Bump version: v1.6.4

* Use certifi provided certificates when downloading files

* fix typo

* Add comment about certifi usage

Co-authored-by: Joe Rickerby <joerick@mac.com>

Co-authored-by: Joe Rickerby <joerick@mac.com>

.circleci/config.yml

@@ -3,7 +3,7 @@ version: 2
 jobs:
   osx-python3.6:
     macos:
-      xcode: "9.4.1"
+      xcode: 10.2.1
     environment:
       PYTHON: python3
     steps:

.travis.yml

@@ -28,7 +28,10 @@ jobs:
 
     - name: macOS | x86_64 | Python 3.x
       os: osx
-      env: PYTHON=python3
+      osx_image: xcode10.2
+      env:
+        - PYTHON=python3
+        - PYTEST_ADDOPTS='-k "unit_test or test_0_basic" --suppress-no-test-exit-code'
 
     - name: Windows | x86_64 | Python 3.6
       os: windows
@@ -52,6 +55,6 @@ jobs:
     # must repeat the s390x job above exactly to match
     - *linux_s390x_36
 
-install: $PYTHON -m pip install -r requirements-dev.txt
+install: $PYTHON -m pip install -r requirements-dev.txt pytest-custom-exit-code
 
 script: $PYTHON ./bin/run_tests.py

README.md

@@ -23,8 +23,9 @@ What does it do?
 | CPython 3.7     | ✅ | ✅  | ✅  | ✅ | ✅ | ✅² | ✅² | ✅³ |
 | CPython 3.8     | ✅ | ✅  | ✅  | ✅ | ✅ | ✅² | ✅² | ✅³ |
 | CPython 3.9     | ✅ | ✅  | ✅  | ✅ | ✅ | ✅² | ✅² | ✅³ |
-| PyPy 2.7 v7.3.0 | ✅ |    | ✅  | ✅ |    |    |    |    |
-| PyPy 3.6 v7.3.0 | ✅ |    | ✅  | ✅ |    |    |    |    |
+| PyPy 2.7 v7.3.2 | ✅ |    | ✅  | ✅ |    |    |    |    |
+| PyPy 3.6 v7.3.2 | ✅ |    | ✅  | ✅ |    |    |    |    |
+| PyPy 3.7 (alpha) v7.3.2 | ✅ |    | ✅  | ✅ |    |    |    |    |
 
 <sup>¹ Not supported on Travis</sup><br>
 <sup>² Only supported on Travis</sup><br>
@@ -66,6 +67,8 @@ jobs:
     - services: docker
     # and a mac build
     - os: osx
+      # PyPy 7.3.2 needs macOS >= 10.14
+      osx_image: xcode10.2
       language: shell
     # and a windows build
     - os: windows
@@ -82,7 +85,7 @@ env:
     # Note: TWINE_PASSWORD is set to a PyPI API token in Travis settings
 
 install:
-  - python3 -m pip install cibuildwheel==1.6.1
+  - python3 -m pip install cibuildwheel==1.6.4
 
 script:
   # build the wheels, put them into './wheelhouse'
@@ -142,7 +145,7 @@ Here are some repos that use cibuildwheel.
 - [pikepdf](https://github.com/pikepdf/pikepdf)
 - [fathon](https://github.com/stfbnc/fathon)
 - [etebase-py](https://github.com/etesync/etebase-py) - Python bindings to a Rust library using `setuptools-rust`, and `sccache` for improved speed, built on Travis CI.
-
+- [xmlstarlet](https://github.com/dimitern/xmlstarlet) - Python 3.6+ CFFI bindings with true MSVC build and GitHub Actions.
 > Add your repo here! Send a PR.
 >
 > <sup>I'd like to include notes here to indicate why an example might be interesting to cibuildwheel users - the styles/technologies/techniques used in each. Please include that in future additions!</sup>
@@ -159,6 +162,27 @@ This is similar to static linking, so it might have some licence implications. C
 Changelog
 =========
 
