python_tar_gz
-            download(config.url, downloaded_tar_gz)
-            installation_path.mkdir(parents=True, exist_ok=True)
+            download(config.url, downloaded_tar_gz, sha256=config.sha256)
+            with remove_on_error(installation_path):
+                installation_path.mkdir(parents=True)
                 call("tar", "-C", installation_path, "-xf", downloaded_tar_gz)
             downloaded_tar_gz.unlink()
 
@@ -319,6 +332,7 @@ def setup_python(
             python_configuration.version,
             python_configuration.build_url,
             free_threading,
+            python_configuration.build_sha256,
         )
     else:
         msg = f"Unknown Python implementation: {implementation_id}"
@@ -482,6 +496,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 build_frontend=build_frontend.name,
                 xbuild_tools=build_options.xbuild_tools,
             )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
 
             compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
             if compatible_wheel:

cibuildwheel/platforms/linux.py

@@ -237,6 +237,7 @@ def build_in_container(
         env["PATH"] = f"{python_bin}:{env['PATH']}"
 
         env = build_options.environment.as_dictionary(env, executor=container.environment_executor)
+        env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
 
         # check config python is still on PATH
         which_python = container.call(["which", "python"], env=env, capture_output=True).strip()
@@ -492,7 +493,7 @@ def build(options: Options, tmp_path: Path) -> None:
     abs_package_dir = options.globals.package_dir.resolve()
     if cwd != abs_package_dir and cwd not in abs_package_dir.parents:
         msg = "package_dir must be inside the working directory"
-        raise Exception(msg)
+        raise errors.ConfigurationError(msg)
 
     container_project_path = PurePosixPath("/project")
     container_package_dir = container_project_path / abs_package_dir.relative_to(cwd)

cibuildwheel/platforms/macos.py

@@ -27,7 +27,13 @@ from cibuildwheel.frontend import (
 from cibuildwheel.logger import log
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call, shell
-from cibuildwheel.util.file import CIBW_CACHE_PATH, copy_test_sources, download, move_file
+from cibuildwheel.util.file import (
+    CIBW_CACHE_PATH,
+    copy_test_sources,
+    download,
+    move_file,
+    remove_on_error,
+)
 from cibuildwheel.util.helpers import prepare_command, unwrap
 from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
 from cibuildwheel.venv import constraint_flags, find_uv, target_marker_env, virtualenv
@@ -88,6 +94,7 @@ class PythonConfiguration:
     version: str
     identifier: str
     url: str
+    sha256: str
 
 
 def all_python_configurations() -> list[PythonConfiguration]:
@@ -135,7 +142,7 @@ def get_python_configurations(
     return python_configurations
 
 
-def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) -> Path:
+def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool, sha256: str) -> Path:
     ft = "T" if free_threading else ""
     installation_path = Path(f"/Library/Frameworks/Python{ft}.framework/Versions/{version}")
     with FileLock(CIBW_CACHE_PATH / f"cpython{version}.lock"):
@@ -161,7 +168,7 @@ def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) ->
             python_filename = url.rsplit("/", maxsplit=1)[-1]
             pkg_path = CIBW_CACHE_PATH / "cpython-installer" / python_filename
             if not pkg_path.exists():
-                download(url, pkg_path)
+                download(url, pkg_path, sha256=sha256)
             args = []
             if version.startswith("3.14"):
                 args += ["-applyChoiceChangesXML", str(resources.FREE_THREAD_ENABLE_314.resolve())]
@@ -185,7 +192,7 @@ def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) ->
     return installation_path / "bin" / (f"python{version}t" if free_threading else "python3")
 
 
-def install_pypy(tmp: Path, url: str) -> Path:
+def install_pypy(tmp: Path, url: str, sha256: str) -> Path:
     pypy_tar_bz2 = url.rsplit("/", 1)[-1]
     extension = ".tar.bz2"
     assert pypy_tar_bz2.endswith(extension)
@@ -193,14 +200,15 @@ def install_pypy(tmp: Path, url: str) -> Path:
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             downloaded_tar_bz2 = tmp / pypy_tar_bz2
-            download(url, downloaded_tar_bz2)
+            download(url, downloaded_tar_bz2, sha256=sha256)
             installation_path.parent.mkdir(parents=True, exist_ok=True)
+            with remove_on_error(installation_path):
                 call("tar", "-C", installation_path.parent, "-xf", downloaded_tar_bz2)
             downloaded_tar_bz2.unlink()
     return installation_path / "bin" / "pypy3"
 
 
-def install_graalpy(tmp: Path, url: str) -> Path:
+def install_graalpy(tmp: Path, url: str, sha256: str) -> Path:
     graalpy_archive = url.rsplit("/", 1)[-1]
     extension = ".tar.gz"
     assert graalpy_archive.endswith(extension)
@@ -208,10 +216,18 @@ def install_graalpy(tmp: Path, url: str) -> Path:
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             downloaded_archive = tmp / graalpy_archive
-            download(url, downloaded_archive)
+            download(url, downloaded_archive, sha256=sha256)
+            with remove_on_error(installation_path):
                 installation_path.mkdir(parents=True)
                 # GraalPy top-folder name is inconsistent with archive name
-            call("tar", "-C", installation_path, "--strip-components=1", "-xzf", downloaded_archive)
+                call(
+                    "tar",
+                    "-C",
+                    installation_path,
+                    "--strip-components=1",
+                    "-xzf",
+                    downloaded_archive,
+                )
             downloaded_archive.unlink()
     return installation_path / "bin" / "graalpy"
 
@@ -232,13 +248,17 @@ def setup_python(
     if implementation_id.startswith("cp"):
         free_threading = "t-macos" in python_configuration.identifier
         base_python = install_cpython(
-            tmp, python_configuration.version, python_configuration.url, free_threading
+            tmp,
+            python_configuration.version,
+            python_configuration.url,
+            free_threading,
+            python_configuration.sha256,
         )
 
     elif implementation_id.startswith("pp"):
-        base_python = install_pypy(tmp, python_configuration.url)
+        base_python = install_pypy(tmp, python_configuration.url, python_configuration.sha256)
     elif implementation_id.startswith("gp"):
-        base_python = install_graalpy(tmp, python_configuration.url)
+        base_python = install_graalpy(tmp, python_configuration.url, python_configuration.sha256)
     else:
         msg = "Unknown Python implementation"
         raise ValueError(msg)
@@ -466,6 +486,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 build_options.environment,
                 build_frontend.name,
             )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
             pip_version = None if use_uv else get_pip_version(env)
 
             compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)

cibuildwheel/platforms/pyodide.py

@@ -29,6 +29,7 @@ from cibuildwheel.util.file import (
     extract_tar,
     extract_zip,
     move_file,
+    remove_on_error,
 )
 from cibuildwheel.util.helpers import prepare_command, unwrap, unwrap_preserving_paragraphs
 from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
@@ -55,6 +56,7 @@ class PythonConfiguration:
     identifier: str
     default_pyodide_version: str
     node_version: str
+    sha256: str = ""
 
 
 class PyodideXBuildEnvInfoVersionRange(TypedDict):
@@ -91,6 +93,7 @@ def ensure_node(major_version: str) -> Path:
             with TemporaryDirectory() as tmp_path:
                 archive = Path(tmp_path) / f"{name}.{ext}"
                 download(url, archive)
+                with remove_on_error(path):
                     if ext == "zip":
                         extract_zip(archive, path.parent)
                     else:
@@ -109,6 +112,7 @@ def install_emscripten(env: dict[str, str], version: str, xbuildenv_cache_path:
     with FileLock(CIBW_CACHE_PATH / "emscripten.lock"):
         if emscripten_dir.exists():
             return emscripten_dir
+        with remove_on_error(emscripten_dir):
             call(
                 "pyodide",
                 "xbuildenv",
@@ -207,6 +211,7 @@ def install_xbuildenv(env: dict[str, str], xbuildenv_cache_path: Path, pyodide_v
         env.pop("PYODIDE_ROOT", None)
 
         # Install the xbuildenv
+        with remove_on_error(xbuildenv_cache_path / pyodide_version):
             call(
                 "pyodide",
                 "xbuildenv",
@@ -391,6 +396,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 environment=build_options.environment,
                 user_pyodide_version=build_options.pyodide_version,
             )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
             pip_version = get_pip_version(env)
             # The Pyodide command line runner mounts all directories in the host
             # filesystem into the Pyodide file system, except for the custom

cibuildwheel/platforms/windows.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import dataclasses
-import json
 import os
 import platform as platform_module
 import shutil
@@ -30,6 +29,7 @@ from cibuildwheel.util.file import (
     download,
     extract_zip,
     move_file,
+    remove_on_error,
 )
 from cibuildwheel.util.helpers import prepare_command, unwrap
 from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
@@ -73,6 +73,7 @@ class PythonConfiguration:
     version: str
     identifier: str
     url: str | None = None
+    sha256: str = ""
 
     @property
     def arch(self) -> str:
@@ -111,6 +112,7 @@ def _ensure_nuget() -> Path:
     nuget = CIBW_CACHE_PATH / "nuget.exe"
     with FileLock(str(nuget) + ".lock"):
         if not nuget.exists():
+            with remove_on_error(nuget):
                 download("https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", nuget)
     return nuget
 
@@ -127,11 +129,12 @@ def install_cpython(configuration: PythonConfiguration, arch: str | None = None)
     with FileLock(str(base_output_dir) + f"-{version}{free_threaded_str}-{arch}.lock"):
         if not installation_path.exists():
             nuget = _ensure_nuget()
+            with remove_on_error(installation_path.parent):
                 call(nuget, "install", *nuget_args)
     return installation_path / "python.exe"
 
 
-def install_pypy(tmp: Path, arch: str, url: str) -> Path:
+def install_pypy(tmp: Path, arch: str, url: str, sha256: str) -> Path:
     assert arch == "64"
     assert "win64" in url
     # Inside the PyPy zip file is a directory with the same name
@@ -142,13 +145,14 @@ def install_pypy(tmp: Path, arch: str, url: str) -> Path:
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             pypy_zip = tmp / zip_filename
-            download(url, pypy_zip)
+            download(url, pypy_zip, sha256=sha256)
+            with remove_on_error(installation_path):
                 # Extract to the parent directory because the zip file still contains a directory
                 extract_zip(pypy_zip, installation_path.parent)
     return installation_path / "python.exe"
 
 
-def install_graalpy(tmp: Path, url: str) -> Path:
+def install_graalpy(tmp: Path, url: str, sha256: str) -> Path:
     zip_filename = url.rsplit("/", 1)[-1]
     extension = ".zip"
     assert zip_filename.endswith(extension)
@@ -156,7 +160,8 @@ def install_graalpy(tmp: Path, url: str) -> Path:
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             graalpy_zip = tmp / zip_filename
-            download(url, graalpy_zip)
+            download(url, graalpy_zip, sha256=sha256)
+            with remove_on_error(installation_path):
                 # Extract to the parent directory because the zip file still contains a directory
                 extract_zip(graalpy_zip, installation_path.parent)
     return installation_path / "bin" / "graalpy.exe"
@@ -272,9 +277,14 @@ def setup_python(
             base_python = install_cpython(python_configuration, arch=native_arch)
     elif implementation_id.startswith("pp"):
         assert python_configuration.url is not None
-        base_python = install_pypy(tmp, python_configuration.arch, python_configuration.url)
+        assert python_configuration.sha256
+        base_python = install_pypy(
+            tmp, python_configuration.arch, python_configuration.url, python_configuration.sha256
+        )
     elif implementation_id.startswith("gp"):
-        base_python = install_graalpy(tmp, python_configuration.url or "")
+        assert python_configuration.url is not None
+        assert python_configuration.sha256
+        base_python = install_graalpy(tmp, python_configuration.url, python_configuration.sha256)
     else:
         msg = "Unknown Python implementation"
         raise ValueError(msg)
@@ -379,42 +389,6 @@ def setup_python(
         setup_setuptools_cross_compile(tmp, python_configuration, python_libs_base, env)
         setup_rust_cross_compile(tmp, python_configuration, python_libs_base, env)
 
-    if implementation_id.startswith("gp311"):
-        # GraalPy 24 fails to discover compilers, setup the relevant environment
-        # variables. Adapted from
-        # https://github.com/microsoft/vswhere/wiki/Start-Developer-Command-Prompt
-        # Remove when GraalPy 24.x is dropped.
-        vcpath = call(
-            Path(os.environ["PROGRAMFILES(X86)"])
-            / "Microsoft Visual Studio"
-            / "Installer"
-            / "vswhere.exe",
-            "-products",
-            "*",
-            "-latest",
-            "-property",
-            "installationPath",
-            capture_stdout=True,
-        ).strip()
-        log.notice(f"Discovering Visual Studio for GraalPy at {vcpath}")
-        vcvars_file = tmp / "vcvars.json"
-        call(
-            f"{vcpath}\\Common7\\Tools\\vsdevcmd.bat",
-            "-no_logo",
-            "-arch=amd64",
-            "-host_arch=amd64",
-            "&&",
-            "python",
-            "-c",
-            # this command needs to be one line for Windows reasons
-            "import sys, json, pathlib, os; pathlib.Path(sys.argv[1]).write_text(json.dumps(dict(os.environ)))",
-            vcvars_file,
-            env=env,
-        )
-        with open(vcvars_file, encoding="utf-8") as f:
-            vcvars = json.load(f)
-        env.update(vcvars)
-
     return base_python, env
 
 
@@ -466,6 +440,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 build_options.environment,
                 build_frontend.name,
             )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
             pip_version = None if use_uv else get_pip_version(env)
 
             compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
@@ -499,22 +474,6 @@ def build(options: Options, tmp_path: Path) -> None:
                     ),
                 )
 
-                if (
-                    config.identifier.startswith("gp311")
-                    and build_frontend.name == "build"
-                    and "--no-isolation" not in extra_flags
-                    and "-n" not in extra_flags
-                ):
-                    # GraalPy 24 fails to discover its standard library when a venv is created
-                    # from a virtualenv seeded executable. See
-                    # https://github.com/oracle/graalpython/issues/491 and remove this once
-                    # GraalPy 24 is dropped.
-                    log.notice(
-                        "Disabling build isolation to workaround GraalPy bug. If the build fails, consider using pip or build[uv] as build frontend."
-                    )
-                    shell("graalpy -m pip install setuptools wheel", env=env)
-                    extra_flags = [*extra_flags, "-n"]
-
                 match build_frontend.name:
                     case "pip":
                         # Path.resolve() is needed. Without it pip wheel may try to fetch package from pypi.org

cibuildwheel/resources/android/_cross_venv.py

@@ -14,6 +14,9 @@ def initialize() -> None:
     if not (host_triplet := os.environ.get("CIBW_HOST_TRIPLET")):
         return
 
+    # Pre-import any modules which would fail to import after the monkey-patching.
+    import ctypes  # noqa: F401, PLC0415 - uses get_config_var("LDLIBRARY")
+
     # os ######################################################################
     def cross_os_uname() -> os.uname_result:
         return os.uname_result(

cibuildwheel/resources/android/fortran_shim.py

@@ -0,0 +1,121 @@
+# This file intentionally has no hashbang line in the source: cibuildwheel will add it
+# above this comment when the file is deployed.
+
+import os
+import re
+import shutil
+import sys
+from pathlib import Path
+from tempfile import gettempdir
+
+from filelock import FileLock
+
+from cibuildwheel.util.file import CIBW_CACHE_PATH, download
+
+# In the future we might pick a different Flang release depending on the NDK version,
+# but so far all Python versions use the same NDK version, so there's no need.
+RELEASE_URL = "https://github.com/termux/ndk-toolchain-clang-with-flang/releases/download"
+RELEASE_VERSION = "r27c"
+ARCHS = ["aarch64", "x86_64"]
+
+# The compiler is built for Linux x86_64, so we use Docker on macOS.
+DOCKER_IMAGE = "debian:trixie-slim"
+
+
+def main() -> None:
+    cache_dir = CIBW_CACHE_PATH / f"flang-android-{RELEASE_VERSION}"
+    with FileLock(f"{cache_dir}.lock"):
+        if not cache_dir.exists():
+            download_flang(cache_dir)
+
+    run_flang(cache_dir)
+
+
+def download_flang(cache_dir: Path) -> None:
+    tmp_dir = Path(f"{cache_dir}.tmp")
+    if tmp_dir.exists():
+        shutil.rmtree(tmp_dir)
+    tmp_dir.mkdir(parents=True)
+
+    for archive_name in [f"package-flang-{arch}.tar.bz2" for arch in ARCHS] + [
+        "package-flang-host.tar.bz2",
+        "package-install.tar.bz2",
+    ]:
+        archive_path = tmp_dir / archive_name
+        download(f"{RELEASE_URL}/{RELEASE_VERSION}/{archive_name}", archive_path)
+        shutil.unpack_archive(archive_path, tmp_dir)
+        archive_path.unlink()
+
+    # Merge the extracted trees together, along with the necessary parts of the NDK. Based on
+    # https://github.com/kivy/python-for-android/blob/develop/pythonforandroid/recipes/fortran/__init__.py.
+    flang_toolchain = tmp_dir / "toolchain"
+    (tmp_dir / "out/install/linux-x86/clang-dev").rename(flang_toolchain)
+
+    ndk_toolchain = Path(os.environ["CC"]).parents[1]
+    if (clang_ver_flang := clang_ver(flang_toolchain)) != (
+        clang_ver_ndk := clang_ver(ndk_toolchain)
+    ):
+        msg = f"Flang uses Clang {clang_ver_flang}, but NDK uses Clang {clang_ver_ndk}"
+        raise ValueError(msg)
+
+    clang_lib_path = f"lib/clang/{clang_ver_ndk}/lib"
+    shutil.rmtree(flang_toolchain / clang_lib_path)
+
+    for src, dst in [
+        (f"{tmp_dir}/build-{arch}-install", f"sysroot/usr/lib/{arch}-linux-android")
+        for arch in ARCHS
+    ] + [
+        (f"{tmp_dir}/build-host-install", ""),
+        (f"{ndk_toolchain}/{clang_lib_path}", clang_lib_path),
+        (f"{ndk_toolchain}/sysroot", "sysroot"),
+    ]:
+        shutil.copytree(src, flang_toolchain / dst, symlinks=True, dirs_exist_ok=True)
+
+    flang_toolchain.rename(cache_dir)
+    shutil.rmtree(tmp_dir)
+
+
+def clang_ver(toolchain: Path) -> str:
+    versions = [p.name for p in (toolchain / "lib/clang").iterdir()]
+    assert len(versions) == 1
+    return versions[0]
+
+
+def run_flang(cache_dir: Path) -> None:
+    match = re.fullmatch(r".+/(.+)-clang", os.environ["CC"])
+    assert match is not None
+    target = match[1]
+
+    # In a future Flang version the executable name will change to "flang"
+    # (https://blog.llvm.org/posts/2025-03-11-flang-new/).
+    flang_args = [f"{cache_dir}/bin/flang-new", f"--target={target}", *sys.argv[1:]]
+
+    if sys.platform == "linux":
+        args = flang_args
+    elif sys.platform == "darwin":
+        args = ["docker", "run", "--rm", "--platform", "linux/amd64"]
+        # Docker on macOS only allows certain directories to be mounted as volumes
+        # by default, but they include all the locations we're likely to need.
+        for path in [
+            # Location of CIBW_CACHE_PATH (containing the Fortran compiler), and
+            # probably the project directory.
+            Path.home(),
+            # Temporary directories created by build backends and cibuildwheel itself.
+            # This is controlled by the TMPDIR environment variable, which is set to
+            # an unpredictable subdirectory of /var/folders. /var is itself a symlink
+            # to /private/var.
+            Path(gettempdir()),
+            Path(gettempdir()).resolve(),
+        ]:
+            args += ["-v", f"{path}:{path}"]
+        args += ["--workdir", str(Path.cwd())]
+        args += ["--entrypoint", flang_args[0], DOCKER_IMAGE, *flang_args[1:]]
+    else:
+        msg = f"unknown platform: {sys.platform}"
+        raise ValueError(msg)
+
+    os.execvp(args[0], args)
+
+
+if __name__ == "__main__":
+    main()