+### 1.6.4
+
+_31 October 2020_
+
+- 🐛 Fix crash on Appveyor during nuget install due to old system CA
+  certificates. We now use certifi's CA certs to download files. (#455)
+
+### 1.6.3
+
+_12 October 2020_
+
+- 🐛 Fix missing SSL certificates on macOS (#447)
+- 🛠 Update OpenSSL Python 3.5 patch to 1.1.1h on macOS (#449)
+
+### 1.6.2
+
+_9 October 2020_
+
+- ✨ Python 3.9 updated to the final release version - v3.9.0 (#440)
+- 🛠 Pypy updated to v7.3.2, adding alpha support for Python 3.7 (#430)
+
 ### 1.6.1
 
 _20 September 2020_
@@ -539,6 +563,7 @@ Maintainers
 - Joe Rickerby [@joerick](https://github.com/joerick)
 - Yannick Jadoul [@YannickJadoul](https://github.com/YannickJadoul)
 - Matthieu Darbois [@mayeut](https://github.com/mayeut)
+- Henry Schreiner [@henryiii](https://github.com/henryiii)
 
 Credits
 -------

appveyor.yml

@@ -1,7 +1,4 @@
 environment:
-  # workaround an appveyor bug on macos
-  # see https://github.com/appveyor/ci/issues/3376#issuecomment-611314299
-  APPVEYOR_CONSOLE_DISABLE_PTY: true
   matrix:
     - APPVEYOR_BUILD_WORKER_IMAGE: Ubuntu
       APPVEYOR_JOB_NAME: "python37-x64-ubuntu"
@@ -10,11 +7,6 @@ environment:
     - APPVEYOR_BUILD_WORKER_IMAGE: macos-mojave
       APPVEYOR_JOB_NAME: "python37-x64-macos-mojave"
 
-# while pypy libffi dependency is failing the build, allow failures on macos
-matrix:
-  allow_failures:
-    - APPVEYOR_BUILD_WORKER_IMAGE: macos-mojave
-
 stack: python 3.7
 
 build: off
@@ -24,7 +16,7 @@ init:
 - ps: |
       $BRANCH = if ($env:APPVEYOR_PULL_REQUEST_HEAD_REPO_BRANCH) { $env:APPVEYOR_PULL_REQUEST_HEAD_REPO_BRANCH } else { $env:APPVEYOR_REPO_BRANCH }
       if (-not ($BRANCH -eq 'master' -or $BRANCH.ToLower().StartsWith('appveyor-'))) {
-        $env:PYTEST_ADDOPTS='-k "unit_test or _basic" --suppress-no-test-exit-code'
+        $env:PYTEST_ADDOPTS='-k "unit_test or test_0_basic" --suppress-no-test-exit-code'
       }
 
 install: python -m pip install -r requirements-dev.txt pytest-custom-exit-code

bin/bump_version.py

@@ -7,6 +7,7 @@ import cibuildwheel
 from packaging.version import Version, InvalidVersion
 import subprocess
 import glob
+import urllib.parse
 
 config = [
     # file path, version find/replace format
@@ -87,6 +88,24 @@ def bump_version():
 
     print('Files updated. If you want to update the changelog as part of this')
     print('commit, do that now.')
+    print()
+
+    try:
+        commit_date_str = subprocess.run([
+            'git',
+            'show', '-s', '--pretty=format:%ci',
+            f'v{current_version}^{{commit}}'
+        ], check=True, capture_output=True, encoding='utf8').stdout
+        commit_date_parts = commit_date_str.split(' ')
+
+        url = 'https://github.com/joerick/cibuildwheel/pulls?' + urllib.parse.urlencode({
+            'q': f'is:pr merged:>{commit_date_parts[0]}T{commit_date_parts[1]}{commit_date_parts[2]}',
+        })
+        print(f'PRs merged since last release:\n  {url}')
+        print()
+    except subprocess.CalledProcessError as e:
+        print(e)
+        print('Failed to get previous version tag information.')
 