cibuildwheel/resources/build-platforms.toml

@@ -21,7 +21,6 @@ python_configurations = [
   { identifier = "pp39-manylinux_x86_64", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
   { identifier = "pp310-manylinux_x86_64", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
   { identifier = "pp311-manylinux_x86_64", version = "3.11", path_str = "/opt/python/pp311-pypy311_pp73" },
-  { identifier = "gp311_242-manylinux_x86_64", version = "3.11", path_str = "/opt/python/graalpy311-graalpy242_311_native" },
   { identifier = "gp312_250-manylinux_x86_64", version = "3.12", path_str = "/opt/python/graalpy312-graalpy250_312_native" },
   { identifier = "cp39-manylinux_aarch64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-manylinux_aarch64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
@@ -71,7 +70,6 @@ python_configurations = [
   { identifier = "pp39-manylinux_aarch64", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
   { identifier = "pp310-manylinux_aarch64", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
   { identifier = "pp311-manylinux_aarch64", version = "3.11", path_str = "/opt/python/pp311-pypy311_pp73" },
-  { identifier = "gp311_242-manylinux_aarch64", version = "3.11", path_str = "/opt/python/graalpy311-graalpy242_311_native" },
   { identifier = "gp312_250-manylinux_aarch64", version = "3.12", path_str = "/opt/python/graalpy312-graalpy250_312_native" },
   { identifier = "pp39-manylinux_i686", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
   { identifier = "pp310-manylinux_i686", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
@@ -143,43 +141,41 @@ python_configurations = [
 
 [macos]
 python_configurations = [
-  { identifier = "cp39-macosx_x86_64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
-  { identifier = "cp39-macosx_arm64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
-  { identifier = "cp39-macosx_universal2", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
-  { identifier = "cp310-macosx_x86_64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
-  { identifier = "cp310-macosx_arm64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
-  { identifier = "cp310-macosx_universal2", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
-  { identifier = "cp311-macosx_x86_64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
-  { identifier = "cp311-macosx_arm64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
-  { identifier = "cp311-macosx_universal2", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
-  { identifier = "cp312-macosx_x86_64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
-  { identifier = "cp312-macosx_arm64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
-  { identifier = "cp312-macosx_universal2", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
-  { identifier = "cp313-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
-  { identifier = "cp313-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
-  { identifier = "cp313-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
-  { identifier = "cp314-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg" },
-  { identifier = "cp314-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg" },
-  { identifier = "cp314-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg" },
-  { identifier = "cp314t-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg" },
-  { identifier = "cp314t-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg" },
-  { identifier = "cp314t-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg" },
-  { identifier = "cp315-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-macos11.pkg" },
-  { identifier = "cp315-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-macos11.pkg" },
-  { identifier = "cp315-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-macos11.pkg" },
-  { identifier = "cp315t-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-macos11.pkg" },
-  { identifier = "cp315t-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-macos11.pkg" },
-  { identifier = "cp315t-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-macos11.pkg" },
-  { identifier = "pp39-macosx_x86_64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_x86_64.tar.bz2" },
-  { identifier = "pp39-macosx_arm64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_arm64.tar.bz2" },
-  { identifier = "pp310-macosx_x86_64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_x86_64.tar.bz2" },
-  { identifier = "pp310-macosx_arm64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_arm64.tar.bz2" },
-  { identifier = "pp311-macosx_x86_64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_x86_64.tar.bz2" },
-  { identifier = "pp311-macosx_arm64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_arm64.tar.bz2" },
-  { identifier = "gp311_242-macosx_x86_64", version = "3.11", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.2/graalpy-24.2.2-macos-amd64.tar.gz" },
-  { identifier = "gp311_242-macosx_arm64", version = "3.11", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.2/graalpy-24.2.2-macos-aarch64.tar.gz" },
-  { identifier = "gp312_250-macosx_x86_64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.1/graalpy-25.0.1-macos-amd64.tar.gz" },
-  { identifier = "gp312_250-macosx_arm64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-macos-aarch64.tar.gz" },
+  { identifier = "cp39-macosx_x86_64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
+  { identifier = "cp39-macosx_arm64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
+  { identifier = "cp39-macosx_universal2", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
+  { identifier = "cp310-macosx_x86_64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
+  { identifier = "cp310-macosx_arm64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
+  { identifier = "cp310-macosx_universal2", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
+  { identifier = "cp311-macosx_x86_64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
+  { identifier = "cp311-macosx_arm64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
+  { identifier = "cp311-macosx_universal2", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
+  { identifier = "cp312-macosx_x86_64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
+  { identifier = "cp312-macosx_arm64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
+  { identifier = "cp312-macosx_universal2", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
+  { identifier = "cp313-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
+  { identifier = "cp313-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
+  { identifier = "cp313-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
+  { identifier = "cp314-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
+  { identifier = "cp314-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
+  { identifier = "cp314-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
+  { identifier = "cp314t-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
+  { identifier = "cp314t-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
+  { identifier = "cp314t-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
+  { identifier = "cp315-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
+  { identifier = "cp315-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
+  { identifier = "cp315-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
+  { identifier = "cp315t-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
+  { identifier = "cp315t-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
+  { identifier = "cp315t-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
+  { identifier = "pp39-macosx_x86_64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_x86_64.tar.bz2", sha256 = "fda015431621e7e5aa16359d114f2c45a77ed936992c1efff86302e768a6b21c" },
+  { identifier = "pp39-macosx_arm64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_arm64.tar.bz2", sha256 = "88f824e7a2d676440d09bc90fc959ae0fd3557d7e2f14bfbbe53d41d159a47fe" },
+  { identifier = "pp310-macosx_x86_64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_x86_64.tar.bz2", sha256 = "2c5e5c2a33ac882551d7f28b98d19d486b8995aa50824a73b4edcc6aeec35c63" },
+  { identifier = "pp310-macosx_arm64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_arm64.tar.bz2", sha256 = "3db8a03fc496164801646844d7f3b12baa0adb3ad9a0b7cb124521bc2e168a36" },
+  { identifier = "pp311-macosx_x86_64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_x86_64.tar.bz2", sha256 = "c95363c4e87235d11a6cec8128239c291b1eb67a752778fbcfe029a71da82b5e" },
+  { identifier = "pp311-macosx_arm64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_arm64.tar.bz2", sha256 = "4747b3aceba4c1c6104cddc0fe5ea302101d32955f0957347b9ecc4fbd7aed05" },
+  { identifier = "gp312_250-macosx_x86_64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.1/graalpy-25.0.1-macos-amd64.tar.gz", sha256 = "10b0721d52397f0cc85f038900318da2203711cbcfae7899e3faed49d3dc6221" },
+  { identifier = "gp312_250-macosx_arm64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-macos-aarch64.tar.gz", sha256 = "387d9f5b376860842bea4d55aae5820974f3f3b68fc36c77ae863a061a888857" },
 ]
 
 [windows]
@@ -198,10 +194,10 @@ python_configurations = [
   { identifier = "cp314t-win32", version = "3.14.5" },
   { identifier = "cp314-win_amd64", version = "3.14.5" },
   { identifier = "cp314t-win_amd64", version = "3.14.5" },
-  { identifier = "cp315-win32", version = "3.15.0-b1" },
-  { identifier = "cp315t-win32", version = "3.15.0-b1" },
-  { identifier = "cp315-win_amd64", version = "3.15.0-b1" },
-  { identifier = "cp315t-win_amd64", version = "3.15.0-b1" },
+  { identifier = "cp315-win32", version = "3.15.0-b2" },
+  { identifier = "cp315t-win32", version = "3.15.0-b2" },
+  { identifier = "cp315-win_amd64", version = "3.15.0-b2" },
+  { identifier = "cp315t-win_amd64", version = "3.15.0-b2" },
   { identifier = "cp39-win_arm64", version = "3.9.10" },
   { identifier = "cp310-win_arm64", version = "3.10.11" },
   { identifier = "cp311-win_arm64", version = "3.11.9" },
@@ -209,41 +205,40 @@ python_configurations = [
   { identifier = "cp313-win_arm64", version = "3.13.13" },
   { identifier = "cp314-win_arm64", version = "3.14.5" },
   { identifier = "cp314t-win_arm64", version = "3.14.5" },
-  { identifier = "cp315-win_arm64", version = "3.15.0-b1" },
-  { identifier = "cp315t-win_arm64", version = "3.15.0-b1" },
-  { identifier = "pp39-win_amd64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-win64.zip" },
-  { identifier = "pp310-win_amd64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-win64.zip" },
-  { identifier = "pp311-win_amd64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-win64.zip" },
-  { identifier = "gp311_242-win_amd64", version = "3.11", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.2/graalpy-24.2.2-windows-amd64.zip" },
-  { identifier = "gp312_250-win_amd64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-windows-amd64.zip" },
+  { identifier = "cp315-win_arm64", version = "3.15.0-b2" },
+  { identifier = "cp315t-win_arm64", version = "3.15.0-b2" },
+  { identifier = "pp39-win_amd64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-win64.zip", sha256 = "06ec12a5e964dc0ad33e6f380185a4d295178dce6d6df512f508e7aee00a1323" },
+  { identifier = "pp310-win_amd64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-win64.zip", sha256 = "c0d07bba6c8fb4e5804f4a8b3f8ef07cc3d89f6ad1db42a45ffb9be60bbb7cc2" },
+  { identifier = "pp311-win_amd64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-win64.zip", sha256 = "948b8ea58dea5b9917210fe4afd242c788fbfaba1c3f1a25e696a404f703389a" },
+  { identifier = "gp312_250-win_amd64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-windows-amd64.zip", sha256 = "2ae5c42b93e08d9e106a017634a3442b272ccae6d08ace157244de0449e937d4" },
 ]
 
 [pyodide]
 python_configurations = [
-  { identifier = "cp312-pyodide_wasm32", version = "3.12", default_pyodide_version = "0.27.7", node_version = "v22" },
-  { identifier = "cp313-pyodide_wasm32", version = "3.13", default_pyodide_version = "0.29.4", node_version = "v22" },
-  { identifier = "cp314-pyodide_wasm32", version = "3.14", default_pyodide_version = "314.0.0a2", node_version = "v24" },
+  { identifier = "cp312-pyodide_wasm32", version = "3.12", default_pyodide_version = "0.27.7", node_version = "v22", sha256 = "0c2e7db42efa5d1dac38b50f8b3d659a1e3885d0a233494831b8206281307d52" },
+  { identifier = "cp313-pyodide_wasm32", version = "3.13", default_pyodide_version = "0.29.4", node_version = "v22", sha256 = "a29fc4a076408a18fc29eb4b280f80c6dddc95c19514c874c29e590d0931c02a" },
+  { identifier = "cp314-pyodide_wasm32", version = "3.14", default_pyodide_version = "314.0.0a2", node_version = "v24", sha256 = "ac7bbcdf289ab3ae25621c436b1d013099ef6bec644ad0538dae5d65552c5c95" },
 ]
 
 [android]
 python_configurations = [
-  { identifier = "cp313-android_arm64_v8a", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-aarch64-linux-android.tar.gz" },
-  { identifier = "cp313-android_x86_64", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-x86_64-linux-android.tar.gz" },
-  { identifier = "cp314-android_arm64_v8a", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-aarch64-linux-android.tar.gz" },
-  { identifier = "cp314-android_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-x86_64-linux-android.tar.gz" },
-  { identifier = "cp315-android_arm64_v8a", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-aarch64-linux-android.tar.gz" },
-  { identifier = "cp315-android_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-x86_64-linux-android.tar.gz" },
+  { identifier = "cp313-android_arm64_v8a", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-aarch64-linux-android.tar.gz", sha256 = "a21250c246b36eb704be096be51e40ab24cafa3ae1d7ca4c396e6bf780cf87cf" },
+  { identifier = "cp313-android_x86_64", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-x86_64-linux-android.tar.gz", sha256 = "b021b76df2c8d64e41c76d18a2d91f27652356bd932c06f9076bac1b664c0e37" },
+  { identifier = "cp314-android_arm64_v8a", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-aarch64-linux-android.tar.gz", sha256 = "f008321abf837fcaec569df143283ece0e764b18d8c75763200160553f906af1" },
+  { identifier = "cp314-android_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-x86_64-linux-android.tar.gz", sha256 = "36184e31464b2b959d92c81ded8d025834342cc080623bced282a2a9a57bd47c" },
+  { identifier = "cp315-android_arm64_v8a", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-aarch64-linux-android.tar.gz", sha256 = "de5e36ffc3c33b63a1ed53fe83db4dee16b003a3180ac35e5c4c203d3750e076" },
+  { identifier = "cp315-android_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-x86_64-linux-android.tar.gz", sha256 = "e05ef9c142ea83b41b194b16014ffe2249d27783313c3b00b97f6c93d9a56b92" },
 ]
 
 [ios]
 python_configurations = [
-  { identifier = "cp313-ios_arm64_iphoneos", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz" },
-  { identifier = "cp313-ios_x86_64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz" },
-  { identifier = "cp313-ios_arm64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz" },
-  { identifier = "cp314-ios_arm64_iphoneos", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz" },
-  { identifier = "cp314-ios_x86_64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz" },
-  { identifier = "cp314-ios_arm64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz" },
-  { identifier = "cp315-ios_arm64_iphoneos", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-iOS-XCframework.tar.gz" },
-  { identifier = "cp315-ios_x86_64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-iOS-XCframework.tar.gz" },
-  { identifier = "cp315-ios_arm64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b1-iOS-XCframework.tar.gz" },
+  { identifier = "cp313-ios_arm64_iphoneos", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
+  { identifier = "cp313-ios_x86_64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
+  { identifier = "cp313-ios_arm64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
+  { identifier = "cp314-ios_arm64_iphoneos", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
+  { identifier = "cp314-ios_x86_64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
+  { identifier = "cp314-ios_arm64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
+  { identifier = "cp315-ios_arm64_iphoneos", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
+  { identifier = "cp315-ios_x86_64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
+  { identifier = "cp315-ios_arm64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
 ]

cibuildwheel/resources/cibuildwheel.schema.json

@@ -460,6 +460,34 @@
       ],
       "title": "CIBW_XBUILD_TOOLS"
     },
+    "xbuild-files": {
+      "description": "Platform-specific files in the build environment",
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "patternProperties": {
+            ".+": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ]
+            }
+          }
+        }
+      ],
+      "title": "CIBW_XBUILD_FILES"
+    },
     "pyodide-version": {
       "type": "string",
       "description": "Specify the version of Pyodide to use",
@@ -679,6 +707,9 @@
               "xbuild-tools": {
                 "$ref": "#/$defs/inherit"
               },
+              "xbuild-files": {
+                "$ref": "#/$defs/inherit"
+              },
               "before-test": {
                 "$ref": "#/$defs/inherit"
               },
@@ -807,6 +838,9 @@
           "xbuild-tools": {
             "$ref": "#/properties/xbuild-tools"
           },
+          "xbuild-files": {
+            "$ref": "#/properties/xbuild-files"
+          },
           "pyodide-version": {
             "$ref": "#/properties/pyodide-version"
           },
@@ -931,6 +965,9 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
@@ -1013,11 +1050,27 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
         "repair-wheel-command": {
-          "$ref": "#/properties/repair-wheel-command"
+          "description": "Execute a shell command to repair each built wheel.",
+          "oneOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "title": "CIBW_REPAIR_WHEEL_COMMAND",
+          "default": "delvewheel repair -w {dest_dir} -v {wheel}"
         },
         "test-command": {
           "$ref": "#/properties/test-command"
@@ -1082,6 +1135,9 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
@@ -1164,6 +1220,9 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
@@ -1233,11 +1292,27 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
         "repair-wheel-command": {
-          "$ref": "#/properties/repair-wheel-command"
+          "description": "Execute a shell command to repair each built wheel.",
+          "oneOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "title": "CIBW_REPAIR_WHEEL_COMMAND",
+          "default": "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"
         },
         "test-command": {
           "$ref": "#/properties/test-command"
@@ -1302,6 +1377,9 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },

cibuildwheel/resources/constraints-pyodide312.txt

@@ -2,7 +2,7 @@
 #    nox -s update_constraints
 annotated-types==0.7.0
     # via pydantic
-auditwheel-emscripten==0.2.4
+auditwheel-emscripten==0.2.5
     # via pyodide-build
 build==1.5.0
     # via
@@ -17,13 +17,13 @@ click==8.1.8
     #   -r .nox/update_constraints/tmp/constraints-pyodide.in
     #   pyodide-build
     #   pyodide-cli
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via requests
 leb128==1.0.9
     # via auditwheel-emscripten
@@ -37,9 +37,9 @@ packaging==26.2
     #   build
     #   pyodide-build
     #   wheel
-pip==26.1.1
+pip==26.1.2
     # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.9.6
+platformdirs==4.10.0
     # via
     #   pyodide-build
     #   python-discovery
@@ -62,7 +62,7 @@ pyodide-lock==0.1.3
     # via pyodide-build
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via pyodide-build
@@ -81,7 +81,7 @@ typing-inspection==0.4.2
     # via pydantic
 urllib3==2.7.0
     # via requests
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via
     #   build
     #   pyodide-build

cibuildwheel/resources/constraints-pyodide313.txt

@@ -2,7 +2,7 @@
 #    nox -s update_constraints
 annotated-types==0.7.0
     # via pydantic
-auditwheel-emscripten==0.2.4
+auditwheel-emscripten==0.2.5
     # via pyodide-build
 build==1.5.0
     # via
@@ -17,13 +17,13 @@ click==8.1.8
     #   -r .nox/update_constraints/tmp/constraints-pyodide.in
     #   pyodide-build
     #   pyodide-cli
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via requests
 leb128==1.0.9
     # via auditwheel-emscripten
@@ -37,9 +37,9 @@ packaging==26.2
     #   build
     #   pyodide-build
     #   wheel
-pip==26.1.1
+pip==26.1.2
     # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.9.6
+platformdirs==4.10.0
     # via
     #   pyodide-build
     #   python-discovery
@@ -62,7 +62,7 @@ pyodide-lock==0.1.3
     # via pyodide-build
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via pyodide-build
@@ -81,7 +81,7 @@ typing-inspection==0.4.2
     # via pydantic
 urllib3==2.7.0
     # via requests
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via
     #   build
     #   pyodide-build

cibuildwheel/resources/constraints-pyodide314.txt

@@ -2,7 +2,7 @@
 #    nox -s update_constraints
 annotated-types==0.7.0
     # via pydantic
-auditwheel-emscripten==0.2.4
+auditwheel-emscripten==0.2.5
     # via pyodide-build
 build==1.5.0
     # via
@@ -17,13 +17,13 @@ click==8.1.8
     #   -r .nox/update_constraints/tmp/constraints-pyodide.in
     #   pyodide-build
     #   pyodide-cli
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via requests
 leb128==1.0.9
     # via auditwheel-emscripten
@@ -37,9 +37,9 @@ packaging==26.2
     #   build
     #   pyodide-build
     #   wheel
-pip==26.1.1
+pip==26.1.2
     # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.9.6
+platformdirs==4.10.0
     # via
     #   pyodide-build
     #   python-discovery
@@ -62,7 +62,7 @@ pyodide-lock==0.1.3
     # via pyodide-build
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via pyodide-build
@@ -81,7 +81,7 @@ typing-inspection==0.4.2
     # via pydantic
 urllib3==2.7.0
     # via requests
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via
     #   build
     #   pyodide-build

cibuildwheel/resources/constraints-python310.txt

@@ -10,6 +10,8 @@ attrs==26.1.0
     # via
     #   cattrs
     #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
     # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
@@ -20,17 +22,17 @@ charset-normalizer==3.4.7
     # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-delvewheel==1.12.1
+delvewheel==1.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
 exceptiongroup==1.3.1
     # via cattrs
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via
     #   requests
     #   url-normalize
@@ -47,26 +49,33 @@ mdurl==0.1.2
 packaging==26.2
     # via
     #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
-pip==26.1.1
+pip==26.1.2
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
     #   requests-cache
     #   virtualenv
-pyelftools==0.32
-    # via abi3audit
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
 pygments==2.20.0
     # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via
@@ -90,7 +99,7 @@ urllib3==2.7.0
     # via
     #   requests
     #   requests-cache
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in
 zipp==4.1.0
     # via importlib-metadata

cibuildwheel/resources/constraints-python311.txt

@@ -10,6 +10,8 @@ attrs==26.1.0
     # via
     #   cattrs
     #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
     # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
@@ -20,15 +22,15 @@ charset-normalizer==3.4.7
     # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-delvewheel==1.12.1
+delvewheel==1.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via
     #   requests
     #   url-normalize
@@ -43,27 +45,34 @@ mdurl==0.1.2
 packaging==26.2
     # via
     #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
+pip==26.1.2; implementation_name != "graalpy" or platform_system != "Windows"
 pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
     #   requests-cache
     #   virtualenv
-pyelftools==0.32
-    # via abi3audit
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
 pygments==2.20.0
     # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via
@@ -83,5 +92,5 @@ urllib3==2.7.0
     # via
     #   requests
     #   requests-cache
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python312.txt

@@ -10,6 +10,8 @@ attrs==26.1.0
     # via
     #   cattrs
     #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
     # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
@@ -20,15 +22,15 @@ charset-normalizer==3.4.7
     # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-delvewheel==1.12.1
+delvewheel==1.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via
     #   requests
     #   url-normalize
@@ -43,27 +45,34 @@ mdurl==0.1.2
 packaging==26.2
     # via
     #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
+pip==26.1.2; implementation_name != "graalpy" or platform_system != "Windows"
 pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
     #   requests-cache
     #   virtualenv
-pyelftools==0.32
-    # via abi3audit
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
 pygments==2.20.0
     # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via
@@ -83,5 +92,5 @@ urllib3==2.7.0
     # via
     #   requests
     #   requests-cache
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python313.txt

@@ -10,6 +10,8 @@ attrs==26.1.0
     # via
     #   cattrs
     #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
     # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
@@ -20,15 +22,15 @@ charset-normalizer==3.4.7
     # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-delvewheel==1.12.1
+delvewheel==1.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via
     #   requests
     #   url-normalize
@@ -43,26 +45,33 @@ mdurl==0.1.2
 packaging==26.2
     # via
     #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
-pip==26.1.1
+pip==26.1.2
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
     #   requests-cache
     #   virtualenv
-pyelftools==0.32
-    # via abi3audit
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
 pygments==2.20.0
     # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via
@@ -82,5 +91,5 @@ urllib3==2.7.0
     # via
     #   requests
     #   requests-cache
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python314.txt

@@ -10,6 +10,8 @@ attrs==26.1.0
     # via
     #   cattrs
     #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
     # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
@@ -20,15 +22,15 @@ charset-normalizer==3.4.7
     # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-delvewheel==1.12.1
+delvewheel==1.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via
     #   requests
     #   url-normalize
@@ -43,26 +45,33 @@ mdurl==0.1.2
 packaging==26.2
     # via
     #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
-pip==26.1.1
+pip==26.1.2
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
     #   requests-cache
     #   virtualenv
-pyelftools==0.32
-    # via abi3audit
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
 pygments==2.20.0
     # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via
@@ -82,5 +91,5 @@ urllib3==2.7.0
     # via
     #   requests
     #   requests-cache
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python315.txt

@@ -10,6 +10,8 @@ attrs==26.1.0
     # via
     #   cattrs
     #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
     # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
@@ -20,15 +22,15 @@ charset-normalizer==3.4.7
     # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-delvewheel==1.12.1
+delvewheel==1.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via
     #   requests
     #   url-normalize
@@ -43,26 +45,33 @@ mdurl==0.1.2
 packaging==26.2
     # via
     #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
-pip==26.1.1
+pip==26.1.2
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
     #   requests-cache
     #   virtualenv
-pyelftools==0.32
-    # via abi3audit
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
 pygments==2.20.0
     # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via
@@ -82,5 +91,5 @@ urllib3==2.7.0
     # via
     #   requests
     #   requests-cache
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python39.txt

@@ -10,6 +10,8 @@ attrs==26.1.0
     # via
     #   cattrs
     #   requests-cache
+auditwheel==6.4.2
+    # via -r cibuildwheel/resources/constraints.in
 build==1.4.4
     # via -r cibuildwheel/resources/constraints.in
 cattrs==25.3.0
@@ -20,9 +22,9 @@ charset-normalizer==3.4.7
     # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-delvewheel==1.12.1
+delvewheel==1.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
 exceptiongroup==1.3.1
     # via cattrs
@@ -30,12 +32,14 @@ filelock==3.19.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via
     #   requests
     #   url-normalize
 importlib-metadata==8.7.1
-    # via build
+    # via
+    #   build
+    #   pkgconf
 kaitaistruct==0.11
     # via abi3audit
 macholib==1.16.4
@@ -47,26 +51,33 @@ mdurl==0.1.2
 packaging==25.0
     # via
     #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
 pip==26.0.1
     # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.4.3.post2
+    # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.4.0
     # via
     #   python-discovery
     #   requests-cache
     #   virtualenv
 pyelftools==0.32
-    # via abi3audit
+    # via
+    #   abi3audit
+    #   auditwheel
 pygments==2.20.0
     # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.32.5
     # via
@@ -90,7 +101,7 @@ urllib3==2.6.3
     # via
     #   requests
     #   requests-cache
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in
 zipp==3.23.1
     # via importlib-metadata

cibuildwheel/resources/constraints.in

@@ -4,3 +4,8 @@ delocate
 delvewheel
 virtualenv
 abi3audit
+
+# Android
+auditwheel
+patchelf
+pkgconf

cibuildwheel/resources/constraints.txt

@@ -10,6 +10,8 @@ attrs==26.1.0
     # via
     #   cattrs
     #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
     # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
@@ -20,15 +22,15 @@ charset-normalizer==3.4.7
     # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-delvewheel==1.12.1
+delvewheel==1.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.16
+idna==3.18
     # via
     #   requests
     #   url-normalize
@@ -43,26 +45,33 @@ mdurl==0.1.2
 packaging==26.2
     # via
     #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
-pip==26.1.1
+pip==26.1.2
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
     #   requests-cache
     #   virtualenv
-pyelftools==0.32
-    # via abi3audit
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
 pygments==2.20.0
     # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.1
+python-discovery==1.4.0
     # via virtualenv
 requests==2.34.2
     # via
@@ -82,5 +91,5 @@ urllib3==2.7.0
     # via
     #   requests
     #   requests-cache
-virtualenv==21.3.3
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/defaults.toml

@@ -1,3 +1,6 @@
+# These are the defaults used by cibuildwheel itself. They should match the values in
+# generate_schema.py, which are used by external tools for validation and IDE support.
+
 [tool.cibuildwheel]
 build = "*"
 skip = ""
@@ -52,6 +55,13 @@ musllinux-s390x-image = "musllinux_1_2"
 musllinux-armv7l-image = "musllinux_1_2"
 musllinux-riscv64-image = "musllinux_1_2"
 
+[tool.cibuildwheel.xbuild-files]
+numpy = [
+    "numpy/_core/include/numpy/_numpyconfig.h",
+    "numpy/_core/include/numpy/numpyconfig.h",
+    "numpy/_core/lib/libnpymath.a",
+    "numpy/random/lib/libnpyrandom.a",
+]
 
 [tool.cibuildwheel.linux]
 repair-wheel-command = "auditwheel repair -w {dest_dir} {wheel}"
@@ -63,6 +73,7 @@ repair-wheel-command = "delocate-wheel --require-archs {delocate_archs} -w {dest
 repair-wheel-command = "delvewheel repair -w {dest_dir} -v {wheel}"
 
 [tool.cibuildwheel.android]
+repair-wheel-command = "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"
 
 [tool.cibuildwheel.ios]
 

cibuildwheel/resources/pinned_docker_images.cfg

@@ -1,54 +1,54 @@
 [x86_64]
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.05.27-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.05.27-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.05.27-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_x86_64:2026.05.27-1
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.06.04-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.06.04-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.06.04-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_x86_64:2026.06.04-1
 
 [i686]
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.05.27-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.05.27-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.05.27-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_i686:2026.05.27-1
+manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.06.04-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.06.04-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.06.04-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_i686:2026.06.04-1
 
 [aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.05.27-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.05.27-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.05.27-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_aarch64:2026.05.27-1
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.06.04-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.06.04-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.06.04-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_aarch64:2026.06.04-1
 
 [ppc64le]
-manylinux2014 = quay.io/pypa/manylinux2014_ppc64le:2026.05.27-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_ppc64le:2026.05.27-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_ppc64le:2026.05.27-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_ppc64le:2026.05.27-1
+manylinux2014 = quay.io/pypa/manylinux2014_ppc64le:2026.06.04-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_ppc64le:2026.06.04-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_ppc64le:2026.06.04-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_ppc64le:2026.06.04-1
 
 [s390x]
-manylinux2014 = quay.io/pypa/manylinux2014_s390x:2026.05.27-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_s390x:2026.05.27-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_s390x:2026.05.27-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_s390x:2026.05.27-1
+manylinux2014 = quay.io/pypa/manylinux2014_s390x:2026.06.04-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_s390x:2026.06.04-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_s390x:2026.06.04-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_s390x:2026.06.04-1
 
 [pypy_x86_64]
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.05.27-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.05.27-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.05.27-1
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.06.04-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.06.04-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.06.04-1
 
 [pypy_i686]
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.05.27-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.05.27-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.05.27-1
+manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.06.04-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.06.04-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.06.04-1
 
 [pypy_aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.05.27-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.05.27-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.05.27-1
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.06.04-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.06.04-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.06.04-1
 
 [armv7l]
-manylinux_2_31 = quay.io/pypa/manylinux_2_31_armv7l:2026.05.27-1
-manylinux_2_35 = quay.io/pypa/manylinux_2_35_armv7l:2026.05.27-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_armv7l:2026.05.27-1
+manylinux_2_31 = quay.io/pypa/manylinux_2_31_armv7l:2026.06.04-1
+manylinux_2_35 = quay.io/pypa/manylinux_2_35_armv7l:2026.06.04-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_armv7l:2026.06.04-1
 
 [riscv64]
-manylinux_2_39 = quay.io/pypa/manylinux_2_39_riscv64:2026.05.27-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_riscv64:2026.05.27-1
+manylinux_2_39 = quay.io/pypa/manylinux_2_39_riscv64:2026.06.04-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_riscv64:2026.06.04-1
 

cibuildwheel/resources/virtualenv.toml

@@ -1 +1 @@
-default = { version = "21.3.3", url = "https://github.com/pypa/get-virtualenv/releases/download/21.3.3/virtualenv.pyz" }
+default = { version = "21.4.2", url = "https://github.com/pypa/get-virtualenv/releases/download/21.4.2/virtualenv.pyz", sha256 = "b54c48b9c81468403626762747c5ee5939616f18f46c3c4bbebdbe0aa3a8ba1d" }

cibuildwheel/util/file.py

@@ -1,11 +1,13 @@
 from __future__ import annotations
 
+import hashlib
 import os
 import shutil
 import ssl
 import tarfile
 import time
 import urllib.request
+from contextlib import contextmanager
 from pathlib import Path, PurePath
 from typing import Final
 from zipfile import ZipFile
@@ -17,7 +19,7 @@ from cibuildwheel.errors import FatalError
 
 TYPE_CHECKING = False
 if TYPE_CHECKING:
-    from collections.abc import Callable
+    from collections.abc import Callable, Generator
 
 DEFAULT_CIBW_CACHE_PATH: Final[Path] = user_cache_path(appname="cibuildwheel", appauthor="pypa")
 CIBW_CACHE_PATH: Final[Path] = Path(
@@ -25,6 +27,22 @@ CIBW_CACHE_PATH: Final[Path] = Path(
 ).resolve()
 
 
+@contextmanager
+def remove_on_error(path: Path) -> Generator[None, None, None]:
+    try:
+        yield
+    except BaseException as original_exception:
+        try:
+            if path.is_dir() and not path.is_symlink():
+                shutil.rmtree(path)
+            elif path.exists() or path.is_symlink():
+                path.unlink()
+        except BaseException as cleanup_exception:
+            msg = f"Failed to remove {path}. Please remove it manually."
+            raise BaseExceptionGroup(msg, [original_exception, cleanup_exception]) from None
+        raise
+
+
 def ensure_cache_sentinel(cache_path: Path) -> None:
     """Create a sentinel file to mark a cibuildwheel cache directory.
 