     while input('Type "done" to continue: ').strip().lower() != 'done':
         pass

bin/update_dependencies.py

@@ -19,7 +19,7 @@ subprocess.check_call([
     '--upgrade',
     'cibuildwheel/resources/constraints.in',
 ])
-for python_version in ['27', '35', '36']:
+for python_version in ['27', '35', '36', '37']:
     subprocess.check_call([
         f'./env{python_version}/bin/pip-compile',
         '--allow-unsafe',

cibuildwheel/__init__.py

@@ -1 +1 @@
-__version__ = '1.6.1'
+__version__ = '1.6.4'

cibuildwheel/linux.py

@@ -60,6 +60,7 @@ def get_python_configurations(build_selector: BuildSelector) -> List[PythonConfi
         PythonConfiguration(version='3.9', identifier='cp39-manylinux_i686', path_str='/opt/python/cp39-cp39'),
         PythonConfiguration(version='2.7', identifier='pp27-manylinux_x86_64', path_str='/opt/python/pp27-pypy_73'),
         PythonConfiguration(version='3.6', identifier='pp36-manylinux_x86_64', path_str='/opt/python/pp36-pypy36_pp73'),
+        PythonConfiguration(version='3.7', identifier='pp37-manylinux_x86_64', path_str='/opt/python/pp37-pypy37_pp73'),
         PythonConfiguration(version='3.5', identifier='cp35-manylinux_aarch64', path_str='/opt/python/cp35-cp35m'),
         PythonConfiguration(version='3.6', identifier='cp36-manylinux_aarch64', path_str='/opt/python/cp36-cp36m'),
         PythonConfiguration(version='3.7', identifier='cp37-manylinux_aarch64', path_str='/opt/python/cp37-cp37m'),

cibuildwheel/macos.py

@@ -11,7 +11,7 @@ from typing import Dict, List, NamedTuple, Optional, Sequence, Union
 from .environment import ParsedEnvironment
 from .util import (BuildOptions, BuildSelector, NonPlatformWheelError, download,
                    get_build_verbosity_extra_flags, get_pip_script,
-                   prepare_command)
+                   prepare_command, install_certifi_script)
 
 
 def call(args: Union[str, Sequence[Union[str, PathLike]]], env: Optional[Dict[str, str]] = None, cwd: Optional[str] = None, shell: bool = False) -> int:
@@ -38,10 +38,11 @@ def get_python_configurations(build_selector: BuildSelector) -> List[PythonConfi
         PythonConfiguration(version='3.6', identifier='cp36-macosx_x86_64', url='https://www.python.org/ftp/python/3.6.8/python-3.6.8-macosx10.9.pkg'),
         PythonConfiguration(version='3.7', identifier='cp37-macosx_x86_64', url='https://www.python.org/ftp/python/3.7.8/python-3.7.8-macosx10.9.pkg'),
         PythonConfiguration(version='3.8', identifier='cp38-macosx_x86_64', url='https://www.python.org/ftp/python/3.8.4/python-3.8.4-macosx10.9.pkg'),
-        PythonConfiguration(version='3.9', identifier='cp39-macosx_x86_64', url='https://www.python.org/ftp/python/3.9.0/python-3.9.0rc1-macosx10.9.pkg'),
+        PythonConfiguration(version='3.9', identifier='cp39-macosx_x86_64', url='https://www.python.org/ftp/python/3.9.0/python-3.9.0-macosx10.9.pkg'),
         # PyPy
-        PythonConfiguration(version='2.7', identifier='pp27-macosx_x86_64', url='https://downloads.python.org/pypy/pypy2.7-v7.3.1-osx64.tar.bz2'),
-        PythonConfiguration(version='3.6', identifier='pp36-macosx_x86_64', url='https://downloads.python.org/pypy/pypy3.6-v7.3.1-osx64.tar.bz2'),
+        PythonConfiguration(version='2.7', identifier='pp27-macosx_x86_64', url='https://downloads.python.org/pypy/pypy2.7-v7.3.2-osx64.tar.bz2'),
+        PythonConfiguration(version='3.6', identifier='pp36-macosx_x86_64', url='https://downloads.python.org/pypy/pypy3.6-v7.3.2-osx64.tar.bz2'),
+        PythonConfiguration(version='3.7', identifier='pp37-macosx_x86_64', url='https://downloads.python.org/pypy/pypy3.7-v7.3.2-osx64.tar.bz2'),
     ]
 