@@ -45,7 +63,7 @@ def ensure_cache_sentinel(cache_path: Path) -> None:
             )
 
 
-def download(url: str, dest: Path) -> None:
+def download(url: str, dest: Path, *, sha256: str | None = None) -> None:
     print(f"+ Download {url} to {dest}")
     dest_dir = dest.parent
     dest_dir.mkdir(parents=True, exist_ok=True)
@@ -59,13 +77,20 @@ def download(url: str, dest: Path) -> None:
         try:
             with urllib.request.urlopen(url, context=context) as response:
                 dest.write_bytes(response.read())
-                return
+                break
 
         except OSError:
             if i == repeat_num - 1:
                 raise
             time.sleep(3)
 
+    if sha256:
+        computed = hashlib.sha256(dest.read_bytes()).hexdigest()
+        if computed != sha256:
+            dest.unlink(missing_ok=True)
+            msg = f"SHA256 mismatch for {url}: expected {sha256!r}, got {computed!r}"
+            raise FatalError(msg)
+
 
 def extract_zip(zip_src: Path, dest: Path) -> None:
     """Extracts a zip and correctly sets permissions on extracted files.

cibuildwheel/util/helpers.py

@@ -109,7 +109,7 @@ def parse_key_value_string(
     if kw_arg_names is None:
         kw_arg_names = []
 
-    all_field_names = [*positional_arg_names, *kw_arg_names]
+    all_field_names = None if ("*" in kw_arg_names) else [*positional_arg_names, *kw_arg_names]
 
     shlexer = shlex.shlex(key_value_string, posix=True, punctuation_chars=";")
     shlexer.commenters = ""
@@ -126,7 +126,7 @@ def parse_key_value_string(
         # check to see if the option name is specified
         field_name, sep, first_value = field[0].partition(":")
         if sep:
-            if field_name not in all_field_names:
+            if (all_field_names is not None) and (field_name not in all_field_names):
                 msg = f"Failed to parse {key_value_string!r}. Unknown field name {field_name!r}"
                 raise ValueError(msg)
 

cibuildwheel/util/python_build_standalone.py

@@ -2,13 +2,15 @@ from __future__ import annotations
 
 import fnmatch
 import functools
+import hashlib
 import json
 import platform
+import subprocess
 import typing
 
 from filelock import FileLock
 
-from cibuildwheel.util.file import download, extract_tar
+from cibuildwheel.util.file import download, extract_tar, remove_on_error
 from cibuildwheel.util.resources import PYTHON_BUILD_STANDALONE_RELEASES
 
 TYPE_CHECKING = False
@@ -19,6 +21,7 @@ if TYPE_CHECKING:
 class PythonBuildStandaloneAsset(typing.TypedDict):
     name: str
     url: str
+    sha256: str
 
 
 class PythonBuildStandaloneRelease(typing.TypedDict):
@@ -40,6 +43,26 @@ class PythonBuildStandaloneError(Exception):
     """Errors related to python-build-standalone."""
 
 
+def _is_musl_libc() -> bool:
+    """
+    Detect whether the host uses musl libc (e.g. Alpine Linux).
+
+    ``platform.libc_ver()`` only ever reports glibc, so we shell out to ``ldd``,
+    which prints "musl libc" on musl-based systems (and "GNU libc"/"GLIBC" on
+    glibc systems). If ``ldd`` is unavailable, we fall back to assuming glibc.
+    """
+    try:
+        ldd = subprocess.run(
+            ["ldd", "--version"],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except OSError:
+        return False
+    return "musl" in (ldd.stdout + ldd.stderr).lower()
+
+
 def _get_platform_identifiers() -> tuple[str, str, str | None]:
     """
     Detects the current platform and returns architecture, platform, and libc
@@ -65,7 +88,7 @@ def _get_platform_identifiers() -> tuple[str, str, str | None]:
     # Map OS + Libc
     if system == "Linux":
         platform_identifier = "unknown-linux"
-        libc_identifier = "musl" if "musl" in (platform.libc_ver() or ("", "")) else "gnu"
+        libc_identifier = "musl" if _is_musl_libc() else "gnu"
     elif system == "Darwin":
         platform_identifier = "apple-darwin"
     elif system == "Windows":
@@ -86,8 +109,8 @@ def _get_pbs_asset(
     arch_identifier: str,
     platform_identifier: str,
     libc_identifier: str | None,
-) -> tuple[str, str, str]:
-    """Finds the asset, returning (tag, filename, url)."""
+) -> tuple[str, str, str, str]:
+    """Finds the asset, returning (tag, url, filename, sha256)."""
     release_data = get_python_build_standalone_release_data()
 
     expected_suffix = f"{arch_identifier}-{platform_identifier}"
@@ -105,22 +128,37 @@ def _get_pbs_asset(
                 continue
 
             asset_url = asset["url"]
-            return release["tag"], asset_url, asset_name
+            asset_sha256 = asset.get("sha256", "")
+            return release["tag"], asset_url, asset_name, asset_sha256
 
     # If loop completes without finding a match
     msg = f"Could not find python-build-standalone release asset matching {asset_pattern!r}."
     raise PythonBuildStandaloneError(msg)
 
 
-def _download_or_get_from_cache(asset_url: str, asset_filename: str, cache_dir: Path) -> Path:
+def _download_or_get_from_cache(
+    asset_url: str, asset_filename: str, cache_dir: Path, sha256: str = ""
+) -> Path:
     with FileLock(cache_dir / (asset_filename + ".lock")):
         asset_cache_path = cache_dir / asset_filename
         if asset_cache_path.is_file():
+            if sha256:
+                computed = hashlib.sha256(asset_cache_path.read_bytes()).hexdigest()
+                if computed != sha256:
+                    print(
+                        f"Cached python_build_standalone SHA256 mismatch for {asset_cache_path}; redownloading."
+                    )
+                    asset_cache_path.unlink(missing_ok=True)
+                else:
+                    print(f"Using cached python_build_standalone: {asset_cache_path}")
+                    return asset_cache_path
+            else:
                 print(f"Using cached python_build_standalone: {asset_cache_path}")
                 return asset_cache_path
 
         print(f"Downloading python_build_standalone: {asset_url} to {asset_cache_path}")
-        download(asset_url, asset_cache_path)
+        with remove_on_error(asset_cache_path):
+            download(asset_url, asset_cache_path, sha256=sha256 or None)
         return asset_cache_path
 
 
@@ -166,7 +204,7 @@ def create_python_build_standalone_environment(
 
     arch_id, platform_id, libc_id = _get_platform_identifiers()
 
-    pbs_tag, asset_url, asset_filename = _get_pbs_asset(
+    pbs_tag, asset_url, asset_filename, asset_sha256 = _get_pbs_asset(
         python_version=python_version,
         arch_identifier=arch_id,
         platform_identifier=platform_id,
@@ -176,7 +214,7 @@ def create_python_build_standalone_environment(
     print(f"Using python-build-standalone release: {pbs_tag}")
 
     archive_path = _download_or_get_from_cache(
-        asset_url=asset_url, asset_filename=asset_filename, cache_dir=cache_dir
+        asset_url=asset_url, asset_filename=asset_filename, cache_dir=cache_dir, sha256=asset_sha256
     )
 
     python_base_dir = temp_dir / "pbs"

cibuildwheel/util/resources.py

@@ -31,7 +31,14 @@ IOS_SUPPORT_FILES: Final[Path] = PATH / "ios-support"
 def read_all_configs() -> dict[str, list[dict[str, str]]]:
     with BUILD_PLATFORMS.open("rb") as f:
         loaded_file = tomllib.load(f)
-    return {k: list[dict[str, str]](v["python_configurations"]) for k, v in loaded_file.items()}
+    configs = {k: list[dict[str, str]](v["python_configurations"]) for k, v in loaded_file.items()}
+    for platform, python_configs in configs.items():
+        for config in python_configs:
+            if "url" in config and not config.get("sha256"):
+                identifier = config["identifier"]
+                msg = f"{platform} Python configuration {identifier!r} is missing a sha256"
+                raise ValueError(msg)
+    return configs
 
 
 def read_python_configs(config: PlatformName) -> list[dict[str, str]]:

cibuildwheel/venv.py

@@ -16,7 +16,7 @@ from packaging.version import Version
 
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call
-from cibuildwheel.util.file import CIBW_CACHE_PATH, download
+from cibuildwheel.util.file import CIBW_CACHE_PATH, download, remove_on_error
 
 TYPE_CHECKING = False
 if TYPE_CHECKING:
@@ -53,10 +53,12 @@ def _ensure_virtualenv(version: str) -> tuple[Path, Version]:
     configuration = loaded_file.get(key, loaded_file["default"])
     version = str(configuration["version"])
     url = str(configuration["url"])
+    sha256 = str(configuration["sha256"])
     path = CIBW_CACHE_PATH / f"virtualenv-{version}.pyz"
     with FileLock(str(path) + ".lock"):
         if not path.exists():
-            download(url, path)
+            with remove_on_error(path):
+                download(url, path, sha256=sha256)
     return (path, Version(version))
 
 
@@ -83,7 +85,7 @@ def _parse_pip_constraint_for_virtualenv(
     If it can't get an exact version, the real constraint will be handled by the
     {macos|windows}.setup_python function.
     If marker_env is provided, marker-bearing constraints are evaluated against it;
-    otherwise, marker-bearing constraints are skipped.
+    otherwise, they are evaluated against the host's default environment.
     """
     env: dict[str, str] = (
         marker_env if marker_env is not None else cast("dict[str, str]", default_environment())

docs/_internal/pyodide-maintenance.md

@@ -28,10 +28,10 @@ For example, consider a scenario when Pyodide ships a new `315.0.0a1` with cp315
 In `cibuildwheel/resources/build-platforms.toml`, add an entry under `[pyodide]`:
 
 ```toml
-{ identifier = "cp315-pyodide_wasm32", version = "3.15", default_pyodide_version = "315.0.0a1", node_version = "v24" },
+{ identifier = "cp315-pyodide_wasm32", version = "3.15", default_pyodide_version = "315.0.0a1", node_version = "v24", sha256 = "SHA256" },
 ```
 
-`version` is the CPython version string, `default_pyodide_version` is the Pyodide release to use when the user does not pin one explicitly (use the latest available alpha/beta for a prerelease entry), and `node_version` is the minimum Node.js major required by that Pyodide release — check the [pyodide-build FAQ](https://pyodide-build.readthedocs.io/en/latest/faq.html#what-node-js-version-do-i-need) for a rudimentary idea of what the correct value is.
+`version` is the CPython version string, `default_pyodide_version` is the Pyodide release to use when the user does not pin one explicitly (use the latest available alpha/beta for a prerelease entry), and `node_version` is the minimum Node.js major required by that Pyodide release — check the [pyodide-build FAQ](https://pyodide-build.readthedocs.io/en/latest/faq.html#what-node-js-version-do-i-need) for a rudimentary idea of what the correct value is. `sha256` is the checksum of the Pyodide xbuildenv tarball.
 
 ### 2. Update the prerelease guards in the selector
 

docs/changelog.md

@@ -1,36 +1,64 @@
 ---
 title: Changelog
+ref: changelog
 ---
 
 # Changelog
 
-### v4.0.0rc1
+### v4.0.0
 
-_14 May 2026_
+_7 June 2026_
+
+See @henryiii's [release post](https://iscinumpy.dev/post/cibuildwheel-4-0-0/) for more info on new features!
 
 - 🌟 Adds wheel auditing with `abi3audit` as a default after the repair step, with new [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) and [`audit-command`](https://cibuildwheel.pypa.io/en/stable/options/#audit-command) options (#2805)
-- 🌟 Adds `pyemscripten` platform tag support (PEP 783), updates Pyodide to 314.0.0a1, and adds a `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) flag for building end-of-life Pyodide versions (#2812, #2848)
+- 🌟 Adds `pyemscripten` platform tag support (PEP 783), updates Pyodide to 314.0.0a2, and adds a `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) flag for building end-of-life Pyodide versions (#2812, #2848)
 - 🌟 Sets up `delvewheel` as the default [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command) for Windows, so extension module DLLs are now bundled automatically. Skip by setting it to empty if not needed. (#2831)
 - ✨ Adds CPython 3.15 support, under the [`enable` option](https://cibuildwheel.pypa.io/en/stable/options/#enable) `cpython-prerelease`. This version of cibuildwheel uses 3.15.0b1. (#2833, #2850)
 
-    _While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.14 will be available in cibuildwheel without the flag._ (#2390)
+    _While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.15 will be available in cibuildwheel without the flag._
+- ✨ Adds CPython 3.15 support for iOS and Android (#2857, #2858)
+- ✨ Adds Android improvements for building NumPy and related packages, including auditwheel support, pkg-config and Fortran configuration, and the [`xbuild-files`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files) option (#2695)
+- ✨ Adds `CIBUILDWHEEL_BUILD_IDENTIFIER` environment variable set to the current build identifier (e.g. `cp311-manylinux_x86_64`) during per-build steps (#2872)
 - ✨ Adds `{project}` and `{package}` placeholders to [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) (#2827)
 - ⚠️ Drops support for Python 3.8 (#2686)
 - ⚠️ Removes the experimental CPython 3.13 free-threading builds and the `cpython-freethreading` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) option. CPython 3.14+ free-threading support remains available without the enable flag. (#2684)
 - ⚠️ Drops support for Cirrus CI, which is shutting down June 1, 2026 (#2817)
+- ⚠️ Drops GraalPy 3.11 (gp311) support, as agreed in #2741, and removes GraalPy 24-only workarounds (#2895)
+- 🔐 Adds SHA256 verification for direct downloads of Python interpreters, virtualenv, and python-build-standalone assets (#2873)
+- 🔐 Adds tarfile extraction filter for safe archive extraction (#2856)
 - 🐛 Fixes `UV_PYTHON` not being set for [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) on Linux when using `uv` as the [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) (#2830)
+- 🐛 Fixes detection of musl libc when downloading python-build-standalone, which previously always selected the gnu asset on musl hosts like Alpine (#2889)
+- 🐛 Fixes [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) expansion when `{project}` or `{package}` contains spaces or backslashes (#2886)
+- 🐛 Prevents deadlock when `linux32` fails and forwards platform args to the sanity check (#2880, #2888)
+- 🐛 Fixes container resource leaks on start failure and during teardown (#2879, #2887)
+- 🐛 Removes potential partial cache-population in case of error (#2892)
+- 🐛 Raises a clear error when `ANDROID_API_LEVEL` is not an integer (#2891)
+- 🐛 Replaces assert with proper exception in python-build-standalone (#2859)
+- 🐛 Uses ConfigurationError when `package_dir` is outside cwd instead of a generic Exception (#2898)
+- 🛠 Updates dependencies and container pins (#2893, #2882, #2874, #2868, #2862, #2884, #2845, #2837, #2818, #2810, #2838, #2813)
 - 🛠 Updates Android to Python 3.13.13 and 3.14.4 (#2821)
 - 🛠 Applies Pyodide-specific patches to the Emscripten toolchain installation (#2800)
-- 🛠 Updates dependencies and container pins (#2845, #2837, #2821, #2818, #2810, #2838, #2813)
 - 🛠 Uses `python -V -V` for Windows build diagnostics (#2832)
+- 🛠 Simplifies pinned container image lookup (#2897)
+- 🛠 Minor fixups across error messages, OCI container, and options (#2860)
+- 💼 Adds PEP 723 metadata for `bin/` scripts and drops the `bin` dependency group (#2819)
+- 💼 Improves Azure test reliability with retries and caching (#2890)
+- 💼 Fixes Windows GitLab CI test running (#2870)
+- 💼 Updates CI action pins and dev dependencies (#2902, #2867, #2851, #2843, #2826, #2823, #2820, #2807)
+- 💼 Adds agent and copilot setup files (#2861)
+- 💼 Uses `if TYPE_CHECKING:` blocks (#2866, #2864)
+- 🧪 Fixes Android tests using the `uv` frontend (#2809)
+- 🧪 Fixes the update-dependencies workflow to use `uv` to run `nox` (#2808)
+- 🧪 Adds unit tests for `OCIContainer._get_platform_args` (#2878)
+- 📚 Updates documentation for delvewheel as the default Windows [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command), including the build diagram, schema defaults, and legal note (#2877, #2853, #2891)
 - 📚 Documents platform-specific [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) configuration (#2834)
 - 📚 Updates the "How it works" diagram with details of Android, iOS, and Pyodide builds (#2816)
 - 📚 Adds Pyodide icon and regenerates working examples data for Android, iOS, and Pyodide (#2815, #2811)
+- 📚 Adds intersphinx support for external documentation linking (#2871)
+- 📚 Adds instructions for building CUDA wheels and fixes manylinux container references in FAQ (#2896, #2900)
 - 📚 Links back to source in docs (#2806)
-- 💼 Adds PEP 723 metadata for `bin/` scripts and drops the `bin` dependency group (#2819)
-- 💼 Updates CI action pins and dev dependencies (#2851, #2843, #2826, #2823, #2820, #2807)
-- 🧪 Fixes Android tests using the `uv` frontend (#2809)
-- 🧪 Fixes the update-dependencies workflow to use `uv` to run `nox` (#2808)
+- 📚 Removes outdated numpy info (#2855)
 
 
 ### v3.4.1

docs/ci-services.md

@@ -1,5 +1,6 @@
 ---
 title: Configuring a CI service
+ref: ci-services
 ---
 
 ## Configuring a CI service

docs/configuration.md

@@ -1,3 +1,8 @@
+---
+title: Configuration
+ref: configuration
+---
+
 # Configuration methods
 
 cibuildwheel can either be configured using environment variables, or from
@@ -58,8 +63,8 @@ cibuildwheel to run tests, add the following YAML to your CI config file:
 You can configure cibuildwheel with a config file, such as `pyproject.toml`.
 Options have the same names as the environment variable overrides, but are
 placed in `[tool.cibuildwheel]` and are lower case, with dashes, following
-common [TOML](https://toml.io) practice. Anything placed in subsections `linux`, `windows`,
-`macos`, or `pyodide` will only affect those platforms. Lists can be used
+common [TOML](https://toml.io) practice. Anything placed in subsections
+named after a platform will only affect those platforms. Lists can be used
 instead of strings for items that are naturally a list. Multiline strings also
 work just like in the environment variables. Environment variables will take
 precedence if defined.

docs/contributing.md

@@ -1,5 +1,6 @@
 ---
 title: Contributing
+ref: contributing
 ---
 
 # Contributing
@@ -26,7 +27,7 @@ Other notes:
 
 ### cibuildwheel's relationship with build errors
 
-cibuildwheel doesn't really do anything itself - it's always deferring to other tools (pip, wheel, auditwheel, delocate, docker). Without cibuildwheel, the process is really fragmented. Different tools, across different OSs need to be stitched together in just the right way to make it work.
+cibuildwheel doesn't really do anything itself - it's always deferring to other tools (pip, wheel, auditwheel, delocate, delvewheel, docker). Without cibuildwheel, the process is really fragmented. Different tools, across different OSs need to be stitched together in just the right way to make it work.
 
 We're not responsible for errors in those tools, for fixing errors/crashes there. But cibuildwheel's job is providing users with an 'integrated' user experience across those tools. We provide an abstraction. The user says 'build me some wheels', not 'open the docker container, build a wheel with pip, fix up the symbols with auditwheel' etc.  However, errors have a habit of breaking abstractions. And this is where users get confused, because the mechanism of cibuildwheel is laid bare, and they must understand a little bit how it works to debug.
 

docs/cpp_standards.md

@@ -1,5 +1,6 @@
 ---
 title: Modern C++ standards
+ref: cpp-standards
 ---
 
 # Modern C++ standards

docs/deliver-to-pypi.md

@@ -1,5 +1,6 @@
 ---
 title: Delivering to PyPI
+ref: deliver-to-pypi
 ---
 
 # Delivering to PyPI

docs/diagram.html

@@ -179,19 +179,30 @@
           },
         },
         {
-          label: 'Repair wheel',
+          label: 'Repair using auditwheel',
           href: 'options/#repair-wheel-command',
           platforms: ['android'],
           style: 'block',
           tooltip: {
             title: 'CIBW_REPAIR_WHEEL_COMMAND',
             tag: 'Customisable step',
-            description: 'By default, bundles libc++ into the wheel if any shared library links against it, using patchelf. Can be overridden with a custom repair command.'
+            description: 'Bundle shared libraries by running auditwheel on each built wheel.'
+          },
+        },
+        {
+          label: 'Repair using delvewheel',
+          href: 'options/#repair-wheel-command',
+          platforms: ['windows'],
+          style: 'block',
+          tooltip: {
+            title: 'CIBW_REPAIR_WHEEL_COMMAND',
+            tag: 'Customisable step',
+            description: 'Bundle shared libraries by running delvewheel on each built wheel.'
           },
         },
         {
           href: 'options/#repair-wheel-command',
-          platforms: ['windows', 'ios', 'pyodide'],
+          platforms: ['ios', 'pyodide'],
           style: 'dot',
           tooltip: {
             title: 'CIBW_REPAIR_WHEEL_COMMAND',

docs/faq.md

@@ -1,5 +1,6 @@
 ---
 title: Tips and tricks
+ref: faq
 ---
 
 # Tips and tricks
@@ -112,7 +113,7 @@ There are two suggested methods for keeping cibuildwheel up to date that instead
 If you use GitHub Actions for builds, you can use cibuildwheel as an action:
 
 ```yaml
-uses: pypa/cibuildwheel@v4.0.0rc1
+uses: pypa/cibuildwheel@v4.0.0
 ```
 
 This is a composite step that just runs cibuildwheel using pipx. You can set command-line options as `with:` parameters, and use `env:` as normal.
@@ -137,7 +138,7 @@ The second option, and the only one that supports other CI systems, is using a `
 
 ```bash
 # requirements-cibw.txt
-cibuildwheel==4.0.0rc1
+cibuildwheel==4.0.0
 ```
 
 Then your install step would have `python -m pip install -r requirements-cibw.txt` in it. Your `.github/dependabot.yml` file could look like this:
@@ -220,6 +221,60 @@ Your build might need some compiler flags to be set through environment variable
 Consider incorporating these into your package, for example, in `setup.py` using [`extra_compile_args` or
 `extra_link_args`](https://setuptools.pypa.io/en/latest/userguide/ext_modules.html#setuptools.Extension).
 
+### Building wheels with CUDA on Linux
+
+On Linux, you can build binary wheels with CUDA to take advantage of NVIDIA GPUs for hardware acceleration.
+Specify the custom Docker containers with CUDA Toolkit as follows:
+
+```yaml
+CIBW_MANYLINUX_X86_64_IMAGE: >-
+  quay.io/manylinux_cuda/manylinux_2_28_x86_64_cuda13_1:latest
+CIBW_MANYLINUX_AARCH64_IMAGE: >-
+  quay.io/manylinux_cuda/manylinux_2_28_aarch64_cuda13_1:latest
+```
+Currently, we support the following CUDA manylinux containers:
+
+* `quay.io/manylinux_cuda/manylinux_2_28_x86_64_cuda12_9:latest`
+* `quay.io/manylinux_cuda/manylinux_2_28_aarch64_cuda12_9:latest`
+* `quay.io/manylinux_cuda/manylinux_2_28_x86_64_cuda13_1:latest`
+* `quay.io/manylinux_cuda/manylinux_2_28_aarch64_cuda13_1:latest`
+* `quay.io/manylinux_cuda/manylinux_2_34_x86_64_cuda12_9:latest`
+* `quay.io/manylinux_cuda/manylinux_2_34_aarch64_cuda12_9:latest`
+* `quay.io/manylinux_cuda/manylinux_2_34_x86_64_cuda13_1:latest`
+* `quay.io/manylinux_cuda/manylinux_2_34_aarch64_cuda13_1:latest`
+
+A typical GitHub Actions workflow will look like this:
+
+```yaml
+jobs:
+  build-wheels:
+    name: Build wheels
+    runs-on: ${{ matrix.target.runner }}
+    strategy:
+      matrix:
+        manylinux-base: [manylinux_2_28, manylinux_2_34]
+        cuda-version: [12_9, 13_1]
+        target:
+          - arch: x86_64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v3
+        env:
+          CIBW_MANYLINUX_X86_64_IMAGE: >-
+            quay.io/manylinux_cuda/${{ matrix.manylinux-base }}_x86_64_cuda${{ matrix.cuda-version }}:latest
+          CIBW_MANYLINUX_AARCH64_IMAGE: >-
+            quay.io/manylinux_cuda/${{ matrix.manylinux-base }}_aarch64_cuda${{ matrix.cuda-version }}:latest
+          CIBW_BUILD: cp312-manylinux_${{ matrix.target.arch }}
+```
+
+
 ## Troubleshooting
 
 If your wheel didn't compile, you might have a mistake in your config.
@@ -234,7 +289,7 @@ Sometimes a build will fail due to a missing dependency.
 
 **If you need a build tool** (e.g. cmake, automake, ninja), you can install it through a package manager like apt/yum, brew or choco, using the [`before-all`](options.md#before-all) option.
 
-**If your build is linking into a native library dependency**, you can build/install that in [`before-all`](options.md#before-all). However, on Linux, Mac (and Windows if you're using [delvewheel]), the library that you install will be bundled into the wheel in the [repair step]. So take care to ensure that
+**If your build is linking into a native library dependency**, you can build/install that in [`before-all`](options.md#before-all). However, on Linux, Mac, and Windows (which uses [delvewheel] by default since cibuildwheel 4.0), the library that you install will be bundled into the wheel in the [repair step]. So take care to ensure that
 
 - the bundled library doesn't accidentally increase the minimum system requirements (such as the minimum macOS version)
 - the bundled library matches the architecture of the wheel you're building when cross-compiling
@@ -302,7 +357,7 @@ Solutions to this vary, but the simplest is to use pipx:
 # most runners have pipx preinstalled, but in case you don't
 python3 -m pip install pipx
 