     # skip builds as required
@@ -71,6 +72,9 @@ def install_cpython(version: str, url: str) -> Path:
 
     # if this version of python isn't installed, get it from python.org and install
     python_package_identifier = f'org.python.Python.PythonFramework-{version}'
+    python_executable = 'python3' if version[0] == '3' else 'python'
+    installation_bin_path = Path(f'/Library/Frameworks/Python.framework/Versions/{version}/bin')
+
     if python_package_identifier not in installed_system_packages:
         # download the pkg
         download(url, Path('/tmp/Python.pkg'))
@@ -78,12 +82,12 @@ def install_cpython(version: str, url: str) -> Path:
         call(['sudo', 'installer', '-pkg', '/tmp/Python.pkg', '-target', '/'])
         # patch open ssl
         if version == '3.5':
-            open_ssl_patch_url = f'https://github.com/mayeut/patch-macos-python-openssl/releases/download/v1.0.2u/patch-macos-python-{version}-openssl-v1.0.2u.tar.gz'
+            open_ssl_patch_url = f'https://github.com/mayeut/patch-macos-python-openssl/releases/download/v1.1.1h/patch-macos-python-{version}-openssl-v1.1.1h.tar.gz'
             download(open_ssl_patch_url, Path('/tmp/python-patch.tar.gz'))
             call(['sudo', 'tar', '-C', f'/Library/Frameworks/Python.framework/Versions/{version}/', '-xmf', '/tmp/python-patch.tar.gz'])
 
-    installation_bin_path = Path(f'/Library/Frameworks/Python.framework/Versions/{version}/bin')
-    python_executable = 'python3' if version[0] == '3' else 'python'
+        call(["sudo", str(installation_bin_path/python_executable), str(install_certifi_script)])
+
     pip_executable = 'pip3' if version[0] == '3' else 'pip'
     make_symlinks(installation_bin_path, python_executable, pip_executable)
 

cibuildwheel/resources/constraints-python27.txt

@@ -10,17 +10,17 @@ contextlib2==0.6.0.post1  # via importlib-metadata, importlib-resources
 delocate==0.8.2           # via -r cibuildwheel/resources/constraints.in
 distlib==0.3.1            # via virtualenv
 filelock==3.0.12          # via virtualenv
-importlib-metadata==1.7.0  # via virtualenv
+importlib-metadata==2.0.0  # via virtualenv
 importlib-resources==3.0.0  # via virtualenv
 pathlib2==2.3.5           # via importlib-metadata, importlib-resources, virtualenv
 scandir==1.10.0           # via pathlib2
 singledispatch==3.4.0.3   # via importlib-resources
 six==1.15.0               # via pathlib2, virtualenv
 typing==3.7.4.3           # via importlib-resources
-virtualenv==20.0.31       # via -r cibuildwheel/resources/constraints.in
+virtualenv==20.0.33       # via -r cibuildwheel/resources/constraints.in
 wheel==0.35.1             # via -r cibuildwheel/resources/constraints.in, delocate
 zipp==1.2.0               # via importlib-metadata, importlib-resources
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==20.2.2               # via -r cibuildwheel/resources/constraints.in
+pip==20.2.3               # via -r cibuildwheel/resources/constraints.in
 setuptools==44.1.1        # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python35.txt