-pipx run cibuildwheel==4.0.0rc1 --output-dir wheelhouse
+pipx run cibuildwheel==4.0.0 --output-dir wheelhouse
 pipx run twine upload wheelhouse/*.whl
 ```
 

docs/index.md

@@ -1,5 +1,6 @@
 ---
 title: Home
+ref: index
 ---
 
 # cibuildwheel

docs/options.md

@@ -1,3 +1,8 @@
+---
+title: Options
+ref: options
+---
+
 # Options
 
 <div class="options-toc"></div>
@@ -64,7 +69,6 @@ When setting the options, you can use shell-style globbing syntax, as per [fnmat
 | PyPy3.9 v7.3  | pp39-macosx_x86_64<br/>pp39-macosx_arm64                               | pp39-win_amd64                                      | pp39-manylinux_x86_64<br/>pp39-manylinux_i686                                                       | pp39-manylinux_aarch64                                                                                                                                                                                                                                                        |                                                  |                                                                                                   |                      |
 | PyPy3.10 v7.3 | pp310-macosx_x86_64<br/>pp310-macosx_arm64                             | pp310-win_amd64                                     | pp310-manylinux_x86_64<br/>pp310-manylinux_i686                                                     | pp310-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                  |                                                                                                   |                      |
 | PyPy3.11 v7.3 | pp311-macosx_x86_64<br/>pp311-macosx_arm64                             | pp311-win_amd64                                     | pp311-manylinux_x86_64<br/>pp311-manylinux_i686                                                     | pp311-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                  |                                                                                                   |                      |
-| GraalPy 3.11 v24.2 | gp311_242-macosx_x86_64<br/>gp311_242-macosx_arm64                             | gp311_242-win_amd64                                     | gp311_242-manylinux_x86_64                                                                              | gp311_242-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                                                                   |                      |
 | GraalPy 3.12 v25.0 | gp312_250-macosx_x86_64<br/>gp312_250-macosx_arm64                             | gp312_250-win_amd64                                     | gp312_250-manylinux_x86_64                                                                              | gp312_250-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                                                                   |                      |
 
 The list of supported and currently selected build identifiers can also be retrieved by passing the `--print-build-identifiers` flag to cibuildwheel.
@@ -669,6 +673,9 @@ Platform-specific environment variables are also available:<br/>
 !!! note
     cibuildwheel always defines the environment variable `CIBUILDWHEEL=1`. This can be useful for [building wheels with optional extensions](faq.md#optional-extensions).
 
+!!! note
+    For each per-build step (`before_build`, the build itself, `repair_command`, `before_test`, `test_command`), cibuildwheel also sets `CIBUILDWHEEL_BUILD_IDENTIFIER` to the current build identifier (e.g. `cp311-manylinux_x86_64`). This can be used in scripts to distinguish different builds.
+
 !!! note
     To do its work, cibuildwheel sets the variables `VIRTUALENV_PIP`, `DIST_EXTRA_CONFIG`, `SETUPTOOLS_EXT_SUFFIX`, `PIP_DISABLE_PIP_VERSION_CHECK`, `PIP_ROOT_USER_ACTION`, and it extends the variables `PATH` and `PIP_CONSTRAINT`. Your assignments to these options might be replaced or extended.
 
@@ -916,15 +923,44 @@ Platform-specific environment variables are also available on platforms that use
     ```
 
 
+### `xbuild-files` {: #xbuild-files env-var toml}
+> Platform-specific files in the build environment
+
+When cross-compiling a package for Android, any dependencies in its [`build-system.requires`](https://packaging.python.org/en/latest/guides/writing-pyproject-toml/) are installed for the build platform. However, some dependencies contain platform-specific files such as headers and static libraries, which must correspond to the target platform.
+
+This option maps a [normalized](https://packaging.python.org/en/latest/specifications/name-normalization/#name-normalization) package name to a list of paths within that package. If the package is present in the build environment, then a matching version will be downloaded for the target platform, and used to overwrite the given paths within the build environment.
+
+The default value of this option includes [paths from popular packages](configuration.md#configuration-file).
+
+Platform-specific environment variables are also available:<br/>
+ `CIBW_XBUILD_FILES_ANDROID`
+
+#### Examples
+
+!!! tab examples "pyproject.toml"
+
+    ```toml
+    [tool.cibuildwheel.xbuild-files]
+    package1 = ["some/header.h", "some/library.a"]
+    package2 = ["other/header.h"]
+    ```
+
+!!! tab examples "Environment variables"
+
+    ```yaml
+    CIBW_XBUILD_FILES: "package1: some/header.h some/library.a; package2: other/header.h"
+    ```
+
+
 ### `repair-wheel-command` {: #repair-wheel-command env-var toml}
 > Execute a shell command to repair each built wheel
 
 Default:
 
 - on Linux: `'auditwheel repair -w {dest_dir} {wheel}'`
+- on Windows: `'delvewheel repair -w {dest_dir} -v {wheel}'`
 - on macOS: `'delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}'`
-- on Android: There is no default command, but cibuildwheel will add `libc++` to the
-  wheel if anything links against it. Setting a command will replace this behavior.
+- on Android: `'auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}'`
 - on Pyodide: You can use `pyodide auditwheel repair --libdir /path/to/libraries --output-dir {dest_dir} {wheel}` command to repair the wheel.
   Unlike other platforms, this command is not set by default as you need to explicitly
   specify the library directory. You might not want to use the libraries in the system
@@ -934,11 +970,15 @@ Default:
 A shell command to repair a built wheel by copying external library dependencies into the wheel tree and relinking them.
 The command is run on each built wheel (except for pure Python ones) before testing it.
 
+!!! note
+    Since cibuildwheel 4.0, `delvewheel` is the default `repair-wheel-command` on Windows, so extension-module DLLs are bundled automatically. If a wheel has a platform tag but contains no extension module (for example, a package that sets a platform tag but ships a pre-built DLL itself), `delvewheel` may error. In that case, set `repair-wheel-command = ""` to skip the repair step.
+
 The following placeholders must be used inside the command and will be replaced by cibuildwheel:
 
 - `{wheel}` for the absolute path to the built wheel
 - `{dest_dir}` for the absolute path of the directory where to create the repaired wheel
 - `{delocate_archs}` (macOS only) comma-separated list of architectures in the wheel.
+- `{ldpaths}` (Android only) colon-separated list of directories to search for external libraries, set by cibuildwheel to include any necessary locations in the NDK. You can add more directories by appending them with a colon separator after the placeholder, or by setting the `AUDITWHEEL_LD_LIBRARY_PATH` environment variable.
 
 You can use the `{package}` or `{project}` placeholders in your `repair-wheel-command` to refer to the package being built or the project root, respectively.
 
@@ -947,24 +987,14 @@ The command is run in a shell, so you can run multiple commands like `cmd1 && cm
 Platform-specific environment variables are also available:<br/>
 `CIBW_REPAIR_WHEEL_COMMAND_MACOS` | `CIBW_REPAIR_WHEEL_COMMAND_WINDOWS` | `CIBW_REPAIR_WHEEL_COMMAND_LINUX` | `CIBW_REPAIR_WHEEL_COMMAND_ANDROID` | `CIBW_REPAIR_WHEEL_COMMAND_IOS` | `CIBW_REPAIR_WHEEL_COMMAND_PYODIDE`
 
-!!! tip
-    cibuildwheel doesn't yet ship a default repair command for Windows.
-
-    **If that's an issue for you, check out [delvewheel]** - a new package that aims to do the same as auditwheel or delocate for Windows.
-
-    Because delvewheel is still relatively early-stage, cibuildwheel does not yet run it by default. However, we'd recommend giving it a try! See the examples below for usage.
-
-    [Delvewheel]: https://github.com/adang1345/delvewheel
-
 #### Examples
 
 !!! tab examples "pyproject.toml"
 
     ```toml
-    # Use delvewheel on windows
+    # Don't repair Windows wheels
     [tool.cibuildwheel.windows]
-    before-build = "pip install delvewheel"
-    repair-wheel-command = "delvewheel repair -w {dest_dir} {wheel}"
+    repair-wheel-command = ""
 
     # Don't repair macOS wheels
     [tool.cibuildwheel.macos]
@@ -992,9 +1022,8 @@ Platform-specific environment variables are also available:<br/>
 !!! tab examples "Environment variables"
 
     ```yaml
-    # Use delvewheel on windows
-    CIBW_BEFORE_BUILD_WINDOWS: "pip install delvewheel"
-    CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: "delvewheel repair -w {dest_dir} {wheel}"
+    # Don't repair Windows wheels
+    CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: ""
 
     # Don't repair macOS wheels
     CIBW_REPAIR_WHEEL_COMMAND_MACOS: ""

docs/platforms.md

@@ -1,5 +1,6 @@
 ---
 title: Platforms
+ref: platforms
 ---
 # Platforms
 
@@ -219,13 +220,9 @@ It also requires the following commands to be on the `PATH`:
 
 Android builds will honor the `ANDROID_API_LEVEL` environment variable to set the
 minimum supported [API level](https://developer.android.com/tools/releases/platforms)
-for generated wheels. This will default to the minimum API level of the selected Python
-version.
-
-If the [`repair-wheel-command`](options.md#repair-wheel-command) adds any libraries to
-the wheel, then `ANDROID_API_LEVEL` must be at least 24. This is already the default
-when building for Python 3.14 and later, but you may need to set it when building for
-Python 3.13.
+for generated wheels. This defaults to 24, which is supported by [99% of active
+devices](https://dl.google.com/android/studio/metadata/distributions.json), and is the first
+version to support RUNPATH, which auditwheel needs in order to graft external libraries.
 
 ### Build frontend support
 

docs/setup.md

@@ -1,5 +1,6 @@
 ---
 title: 'Getting started'
+ref: setup
 ---
 
 # Getting started

docs/working-examples.md

@@ -1,5 +1,6 @@
 ---
 title: Working examples
+ref: working-examples
 ---
 
 <!-- START bin/projects.py -->
@@ -81,8 +82,8 @@ title: Working examples
 | [python-rapidjson][]              | ![travisci icon][] ![gitlab icon][] | ![windows icon][] ![linux icon][] | Python wrapper around rapidjson |
 | [pybind11 python_example][]       | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | Example pybind11 module built with a Python-based build system |
 | [python-snappy][]                 | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Python bindings for the snappy google library |
-| [abess][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A fast best-subset selection library. It uses cibuildwheel to build a large project with C++ extensions. |
 | [Confluent client for Kafka][]    | ![travisci icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | setup in `tools/wheels/build-wheels.bat` |
+| [abess][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A fast best-subset selection library. It uses cibuildwheel to build a large project with C++ extensions. |
 | [jq.py][]                         | ![travisci icon][] | ![apple icon][] ![linux icon][] | Python bindings for jq |
 | [cyvcf2][]                        | ![github icon][] | ![apple icon][] ![linux icon][] | cython + htslib == fast VCF and BCF processing |
 | [matrixprofile][]                 | ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A Python 3 library making time series data mining tasks, utilizing matrix profile algorithms, accessible to everyone. |
@@ -95,8 +96,8 @@ title: Working examples
 | [power-grid-model][]              | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Python/C++ library for distribution power system analysis |
 | [TgCrypto][]                      | ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Includes a Windows Travis build. |
 | [streaming-form-data][]           | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Streaming parser for multipart/form-data written in Cython |
-| [pybase64][]                      | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![android icon][] ![ios icon][] ![pyodide icon][] | setuptools backend with custom CMake step for external sources. SBOM embedded via a custom repair step. |
 | [Imagecodecs (fork)][]            | ![azurepipelines icon][] | ![apple icon][] ![linux icon][] | Over 20 external dependencies in compiled libraries, custom docker image, `libomp`, `openblas` and `install_name_tool` for macOS. |
+| [pybase64][]                      | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![android icon][] ![ios icon][] ![pyodide icon][] | setuptools backend with custom CMake step for external sources. SBOM embedded via a custom repair step. |
 | [boost-histogram][]               | ![github icon][] ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | Supports full range of wheels, including PyPy and alternate archs. |
 | [bx-python][]                     | ![travisci icon][] | ![apple icon][] ![linux icon][] | A library that includes Cython extensions. |
 | [Python-WebRTC][]                 | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | a Python extension that provides bindings to WebRTC M92 |
@@ -109,8 +110,8 @@ title: Working examples
 | [cf-units][]                      | ![github icon][] | ![apple icon][] ![linux icon][] | Units of measure as required by the Climate and Forecast (CF) Metadata Conventions |
 | [etebase-py][]                    | ![travisci icon][] | ![linux icon][] | Python bindings to a Rust library using `setuptools-rust`, and `sccache` for improved speed. |
 | [SiPM][]                          | ![github icon][] | ![apple icon][] ![linux icon][] | High performance library for SiPM detectors simulation using C++17, OpenMP and AVX2 intrinsics. |
-| [numpythia][]                     | ![github icon][] | ![apple icon][] ![linux icon][] | The interface between PYTHIA and NumPy |
 | [aalink][]                        | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Async Python interface for Ableton Link. |
+| [numpythia][]                     | ![github icon][] | ![apple icon][] ![linux icon][] | The interface between PYTHIA and NumPy |
 | [pyjet][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | The interface between FastJet and NumPy |
 | [ril][]                           | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A python binding to Rust Imaging library using maturin and Pyo3, utilizes Github Action cache to improve speed. Builds abi3 wheels. |
 | [GSD][]                           | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Cython and NumPy project with 64-bit wheels. |
@@ -192,8 +193,8 @@ title: Working examples
 [python-rapidjson]: https://github.com/python-rapidjson/python-rapidjson
 [pybind11 python_example]: https://github.com/pybind/python_example
 [python-snappy]: https://github.com/intake/python-snappy
-[abess]: https://github.com/abess-team/abess
 [Confluent client for Kafka]: https://github.com/confluentinc/confluent-kafka-python
+[abess]: https://github.com/abess-team/abess
 [jq.py]: https://github.com/mwilliamson/jq.py
 [cyvcf2]: https://github.com/brentp/cyvcf2
 [matrixprofile]: https://github.com/matrix-profile-foundation/matrixprofile
@@ -206,8 +207,8 @@ title: Working examples
 [power-grid-model]: https://github.com/PowerGridModel/power-grid-model
 [TgCrypto]: https://github.com/pyrogram/tgcrypto
 [streaming-form-data]: https://github.com/siddhantgoel/streaming-form-data
-[pybase64]: https://github.com/mayeut/pybase64
 [Imagecodecs (fork)]: https://github.com/czaki/imagecodecs_build
+[pybase64]: https://github.com/mayeut/pybase64
 [boost-histogram]: https://github.com/scikit-hep/boost-histogram
 [bx-python]: https://github.com/bxlab/bx-python
 [Python-WebRTC]: https://github.com/MarshalX/python-webrtc
@@ -220,8 +221,8 @@ title: Working examples
 [cf-units]: https://github.com/SciTools/cf-units
 [etebase-py]: https://github.com/etesync/etebase-py
 [SiPM]: https://github.com/EdoPro98/SimSiPM
-[numpythia]: https://github.com/scikit-hep/numpythia
 [aalink]: https://github.com/artfwo/aalink
+[numpythia]: https://github.com/scikit-hep/numpythia
 [pyjet]: https://github.com/scikit-hep/pyjet
 [ril]: https://github.com/Cryptex-github/ril-py
 [GSD]: https://github.com/glotzerlab/gsd

examples/azure-pipelines-minimal.yml

@@ -6,7 +6,7 @@ jobs:
     - bash: |
         set -o errexit
         python3 -m pip install --upgrade pip
-        pip3 install cibuildwheel==4.0.0rc1
+        pip3 install cibuildwheel==4.0.0
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels
@@ -20,7 +20,7 @@ jobs:
     - bash: |
         set -o errexit
         python3 -m pip install --upgrade pip
-        python3 -m pip install cibuildwheel==4.0.0rc1
+        python3 -m pip install cibuildwheel==4.0.0
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels
@@ -34,7 +34,7 @@ jobs:
     - bash: |
         set -o errexit
         python -m pip install --upgrade pip
-        pip install cibuildwheel==4.0.0rc1
+        pip install cibuildwheel==4.0.0
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels

examples/circleci-minimal.yml

@@ -11,7 +11,7 @@ jobs:
       - run:
           name: Build the Linux wheels.
           command: |
-            python3 -m pip install --user cibuildwheel==4.0.0rc1
+            python3 -m pip install --user cibuildwheel==4.0.0
             cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/
@@ -28,7 +28,7 @@ jobs:
       - run:
           name: Build the Linux aarch64 wheels.
           command: |
-            python3 -m pip install --user cibuildwheel==4.0.0rc1
+            python3 -m pip install --user cibuildwheel==4.0.0
             python3 -m cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/
@@ -44,7 +44,7 @@ jobs:
           name: Build the OS X wheels.
           command: |
             sudo softwareupdate --install-rosetta --agree-to-license  # for x86_64/universal2 tests
-            pip3 install cibuildwheel==4.0.0rc1
+            pip3 install cibuildwheel==4.0.0
             cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/

examples/github-deploy.yml

@@ -53,7 +53,7 @@ jobs:
           persist-credentials: false
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v4.0.0rc1
+        uses: pypa/cibuildwheel@v4.0.0
         env:
           CIBW_PLATFORM: ${{ matrix.platform || 'auto' }}
           CIBW_ARCHS: ${{ matrix.archs || 'auto' }}

examples/github-minimal.yml

@@ -17,7 +17,7 @@ jobs:
           persist-credentials: false
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v4.0.0rc1
+        uses: pypa/cibuildwheel@v4.0.0
         # env:
         #   CIBW_SOME_OPTION: value
         #   ...

examples/github-pipx.yml

@@ -17,7 +17,7 @@ jobs:
           persist-credentials: false
 
       - name: Build wheels
-        run: pipx run cibuildwheel==4.0.0rc1
+        run: pipx run cibuildwheel==4.0.0
 
       - uses: actions/upload-artifact@v4
         with:

examples/github-with-qemu.yml

@@ -23,7 +23,7 @@ jobs:
           platforms: all
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v4.0.0rc1
+        uses: pypa/cibuildwheel@v4.0.0
         env:
           # configure cibuildwheel on Linux to build native archs ('auto'),
           # and to split the remaining architectures between the x86_64 and

examples/gitlab-minimal.yml

@@ -12,7 +12,7 @@ linux:
     DOCKER_TLS_CERTDIR: ""
   script:
     - curl -sSL https://get.docker.com/ | sh
-    - python -m pip install cibuildwheel==4.0.0rc1
+    - python -m pip install cibuildwheel==4.0.0
     - cibuildwheel --output-dir wheelhouse
   artifacts:
     paths:
@@ -23,7 +23,7 @@ windows:
   before_script:
     - choco install python -y --allow-downgrade --version 3.12.4
     - choco install git.install -y
-    - py -m pip install cibuildwheel==4.0.0rc1
+    - py -m pip install cibuildwheel==4.0.0
   script:
     - py -m cibuildwheel --output-dir wheelhouse --platform windows
   artifacts:
@@ -35,7 +35,7 @@ windows:
 macos:
   image: macos-14-xcode-15
   before_script:
-    - python3 -m pip install cibuildwheel==4.0.0rc1
+    - python3 -m pip install cibuildwheel==4.0.0
   script:
     - python3 -m cibuildwheel --output-dir wheelhouse
   artifacts:

examples/gitlab-with-qemu.yml

@@ -14,7 +14,7 @@ linux:
     - curl -sSL https://get.docker.com/ | sh
     # Warning: This is extremely slow, be careful with how many wheels you build
     - docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-    - python -m pip install cibuildwheel==4.0.0rc1
+    - python -m pip install cibuildwheel==4.0.0
     # Assuming your CI runner's default architecture is x86_64...
     - cibuildwheel --output-dir wheelhouse --platform linux --archs aarch64
   artifacts:

mkdocs.yml

@@ -58,3 +58,5 @@ plugins:
       j2_variable_end_string: »
       on_error_fail: true