@@ -8,13 +8,13 @@ appdirs==1.4.4            # via virtualenv
 delocate==0.8.2           # via -r cibuildwheel/resources/constraints.in
 distlib==0.3.1            # via virtualenv
 filelock==3.0.12          # via virtualenv
-importlib-metadata==1.7.0  # via virtualenv
+importlib-metadata==2.0.0  # via virtualenv
 importlib-resources==3.0.0  # via virtualenv
 six==1.15.0               # via virtualenv
-virtualenv==20.0.31       # via -r cibuildwheel/resources/constraints.in
+virtualenv==20.0.33       # via -r cibuildwheel/resources/constraints.in
 wheel==0.35.1             # via -r cibuildwheel/resources/constraints.in, delocate
 zipp==1.2.0               # via importlib-metadata, importlib-resources
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==20.2.2               # via -r cibuildwheel/resources/constraints.in
+pip==20.2.3               # via -r cibuildwheel/resources/constraints.in
 setuptools==50.3.0        # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python36.txt

@@ -8,13 +8,13 @@ appdirs==1.4.4            # via virtualenv
 delocate==0.8.2           # via -r cibuildwheel/resources/constraints.in
 distlib==0.3.1            # via virtualenv
 filelock==3.0.12          # via virtualenv
-importlib-metadata==1.7.0  # via virtualenv
+importlib-metadata==2.0.0  # via virtualenv
 importlib-resources==3.0.0  # via virtualenv
 six==1.15.0               # via virtualenv
-virtualenv==20.0.31       # via -r cibuildwheel/resources/constraints.in
+virtualenv==20.0.33       # via -r cibuildwheel/resources/constraints.in
 wheel==0.35.1             # via -r cibuildwheel/resources/constraints.in, delocate
-zipp==3.1.0               # via importlib-metadata, importlib-resources
+zipp==3.3.0               # via importlib-metadata, importlib-resources
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==20.2.2               # via -r cibuildwheel/resources/constraints.in
+pip==20.2.3               # via -r cibuildwheel/resources/constraints.in
 setuptools==50.3.0        # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python37.txt

@@ -0,0 +1,19 @@
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    bin/update_constraints.py
+#
+appdirs==1.4.4            # via virtualenv
+delocate==0.8.2           # via -r cibuildwheel/resources/constraints.in
+distlib==0.3.1            # via virtualenv
+filelock==3.0.12          # via virtualenv
+importlib-metadata==2.0.0  # via virtualenv
+six==1.15.0               # via virtualenv
+virtualenv==20.0.33       # via -r cibuildwheel/resources/constraints.in
+wheel==0.35.1             # via -r cibuildwheel/resources/constraints.in, delocate
+zipp==3.3.0               # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+pip==20.2.3               # via -r cibuildwheel/resources/constraints.in
+setuptools==50.3.0        # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints.txt

@@ -8,12 +8,10 @@ appdirs==1.4.4            # via virtualenv
 delocate==0.8.2           # via -r cibuildwheel/resources/constraints.in
 distlib==0.3.1            # via virtualenv
 filelock==3.0.12          # via virtualenv
-importlib-metadata==1.7.0  # via virtualenv
 six==1.15.0               # via virtualenv
-virtualenv==20.0.31       # via -r cibuildwheel/resources/constraints.in
+virtualenv==20.0.33       # via -r cibuildwheel/resources/constraints.in
 wheel==0.35.1             # via -r cibuildwheel/resources/constraints.in, delocate
-zipp==3.1.0               # via importlib-metadata
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==20.2.2               # via -r cibuildwheel/resources/constraints.in
+pip==20.2.3               # via -r cibuildwheel/resources/constraints.in
 setuptools==50.3.0        # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/install_certifi.py