       on_undefined: strict
+  - intersphinx:
+      project: cibuildwheel

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cibuildwheel"
-version = "4.0.0rc1"
+version = "4.0.0"
 description = "Build Python wheels on CI with minimal configuration."
 readme = "README.md"
 license = "BSD-2-Clause"
@@ -45,11 +45,7 @@ dependencies = [
     "filelock",
     "humanize",
     "packaging>=20.9",
-    # patchelf is used for Android
-    "patchelf; (sys_platform == 'linux' or sys_platform == 'darwin') and (platform_machine == 'x86_64' or platform_machine == 'arm64' or platform_machine == 'aarch64')",
     "platformdirs",
-    "pyelftools>=0.29",
-    "wheel>=0.33.6",
 ]
 
 [project.optional-dependencies]
@@ -70,6 +66,7 @@ Homepage = "https://github.com/pypa/cibuildwheel"
 docs = [
     "jinja2>=3.1.2",
     "mkdocs-include-markdown-plugin==7.1.8",
+    "mkdocs-intersphinx>=0.1.1; python_version >= '3.12'",
     "mkdocs-macros-plugin>=1.4.1",
     "mkdocs==1.6.1",
     "pymdown-extensions",

test/test_0_basic.py

@@ -35,6 +35,7 @@ def test_dummy_serial() -> None:
     """
 
 
+@pytest.mark.flaky(reruns=2, reruns_delay=5)
 def test(
     tmp_path: Path, build_frontend_env: dict[str, str], capfd: pytest.CaptureFixture[str]
 ) -> None:

test/test_android.py

@@ -13,7 +13,7 @@ from zipfile import ZipFile
 
 import pytest
 
-from .test_projects import new_c_project
+from .test_projects import new_c_project, new_meson_project
 from .utils import cibuildwheel_run, expected_wheels
 
 pytestmark = pytest.mark.android
@@ -125,7 +125,7 @@ def test_frontend_good(tmp_path: Path, build_frontend_env: dict[str, str]) -> No
         tmp_path,
         add_env={**cp313_env, **build_frontend_env, "CIBW_TEST_COMMAND": "python -m site"},
     )
-    assert wheels == [f"spam-0.1.0-cp313-cp313-android_21_{native_arch.android_abi}.whl"]
+    assert wheels == [f"spam-0.1.0-cp313-cp313-android_24_{native_arch.android_abi}.whl"]
 
 
 @pytest.mark.parametrize("frontend", ["pip"])
@@ -136,7 +136,10 @@ def test_frontend_bad(frontend: str, tmp_path: Path, capfd: pytest.CaptureFixtur
             tmp_path,
             add_env={**cp313_env, "CIBW_BUILD_FRONTEND": frontend},
         )
-    assert "Android requires the build frontend to be 'build'" in capfd.readouterr().err
+    assert (
+        f"Android requires the build frontend to be 'build' or 'uv', not '{frontend}'"
+        in capfd.readouterr().err
+    )
 
 
 @needs_emulator
@@ -162,7 +165,7 @@ def test_archs(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
             ),
         },
     )
-    assert wheels == [f"spam-0.1.0-cp313-cp313-android_21_{arch.android_abi}.whl" for arch in archs]
+    assert wheels == [f"spam-0.1.0-cp313-cp313-android_24_{arch.android_abi}.whl" for arch in archs]
 
     stdout, stderr = capfd.readouterr()
     lines = (line for line in stdout.splitlines() if line.startswith("Hello from"))
@@ -435,13 +438,25 @@ def test_verbosity(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
 
 @needs_emulator
 def test_api_level(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
-    project = new_c_project()
+    project = new_c_project(
+        # Check that the the compiler options are set correctly.
+        spam_c_top_level_add=dedent(
+            """\
+            #if __ANDROID_API__ != 33
+            #error Unexpected API level; the following syntax error will show the actual value:
+            __ANDROID_API__
+            #endif
+            """
+        )
+    )
     project.files["pyproject.toml"] = dedent(
         """\
         [build-system]
         requires = ["setuptools"]
 
         [tool.cibuildwheel]
+        # Test setting API level in pyproject.toml (test_libcxx covers setting
+        # it in the outer environment.)
         android.environment.ANDROID_API_LEVEL = "33"
         android.environment.PIP_EXTRA_INDEX_URL = "https://chaquo.com/pypi-13.1"
         """
@@ -486,17 +501,21 @@ def test_libcxx(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
         "PATH": non_venv_path,
     }
 
-    # Including external libraries requires API level 24.
+    # Including external libraries requires API level 24. This is enforced by auditwheel.
+    cp313_android_21_env = {
+        **cp313_test_env,
+        # Test setting API level in the outer environment (test_api_level covers setting
+        # it in pyproject.toml.)
+        "ANDROID_API_LEVEL": "21",
+    }
     with pytest.raises(CalledProcessError):
-        cibuildwheel_run(project_dir, add_env=cp313_test_env, output_dir=output_dir)
-    assert "libc++_shared.so requires ANDROID_API_LEVEL to be at least 24" in capfd.readouterr().err
-
-    wheels = cibuildwheel_run(
-        project_dir,
-        add_env={**cp313_test_env, "ANDROID_API_LEVEL": "24"},
-        output_dir=output_dir,
+        cibuildwheel_run(project_dir, add_env=cp313_android_21_env, output_dir=output_dir)
+    assert (
+        "Grafting libraries with RUNPATH requires API level 24 or higher" in capfd.readouterr().err
     )
-    assert len(wheels) == 1
+
+    wheels = cibuildwheel_run(project_dir, add_env=cp313_test_env, output_dir=output_dir)
+    assert wheels == [f"spam-0.1.0-cp313-cp313-android_24_{native_arch.android_abi}.whl"]
     names = ZipFile(output_dir / wheels[0]).namelist()
     libcxx_names = [
         name for name in names if re.fullmatch(r"spam\.libs/libc\+\+_shared-[0-9a-f]{8}\.so", name)
@@ -504,16 +523,177 @@ def test_libcxx(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
     assert len(libcxx_names) == 1
     assert "ham: 1, spam: 0" in capfd.readouterr().out
 
-    # A C package should not include libc++.
+    # A C package should not include libc++, and can therefore use an older API level.
     rmtree(project_dir)
     rmtree(output_dir)
     new_c_project().generate(project_dir)
-    wheels = cibuildwheel_run(project_dir, add_env=cp313_env, output_dir=output_dir)
-    assert len(wheels) == 1
+    wheels = cibuildwheel_run(project_dir, add_env=cp313_android_21_env, output_dir=output_dir)
+    assert wheels == [f"spam-0.1.0-cp313-cp313-android_21_{native_arch.android_abi}.whl"]
     for name in ZipFile(output_dir / wheels[0]).namelist():
         assert ".libs" not in name
 
 
+@needs_emulator
+def test_repair_none(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
+    new_c_project(setup_py_extension_args_add="language='c++'").generate(tmp_path)
+    with pytest.raises(CalledProcessError):
+        cibuildwheel_run(
+            tmp_path,
+            add_env={
+                **cp313_env,
+                "CIBW_REPAIR_WHEEL_COMMAND": "",
+                "CIBW_TEST_COMMAND": "python -c 'import spam'",
+            },
+        )
+    assert 'dlopen failed: library "libc++_shared.so" not found' in capfd.readouterr().err
+
+
+def test_repair_ldpaths(tmp_path: Path) -> None:
+    new_c_project().generate(tmp_path)
+    repair_path = tmp_path / "repair.py"
+    repair_path.write_text(
+        dedent(
+            """\
+            #!/usr/bin/env python
+            import shutil
+            import sys
+            from pathlib import Path
+
+            assert len(sys.argv) == 4, sys.argv
+            ldpaths = list(map(Path, sys.argv[1].split(":")))
+            dest_dir = sys.argv[2]
+            wheel = sys.argv[3]
+
+            for name in ["libc++_shared.so", "libomp.so"]:
+                assert any((lp / name).exists() for lp in ldpaths), (name, ldpaths)
+
+            shutil.copy(wheel, dest_dir)
+            """
+        )
+    )
+    repair_path.chmod(0o755)
+
+    wheels = cibuildwheel_run(
+        tmp_path,
+        add_env={
+            **cp313_env,
+            "CIBW_REPAIR_WHEEL_COMMAND": f"{repair_path} {{ldpaths}} {{dest_dir}} {{wheel}}",
+        },
+    )
+    assert wheels == [f"spam-0.1.0-cp313-cp313-android_24_{native_arch.android_abi}.whl"]
+
+
+@pytest.mark.parametrize(
+    ("script", "error"),
+    [
+        ("", "did not produce a wheel"),
+        ("touch $dest_dir/one.whl $dest_dir/two.whl", "produced multiple wheels"),
+        ("touch $dest_dir/one-0.0.1-py3-none-any.whl", "pure Python wheel was generated"),
+    ],
+)
+def test_repair_error(
+    script: str, error: str, tmp_path: Path, capfd: pytest.CaptureFixture[str]
+) -> None:
+    new_c_project().generate(tmp_path)
+    repair_path = tmp_path / "repair.sh"
+    repair_path.write_text(
+        dedent(
+            f"""\
+            #!/bin/sh
+            dest_dir=$1
+            {script}
+            """
+        )
+    )
+    repair_path.chmod(0o755)
+
+    with pytest.raises(CalledProcessError):
+        cibuildwheel_run(
+            tmp_path,
+            add_env={**cp313_env, "CIBW_REPAIR_WHEEL_COMMAND": f"{repair_path} {{dest_dir}}"},
+        )
+    assert error in capfd.readouterr().err
+
+
+# This also tests integration with pkgconf, because Meson uses it to find Python.
+@needs_emulator
+def test_meson(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
+    # Alter spam.filter to return the value of a Fortran function.
+    new_meson_project(
+        spam_c_top_level_add="int fortran_func_();",
+        spam_c_function_add="sts = fortran_func_();",
+        project_args_add="'fortran',",
+        extension_args_add="'fortran.f90', link_language: 'fortran',",
+    ).generate(tmp_path)
+
+    # TODO: remove once meson-python has a release with Android support.
+    pyproject_path = tmp_path / "pyproject.toml"
+    pyproject_path.write_text(
+        pyproject_path.read_text().replace(
+            "meson-python", "meson-python @ git+https://github.com/mesonbuild/meson-python@main"
+        )
+    )
+
+    # Add Fortran code.
+    (tmp_path / "fortran.f90").write_text(
+        dedent(
+            """\
+            integer*4 function fortran_func()
+                fortran_func = 42
+            end
+            """
+        )
+    )
+
+    script = 'import spam; print(f"result: {spam.filter("")}")'
+    cibuildwheel_run(
+        tmp_path,
+        add_env={**cp313_env, "CIBW_TEST_COMMAND": f"python -c '{script}'"},
+    )
+    assert "result: 42" in capfd.readouterr().out
+
+
+@needs_emulator
+def test_xbuild_files(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
+    # Verify that we've replaced the correct files by compiling against a non-trivial
+    # function from libnpymath.a.
+    new_c_project(
+        setup_py_add=dedent(
+            """\
+            import numpy as np
+            np_include = np.get_include()
+            np_lib = f"{np_include}/../lib"
+            libraries.append("npymath")
+            """
+        ),
+        setup_py_extension_args_add="include_dirs=[np_include], library_dirs=[np_lib]",
+        spam_c_top_level_add="#include <numpy/halffloat.h>",
+        spam_c_function_add="sts = npy_float_to_half(42);",
+    ).generate(tmp_path)
+
+    (tmp_path / "pyproject.toml").write_text(
+        dedent(
+            """\
+            [build-system]
+            requires = ["setuptools", "numpy==2.3.2"]
+            """
+        )
+    )
+
+    script = 'import spam; print(f"result: {spam.filter(""):#x}")'
+    cibuildwheel_run(
+        tmp_path,
+        add_env={
+            **cp313_env,
+            # TODO: remove this once there are official Android NumPy wheels on PyPI.
+            "PIP_EXTRA_INDEX_URL": "https://chaquo.com/pypi-test",
+            "CIBW_ARCHS": "all",  # Include both native and non-native archs.
+            "CIBW_TEST_COMMAND": f"python -c '{script}'",
+        },
+    )
+    assert "result: 0x5140" in capfd.readouterr().out
+
+
 @needs_emulator
 def test_setuptools_rust(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
     """

test/test_dependency_versions.py

@@ -179,19 +179,6 @@ def test_dependency_constraints(
         msg = f"Unknown method: {method}"
         raise ValueError(msg)
 
-    skip = ""
-
-    if (
-        utils.get_platform() == "windows"
-        and method == "file"
-        and build_frontend_env_nouv["CIBW_BUILD_FRONTEND"] == "build"
-    ):
-        # GraalPy 24 fails to discover its standard library when a venv is created
-        # from a virtualenv seeded executable. See
-        # https://github.com/oracle/graalpython/issues/491 and remove this once
-        # GraalPy 24 is dropped
-        skip = "gp311*"
-
     # cross-platform Python script for dependency constraint checks
     before_build_script = project_dir / "check_versions.py"
     before_build_script.write_text(CHECK_VERSIONS_SCRIPT)
@@ -200,7 +187,6 @@ def test_dependency_constraints(
     actual_wheels = utils.cibuildwheel_run(
         project_dir,
         add_env={
-            "CIBW_SKIP": skip,
             "CIBW_DEPENDENCY_VERSIONS": dependency_version_option,
             "CIBW_BEFORE_BUILD": f"python {before_build_script.name}",
             "EXPECTED_VERSIONS": json.dumps(tool_versions),
@@ -212,9 +198,4 @@ def test_dependency_constraints(
     # also check that we got the right wheels
     expected_wheels = utils.expected_wheels("spam", "0.1.0", single_python=True)
 
-    if skip == "gp*":
-        # See reference to https://github.com/oracle/graalpython/issues/491
-        # above
-        expected_wheels = [w for w in expected_wheels if "graalpy311" not in w]
-
     assert set(actual_wheels) == set(expected_wheels)

test/test_ios.py

@@ -48,7 +48,7 @@ def skip_if_ios_testing_not_supported() -> None:
 # which is guaranteed to run single-process.
 # This can also fail the first time sometimes.
 @pytest.mark.serial
-@pytest.mark.flaky(reruns=2)
+@pytest.mark.flaky(reruns=1)
 @pytest.mark.parametrize(
     "build_config",
     [
@@ -173,7 +173,7 @@ def test_ios_testing_with_placeholder(tmp_path: Path, capfd: pytest.CaptureFixtu
 
 
 @pytest.mark.serial
-@pytest.mark.flaky(reruns=2)
+@pytest.mark.flaky(reruns=1)
 def test_ios_test_command_short_circuit(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
     skip_if_ios_testing_not_supported()
 

test/test_pep518.py

@@ -40,26 +40,12 @@ def test_pep518(tmp_path: Path, build_frontend_env: dict[str, str]) -> None:
     project_dir = tmp_path / "project"
     basic_project.generate(project_dir)
 
-    # GraalPy fails to discover its standard library when a venv is created
-    # from a virtualenv seeded executable. See
-    # https://github.com/oracle/graalpython/issues/491 and remove this once
-    # fixed upstream.
-    if build_frontend_env["CIBW_BUILD_FRONTEND"] == "build" and utils.get_platform() == "windows":
-        build_frontend_env["CIBW_SKIP"] = "gp*"
-
     # build the wheels
     actual_wheels = utils.cibuildwheel_run(project_dir, add_env=build_frontend_env)
 
     # check that the expected wheels are produced
     expected_wheels = utils.expected_wheels("spam", "0.1.0")
 
-    # GraalPy fails to discover its standard library when a venv is created
-    # from a virtualenv seeded executable. See
-    # https://github.com/oracle/graalpython/issues/491 and remove this once
-    # fixed upstream.
-    if build_frontend_env["CIBW_BUILD_FRONTEND"] == "build" and utils.get_platform() == "windows":
-        expected_wheels = [w for w in expected_wheels if "graalpy" not in w]
-
     assert set(actual_wheels) == set(expected_wheels)
 
     # These checks ensure an extra file is not created when using custom

test/test_projects/meson.py

@@ -22,6 +22,7 @@ archs = ["auto64"]
 
 MESON_BUILD_TEMPLATE = r"""
 project('spam', 'c',
+  {{ project_args_add | indent(2) }}
   version: '0.1.0',
   default_options: ['warning_level=2'],
 )
@@ -30,6 +31,7 @@ py = import('python').find_installation(pure: false)
 
 py.extension_module('spam',
   'spam.c',
+  {{ extension_args_add | indent(2) }}
   install: true,
 )
 """
@@ -39,6 +41,8 @@ def new_meson_project(
     *,
     spam_c_top_level_add: str = "",
     spam_c_function_add: str = "",
+    project_args_add: str = "",
+    extension_args_add: str = "",
 ) -> TestProject:
     project = TestProject()
 
@@ -54,6 +58,8 @@ def new_meson_project(
         {
             "spam_c_top_level_add": spam_c_top_level_add,
             "spam_c_function_add": spam_c_function_add,
+            "project_args_add": project_args_add,
+            "extension_args_add": extension_args_add,
         }
     )
 

test/test_projects/setuptools.py

@@ -82,9 +82,10 @@ import sys
 
 from setuptools import setup, Extension
 
+libraries = []
+
 {{ setup_py_add }}
 
-libraries = []
 # Emscripten fails if you pass -lc...
 # See: https://github.com/emscripten-core/emscripten/issues/16680
 if sys.platform.startswith('linux') and "emscripten" not in os.environ.get("_PYTHON_HOST_PLATFORM", ""):

test/utils.py

@@ -177,6 +177,7 @@ def expected_wheels(
     musllinux_versions: list[str] | None = None,
     macosx_deployment_target: str | None = None,
     iphoneos_deployment_target: str | None = None,
+    android_api_level: int | None = None,
     machine_arch: str | None = None,
     platform: str | None = None,
     python_abi_tags: list[str] | None = None,
@@ -201,6 +202,9 @@ def expected_wheels(
     if iphoneos_deployment_target is None:
         iphoneos_deployment_target = os.environ.get("IPHONEOS_DEPLOYMENT_TARGET", "13.0")
 
+    if android_api_level is None:
+        android_api_level = int(os.environ.get("ANDROID_API_LEVEL", "24"))
+
     architectures = [machine_arch]
     if not single_arch:
         if platform == "linux" and full_auto:
@@ -226,6 +230,7 @@ def expected_wheels(
             musllinux_versions=musllinux_versions,
             macosx_deployment_target=macosx_deployment_target,
             iphoneos_deployment_target=iphoneos_deployment_target,
+            android_api_level=android_api_level,
             platform=platform,
             python_abi_tags=python_abi_tags,
             include_universal2=include_universal2,
@@ -242,6 +247,7 @@ def _expected_wheels(
     musllinux_versions: list[str] | None,
     macosx_deployment_target: str,
     iphoneos_deployment_target: str,
+    android_api_level: int,
     platform: str,
     python_abi_tags: list[str] | None,
     include_universal2: bool,
@@ -313,7 +319,6 @@ def _expected_wheels(
 
         if EnableGroup.GraalPy in enable_groups and include_graalpy_in_expected_wheels:
             python_abi_tags += [
-                "graalpy311-graalpy242_311_native",
                 "graalpy312-graalpy250_312_native",
             ]
 
@@ -370,9 +375,6 @@ def _expected_wheels(
                 else:
                     min_macosx = _floor_macosx(macosx_deployment_target, "10.15")
             elif python_abi_tag.startswith("graalpy"):
-                if python_abi_tag.startswith("graalpy311"):
-                    min_macosx = macosx_deployment_target
-                else:
                 min_macosx = _floor_macosx(macosx_deployment_target, "10.13")
             else:
                 min_macosx = macosx_deployment_target
@@ -387,12 +389,7 @@ def _expected_wheels(
                 platform_tags.append(f"macosx_{min_macosx.replace('.', '_')}_universal2")
 
         elif platform == "android":
-            api_level = {
-                "cp313-cp313": 21,
-                "cp314-cp314": 24,
-                "cp315-cp315": 24,
-            }[python_abi_tag]
-            platform_tags = [f"android_{api_level}_{machine_arch}"]
+            platform_tags = [f"android_{android_api_level}_{machine_arch}"]
 
         elif platform == "ios":
             if machine_arch == "x86_64":

unit_test/build_selector_test.py

@@ -199,7 +199,7 @@ def test_build_limited_python() -> None:
     assert build_selector("cp37-win32")
     assert build_selector("cp38-win32")
     assert build_selector("pp37-win_amd64")
-    assert build_selector("gp311_242-win_amd64")
+    assert build_selector("gp312_250-win_amd64")
 
 
 def test_build_limited_python_partial() -> None:

unit_test/linux_build_steps_test.py

@@ -3,7 +3,10 @@ from __future__ import annotations
 import textwrap
 from pprint import pprint
 
+import pytest
+
 import cibuildwheel.platforms.linux
+from cibuildwheel.errors import ConfigurationError
 from cibuildwheel.oci_container import OCIContainerEngineConfig
 from cibuildwheel.options import CommandLineArguments, Options
 
@@ -11,8 +14,6 @@ TYPE_CHECKING = False
 if TYPE_CHECKING:
     from pathlib import Path
 
-    import pytest
-
 
 def test_linux_container_split(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     """
@@ -99,3 +100,24 @@ def test_linux_container_split(tmp_path: Path, monkeypatch: pytest.MonkeyPatch)
     ]
     assert before_alls(build_steps[3]) == [""] * 4
     assert container_engines(build_steps[3]) == [default_container_engine] * 4
+
+
+def test_package_dir_outside_working_directory_raises_configuration_error(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    work_dir = tmp_path / "work"
+    work_dir.mkdir()
+    package_dir = tmp_path / "package"
+    package_dir.mkdir()
+    package_dir.joinpath("pyproject.toml").touch()
+
+    monkeypatch.chdir(work_dir)
+
+    command_line_arguments = CommandLineArguments.defaults()
+    command_line_arguments.package_dir = package_dir
+    options = Options(platform="linux", command_line_arguments=command_line_arguments, env={})
+
+    with pytest.raises(
+        ConfigurationError, match="package_dir must be inside the working directory"
+    ):
+        cibuildwheel.platforms.linux.build(options, tmp_path / "build")

unit_test/oci_container_test.py

@@ -546,6 +546,7 @@ def test_disable_host_mount(
                 container.call(["cat", host_mount_path], capture_output=True)
 
 
+@pytest.mark.flaky(reruns=2, reruns_delay=5)
 @pytest.mark.parametrize("platform", list(OCIPlatform))
 def test_local_image(
     container_engine: OCIContainerEngineConfig, platform: OCIPlatform, tmp_path: Path
@@ -555,9 +556,12 @@ def test_local_image(
         platform,
     }:
         pytest.skip("Skipping test because docker on this platform does not support QEMU")
-    if container_engine.name == "podman" and platform == OCIPlatform.ARMV7:
+    if container_engine.name == "podman":
+        if platform == OCIPlatform.ARMV7:
             # both GHA & local macOS arm64 podman desktop are failing
             pytest.xfail("podman fails with armv7l images")
+        elif platform == OCIPlatform.i386 and sys.platform.startswith("darwin"):
+            pytest.xfail("podman fails with i386 images on macOS")
 
     remote_image = "debian:trixie-slim"
     platform_name = platform.value.replace("/", "_")
@@ -568,15 +572,182 @@ def test_local_image(
         [container_engine.name, "pull", f"--platform={platform.value}", remote_image],
         check=True,
     )
+    container = OCIContainer(engine=container_engine, image=local_image, oci_platform=platform)
+    # before image is built & available, we want to pull it
+    subprocess.run([container_engine.name, "rmi", local_image], check=False)
+    assert container._get_platform_args() == (f"--platform={platform.value}", "--pull=always")
     subprocess.run(
         [container_engine.name, "build", f"--platform={platform.value}", "-t", local_image, "."],
         check=True,
         cwd=tmp_path,
     )
-    with OCIContainer(engine=container_engine, image=local_image, oci_platform=platform):
+    # after image is built & available, we never want to pull it
+    expected_platform_args = f"--platform={platform.value}", "--pull=never"
+    assert container._get_platform_args() == expected_platform_args
+    with container:
+        assert container._get_platform_args() == expected_platform_args
+
+
+@pytest.mark.flaky(reruns=2, reruns_delay=5)
+def test_enter_error(container_engine: OCIContainerEngineConfig, tmp_path: Path) -> None:
+    remote_image = "debian:trixie-slim"
+    platform = DEFAULT_OCI_PLATFORM
+    local_image = f"cibw_{container_engine.name}_enter:latest"
+    dockerfile = tmp_path / "Dockerfile"
+    dockerfile.write_text(f"FROM {remote_image}\nRUN ln -sf false /bin/true")
+    subprocess.run(
+        [container_engine.name, "pull", f"--platform={platform.value}", remote_image],
+        check=True,
+    )
+    subprocess.run(
+        [container_engine.name, "build", f"--platform={platform.value}", "-t", local_image, "."],
+        check=True,
+        cwd=tmp_path,
+    )
+    container = OCIContainer(engine=container_engine, image=local_image, oci_platform=platform)
+    with pytest.raises(subprocess.CalledProcessError, match="/bin/true"), container:
+        pass
+    assert container.name is None
+    assert container.process is None
+
+
+@pytest.mark.parametrize("ci", [True, False])
+def test_enter_error_cleanup_failure(
+    ci: bool, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    provider = cibuildwheel.ci.CIProvider.other if ci else None
+    monkeypatch.setattr(cibuildwheel.oci_container, "detect_ci_provider", lambda: provider)
+    result: subprocess.CompletedProcess[bytes] = subprocess.CompletedProcess(
+        "", returncode=1, stdout=None, stderr=None
+    )
+    monkeypatch.setattr(subprocess, "run", lambda *args, **kwargs: result)
+    engine = OCIContainerEngineConfig("docker")
+    container = OCIContainer(engine=engine, image="foo", oci_platform=OCIPlatform.AMD64)
+    container.name = "bar"
+    container._remove_container()
+    out, err = capsys.readouterr()
+    assert out == ""
+    if ci:
+        assert err == ""
+    else:
+        assert "warning" in err
+        assert "Failed to remove 'bar' container" in err
+
+
+class _FakeStream:
+    def __init__(self, *, write_error: Exception | None = None) -> None:
+        self._write_error = write_error
+        self.closed = False
+
+    def write(self, data: bytes) -> int:
+        if self._write_error is not None:
+            raise self._write_error
+        return len(data)
+
+    def flush(self) -> None:
         pass
 
+    def close(self) -> None:
+        self.closed = True
 
+
+class _FakeProcess:
+    def __init__(self, *, wait_error: Exception | None = None, alive: bool = True) -> None:
+        self._wait_error = wait_error
+        self._alive = alive
+        self.killed = False
+
+    def wait(self, timeout: float | None = None) -> int:
+        if self._wait_error is not None and timeout is not None:
+            raise self._wait_error
+        return 0
+
+    def poll(self) -> int | None:
+        return None if self._alive else 0
+
+    def kill(self) -> None:
+        self.killed = True
+        self._alive = False
+
+
+def _container_ready_for_exit(
+    monkeypatch: pytest.MonkeyPatch,
+    *,
+    process: _FakeProcess,
+    bash_stdin: _FakeStream,
+    bash_stdout: _FakeStream,
+) -> tuple[OCIContainer, list[bool]]:
+    """Build a container with the post-__enter__ state faked, ready for __exit__."""
+    monkeypatch.setattr(cibuildwheel.oci_container, "detect_ci_provider", lambda: None)
+    container = OCIContainer(
+        engine=OCIContainerEngineConfig("docker"), image="foo", oci_platform=OCIPlatform.AMD64
+    )
+    container.name = "bar"
+    removed: list[bool] = []
+    monkeypatch.setattr(container, "_remove_container", lambda: removed.append(True))
+    monkeypatch.setattr(container, "process", process)
+    # bash_stdin/bash_stdout are only set during __enter__, so raising=False
+    monkeypatch.setattr(container, "bash_stdin", bash_stdin, raising=False)
+    monkeypatch.setattr(container, "bash_stdout", bash_stdout, raising=False)
+    return container, removed
+
+
+def test_exit_clean_shutdown_removes_container(monkeypatch: pytest.MonkeyPatch) -> None:
+    process = _FakeProcess(alive=True)
+    bash_stdin = _FakeStream()
+    bash_stdout = _FakeStream()
+    container, removed = _container_ready_for_exit(
+        monkeypatch, process=process, bash_stdin=bash_stdin, bash_stdout=bash_stdout
+    )
+
+    container.__exit__(None, None, None)
+
+    assert removed == [True]
+    assert not process.killed
+    assert container.process is None
+    assert bash_stdin.closed
+    assert bash_stdout.closed
+
+
+def test_exit_removes_container_when_bash_already_dead(monkeypatch: pytest.MonkeyPatch) -> None:
+    # bash has already exited, so writing "exit 0" raises BrokenPipeError. The
+    # container must still be removed rather than leaked.
+    process = _FakeProcess(alive=False)
+    bash_stdin = _FakeStream(write_error=BrokenPipeError())
+    bash_stdout = _FakeStream()
+    container, removed = _container_ready_for_exit(
+        monkeypatch, process=process, bash_stdin=bash_stdin, bash_stdout=bash_stdout
+    )
+
+    container.__exit__(None, None, None)
+
+    assert removed == [True]
+    assert container.process is None
+    assert bash_stdin.closed
+    assert bash_stdout.closed
+    assert not process.killed  # already dead, nothing to kill
+
+
+def test_exit_kills_process_on_shutdown_timeout(monkeypatch: pytest.MonkeyPatch) -> None:
+    # bash refuses to exit, so process.wait(timeout=30) raises TimeoutExpired. The
+    # process must be killed and the container removed rather than leaked.
+    process = _FakeProcess(wait_error=subprocess.TimeoutExpired(cmd="bash", timeout=30))
+    bash_stdin = _FakeStream()
+    bash_stdout = _FakeStream()
+    container, removed = _container_ready_for_exit(
+        monkeypatch, process=process, bash_stdin=bash_stdin, bash_stdout=bash_stdout
+    )
+
+    container.__exit__(None, None, None)
+
+    assert process.killed
+    assert removed == [True]
+    assert container.process is None
+    assert bash_stdin.closed
+    assert bash_stdout.closed
+
+
+@pytest.mark.flaky(reruns=2, reruns_delay=5)
 @pytest.mark.parametrize("platform", list(OCIPlatform))
 def test_multiarch_image(container_engine: OCIContainerEngineConfig, platform: OCIPlatform) -> None:
     if detect_ci_provider() == CIProvider.travis_ci and DEFAULT_OCI_PLATFORM not in {
@@ -584,9 +755,13 @@ def test_multiarch_image(container_engine: OCIContainerEngineConfig, platform: O
         platform,
     }:
         pytest.skip("Skipping test because docker on this platform does not support QEMU")
-    if container_engine.name == "podman" and platform == OCIPlatform.ARMV7:
+    if container_engine.name == "podman":
+        if platform == OCIPlatform.ARMV7:
             # both GHA & local macOS arm64 podman desktop are failing
             pytest.xfail("podman fails with armv7l images")
+        elif platform == OCIPlatform.i386 and sys.platform.startswith("darwin"):
+            pytest.xfail("podman fails with i386 images on macOS")
+
     with OCIContainer(
         engine=container_engine, image="debian:trixie-slim", oci_platform=platform
     ) as container:
@@ -612,6 +787,14 @@ def test_multiarch_image(container_engine: OCIContainerEngineConfig, platform: O
             OCIPlatform.S390X: "s390x",
         }
         assert output_map_dpkg[platform] == output.strip()
+        # There's no way to check reliably the presence of a specific platform image in the local
+        # store when the image storage backend supports multi-platform images (such as containerd).
+        # When platform != DEFAULT_OCI_PLATFORM and the image storage backend supports
+        # multi-platform images, _get_platform_args will return "--pull=always", at least when the
+        # DEFAULT_OCI_PLATFORM image is present.
+        if platform == DEFAULT_OCI_PLATFORM:
+            expected_platform_args = f"--platform={platform.value}", "--pull=never"
+            assert container._get_platform_args() == expected_platform_args
 
 
 @pytest.mark.parametrize(

unit_test/option_prepare_test.py

@@ -14,7 +14,7 @@ from cibuildwheel.oci_container import OCIPlatform
 from cibuildwheel.util import file
 
 DEFAULT_IDS = {"cp39", "cp310", "cp311", "cp312", "cp313", "cp314", "cp314t"}
-ALL_IDS = DEFAULT_IDS | {"pp39", "pp310", "pp311", "gp311_242", "gp312_250"}
+ALL_IDS = DEFAULT_IDS | {"pp39", "pp310", "pp311", "gp312_250"}
 
 
 @pytest.fixture
@@ -158,7 +158,6 @@ before-all = "true"
             "pp39",
             "pp310",
             "pp311",
-            "gp311_242",
             "gp312_250",
         }
     }
@@ -180,7 +179,6 @@ before-all = "true"
             "pp39",
             "pp310",
             "pp311",
-            "gp311_242",
             "gp312_250",
         ]
     }

unit_test/options_test.py

@@ -13,7 +13,9 @@ from cibuildwheel import errors
 from cibuildwheel.bashlex_eval import local_environment_executor
 from cibuildwheel.frontend import (
     BuildFrontendConfig,
+    _split_config_settings,
     get_build_frontend_extra_flags,
+    parse_config_settings,
     prepare_config_settings,
 )
 from cibuildwheel.logger import Logger
@@ -608,6 +610,29 @@ def test_prepare_config_settings(config_settings: str, expected: str) -> None:
     )
 
 
+@pytest.mark.parametrize(
+    ("project", "package"),
+    [
+        (R"C:\Users\John Doe\project", R"C:\Users\John Doe\project\pkg"),
+        ("/home/me/my project", "/home/me/my project/pkg"),
+    ],
+)
+def test_prepare_config_settings_special_chars(project: str, package: str) -> None:
+    # Paths with spaces or backslashes must survive the round-trip through the
+    # downstream shlex.split intact (regression test for the {package}/{project}
+    # substitution being mangled by re-parsing).
+    config_settings = "setup-args=--cross-file={package}/cross.ini other-setting={project}"
+    prepared = prepare_config_settings(config_settings, project=project, package=package)
+    assert _split_config_settings(prepared) == [
+        f"-Csetup-args=--cross-file={package}/cross.ini",
+        f"-Cother-setting={project}",
+    ]
+    assert parse_config_settings(prepared) == {
+        "setup-args": f"--cross-file={package}/cross.ini",
+        "other-setting": project,
+    }
+
+
 @pytest.mark.parametrize(
     ("definition", "expected_args"),
     [
@@ -667,3 +692,51 @@ def test_xbuild_tools_handling(tmp_path: Path, definition: str, expected: list[s
 
     local = options.build_options("cp313-ios_13_0_arm64_iphoneos")
     assert local.xbuild_tools == expected
+
+
+DEFAULT_XBUILD_FILES = {
+    "numpy": [
+        "numpy/_core/include/numpy/_numpyconfig.h",
+        "numpy/_core/include/numpy/numpyconfig.h",
+        "numpy/_core/lib/libnpymath.a",
+        "numpy/random/lib/libnpyrandom.a",
+    ]
+}
+
+
+@pytest.mark.parametrize(
+    ("definition", "expected"),
+    [
+        ("", DEFAULT_XBUILD_FILES),
+        ('xbuild-files = ""', {}),
+        ('xbuild-files = "package1: file1"', {"package1": ["file1"]}),
+        (
+            "xbuild-files = \"package1: 'file1 with space'; package2: file2a file2b\"",
+            {"package1": ["file1 with space"], "package2": ["file2a", "file2b"]},
+        ),
+    ],
+)
+def test_xbuild_files(tmp_path: Path, definition: str, expected: dict[str, list[str]]) -> None:
+    args = CommandLineArguments.defaults()
+    args.package_dir = tmp_path
+
+    pyproject_toml: Path = tmp_path / "pyproject.toml"
+    pyproject_toml.write_text(
+        textwrap.dedent(
+            f"""\
+            [tool.cibuildwheel]
+            {definition}
+            """
+        )
+    )
+
+    options = Options(platform="ios", command_line_arguments=args, env={})
+    assert options.build_options(None).xbuild_files == expected
+
+    pyproject_toml.write_text(
+        "[tool.cibuildwheel.xbuild-files]\n"
+        + "\n".join(f"{package} = {files}" for package, files in expected.items())
+    )
+
+    options = Options(platform="ios", command_line_arguments=args, env={})
+    assert options.build_options(None).xbuild_files == expected

unit_test/python_build_standalone_test.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import platform
+import subprocess
+from typing import Any
+
+import pytest
+
+from cibuildwheel.util import python_build_standalone as pbs
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+# Real-world `ldd --version` outputs.
+GLIBC_STDOUT = "ldd (Ubuntu GLIBC 2.35-0ubuntu3.1) 2.35\n"
+MUSL_STDERR = "musl libc (x86_64)\nVersion 1.2.4\nDynamic Program Loader\n"
+
+
+def _fake_ldd(
+    stdout: str = "", stderr: str = ""
+) -> Callable[..., subprocess.CompletedProcess[str]]:
+    def run(*args: Any, **kwargs: Any) -> subprocess.CompletedProcess[str]:
+        return subprocess.CompletedProcess(args=args, returncode=0, stdout=stdout, stderr=stderr)
+
+    return run
+
+
+def test_is_musl_libc_detects_musl(monkeypatch: pytest.MonkeyPatch) -> None:
+    # musl's ldd prints to stderr and exits non-zero, but capture both streams
+    monkeypatch.setattr(subprocess, "run", _fake_ldd(stderr=MUSL_STDERR))
+    assert pbs._is_musl_libc() is True
+
+
+def test_is_musl_libc_detects_glibc(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(subprocess, "run", _fake_ldd(stdout=GLIBC_STDOUT))
+    assert pbs._is_musl_libc() is False
+
+
+def test_is_musl_libc_missing_ldd(monkeypatch: pytest.MonkeyPatch) -> None:
+    def run(*args: Any, **kwargs: Any) -> subprocess.CompletedProcess[str]:
+        msg = "ldd"
+        raise FileNotFoundError(msg)
+
+    monkeypatch.setattr(subprocess, "run", run)
+    assert pbs._is_musl_libc() is False
+
+
+@pytest.mark.parametrize(
+    ("musl", "expected_libc"),
+    [(True, "musl"), (False, "gnu")],
+)
+def test_linux_platform_identifiers_libc(
+    monkeypatch: pytest.MonkeyPatch, musl: bool, expected_libc: str
+) -> None:
+    monkeypatch.setattr(platform, "system", lambda: "Linux")
+    monkeypatch.setattr(platform, "machine", lambda: "x86_64")
+    monkeypatch.setattr(pbs, "_is_musl_libc", lambda: musl)
+
+    arch, platform_id, libc = pbs._get_platform_identifiers()
+    assert arch == "x86_64"
+    assert platform_id == "unknown-linux"
+    assert libc == expected_libc

unit_test/test_sha256.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import hashlib
+
+from cibuildwheel.platforms import pyodide
+from cibuildwheel.util import python_build_standalone
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    import pytest
+
+
+def test_pyodide_all_python_configurations_accept_sha256() -> None:
+    python_configurations = pyodide.all_python_configurations()
+
+    assert python_configurations
+    assert all(config.sha256 for config in python_configurations)
+
+
+def test_download_or_get_from_cache_uses_valid_cached_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    cached_file = tmp_path / "python-build-standalone.tar.gz"
+    cached_bytes = b"cached archive"
+    cached_file.write_bytes(cached_bytes)
+    cached_sha256 = hashlib.sha256(cached_bytes).hexdigest()
+
+    was_downloaded = False
+
+    def fake_download(url: str, dest: Path, *, sha256: str | None = None) -> None:  # noqa: ARG001
+        nonlocal was_downloaded
+        was_downloaded = True
+
+    monkeypatch.setattr(python_build_standalone, "download", fake_download)
+
+    archive_path = python_build_standalone._download_or_get_from_cache(
+        asset_url="https://example.com/python-build-standalone.tar.gz",
+        asset_filename=cached_file.name,
+        cache_dir=tmp_path,
+        sha256=cached_sha256,
+    )
+
+    assert archive_path == cached_file
+    assert not was_downloaded
+
+
+def test_download_or_get_from_cache_redownloads_invalid_cached_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    cached_file = tmp_path / "python-build-standalone.tar.gz"
+    cached_file.write_bytes(b"bad cache")
+    expected_bytes = b"good archive"
+    expected_sha256 = hashlib.sha256(expected_bytes).hexdigest()
+
+    def fake_download(url: str, dest: Path, *, sha256: str | None = None) -> None:  # noqa: ARG001
+        assert sha256 == expected_sha256
+        dest.write_bytes(expected_bytes)
+
+    monkeypatch.setattr(python_build_standalone, "download", fake_download)
+
+    archive_path = python_build_standalone._download_or_get_from_cache(
+        asset_url="https://example.com/python-build-standalone.tar.gz",
+        asset_filename=cached_file.name,
+        cache_dir=tmp_path,
+        sha256=expected_sha256,
+    )
+
+    assert archive_path == cached_file
+    assert cached_file.read_bytes() == expected_bytes

unit_test/utils_test.py

@@ -1,3 +1,4 @@
+import re
 import textwrap
 from pathlib import Path, PurePath
 from unittest.mock import Mock, call
@@ -6,7 +7,7 @@ import pytest
 
 from cibuildwheel import errors
 from cibuildwheel.ci import fix_ansi_codes_for_github_actions
-from cibuildwheel.util.file import copy_test_sources
+from cibuildwheel.util.file import copy_test_sources, remove_on_error
 from cibuildwheel.util.helpers import (
     FlexibleVersion,
     format_safe,
@@ -212,6 +213,28 @@ def test_parse_key_value_string() -> None:
     }
 
 
+def test_parse_key_value_string_unknown_name() -> None:
+    # Unknown fields are not allowed by default.
+    with pytest.raises(ValueError, match=r"Failed to parse 'key: value'. Unknown field name 'key'"):
+        parse_key_value_string("key: value")
+
+    # Unknown fields can be enabled by passing "*".
+    assert parse_key_value_string(
+        "key: value",
+        kw_arg_names=["*"],
+    ) == {
+        "key": ["value"],
+    }
+
+    assert parse_key_value_string(
+        "key1: value1a value1b; key2: value2",
+        kw_arg_names=["*"],
+    ) == {
+        "key1": ["value1a", "value1b"],
+        "key2": ["value2"],
+    }
+
+
 def test_flexible_version_comparisons() -> None:
     assert FlexibleVersion("2.0") == FlexibleVersion("2")
     assert FlexibleVersion("2.0") < FlexibleVersion("2.1")
@@ -373,6 +396,58 @@ def test_copy_test_sources_alternate_copy_into(sample_project: Path) -> None:
     )
 
 
+def test_remove_on_error_keeps_paths(tmp_path: Path) -> None:
+    file_path = tmp_path / "file.txt"
+    file_path.write_text("data")
+    dir_path = tmp_path / "dir"
+    dir_path.mkdir()
+
+    for path in (file_path, dir_path):
+        with remove_on_error(path):
+            pass
+
+    assert file_path.exists()
+    assert dir_path.exists()
+
+
+def test_remove_on_error_file_or_tree(tmp_path: Path) -> None:
+    file_path = tmp_path / "file.txt"
+    file_path.write_text("data")
+    dir_path = tmp_path / "dir"
+    nested_file_path = dir_path / "nested.txt"
+    nested_file_path.parent.mkdir()
+    nested_file_path.write_text("data")
+
+    for path in (file_path, dir_path):
+        with pytest.raises(RuntimeError), remove_on_error(path):
+            raise RuntimeError
+
+    assert not file_path.exists()
+    assert not dir_path.exists()
+
+
+def test_remove_on_error_cleanup_failure(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    path = tmp_path / "cleanup-failure"
+    path.mkdir()
+    original_exception = RuntimeError("original error")
+    cleanup_exception = PermissionError("cleanup error")
+
+    def _raise_cleanup_error(_: Path) -> None:
+        raise cleanup_exception
+
+    monkeypatch.setattr("cibuildwheel.util.file.shutil.rmtree", _raise_cleanup_error)
+    with (
+        pytest.raises(
+            BaseExceptionGroup,
+            match=re.escape(f"Failed to remove {path}. Please remove it manually."),
+        ) as caught_exception,
+        remove_on_error(path),
+    ):
+        raise original_exception
+
+    assert caught_exception.value.exceptions == (original_exception, cleanup_exception)
+
+
 def test_unwrap() -> None:
     assert (
         unwrap("""