@@ -0,0 +1,50 @@
+# Based on: https://github.com/python/cpython/blob/master/Mac/BuildScript/resources/install_certificates.command
+
+# install_certifi.py
+#
+# sample script to install or update a set of default Root Certificates
+# for the ssl module.  Uses the certificates provided by the certifi package:
+#       https://pypi.org/project/certifi/
+
+import os
+import os.path
+import ssl
+import stat
+import subprocess
+import sys
+
+STAT_0o775 = (stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
+              | stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
+              | stat.S_IROTH | stat.S_IXOTH)
+
+if sys.version_info[0] == 2:
+    FileNotFoundError = OSError
+
+
+def main():
+    openssl_dir, openssl_cafile = os.path.split(
+        ssl.get_default_verify_paths().openssl_cafile)
+    print(" -- pip install --upgrade certifi")
+    subprocess.check_call([sys.executable,
+                           "-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])
+
+    import certifi
+    # change working directory to the default SSL directory
+    os.chdir(openssl_dir)
+    relpath_to_certifi_cafile = os.path.relpath(certifi.where())
+
+    print(" -- removing any existing file or link")
+    try:
+        os.remove(openssl_cafile)
+    except FileNotFoundError:
+        pass
+    print(" -- creating symlink to certifi certificate bundle")
+    os.symlink(relpath_to_certifi_cafile, openssl_cafile)
+
+    print(" -- setting permissions")
+    os.chmod(openssl_cafile, STAT_0o775)
+    print(" -- update complete")
+
+
+if __name__ == '__main__':
+    main()

cibuildwheel/resources/pinned_docker_images.cfg

@@ -1,22 +1,21 @@
 [x86_64]
-manylinux1 = quay.io/pypa/manylinux1_x86_64:2020-09-20-9444d5c
-manylinux2010 = quay.io/pypa/manylinux2010_x86_64:2020-09-20-6131e60
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2020-09-20-fb9af88
+manylinux1 = quay.io/pypa/manylinux1_x86_64:2020-10-06-c4a4a7c
+manylinux2010 = quay.io/pypa/manylinux2010_x86_64:2020-10-06-786a931
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2020-10-06-b2ca7a1
 
 [i686]
-manylinux1 = quay.io/pypa/manylinux1_i686:2020-09-20-9444d5c
-manylinux2010 = quay.io/pypa/manylinux2010_i686:2020-09-20-6131e60
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2020-09-20-fb9af88
+manylinux1 = quay.io/pypa/manylinux1_i686:2020-10-06-c4a4a7c
+manylinux2010 = quay.io/pypa/manylinux2010_i686:2020-10-06-786a931
+manylinux2014 = quay.io/pypa/manylinux2014_i686:2020-10-06-b2ca7a1
 
 [pypy_x86_64]
-manylinux2010 = pypywheels/manylinux2010-pypy_x86_64:2020-07-02-fd8c128
+manylinux2010 = pypywheels/manylinux2010-pypy_x86_64:2020-09-26-8f210b5
 
 [aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2020-09-20-fb9af88
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2020-10-06-b2ca7a1
 
 [ppc64le]
-manylinux2014 = quay.io/pypa/manylinux2014_ppc64le:2020-09-20-fb9af88
+manylinux2014 = quay.io/pypa/manylinux2014_ppc64le:2020-10-06-b2ca7a1
 
 [s390x]
-manylinux2014 = quay.io/pypa/manylinux2014_s390x:2020-09-20-fb9af88
-
+manylinux2014 = quay.io/pypa/manylinux2014_s390x:2020-10-06-b2ca7a1

cibuildwheel/util.py

@@ -1,6 +1,8 @@
 import os
 import textwrap
+import certifi
 import urllib.request
+import ssl
 from fnmatch import fnmatch
 from pathlib import Path
 from time import sleep
@@ -66,10 +68,14 @@ def download(url: str, dest: Path) -> None:
     if not dest_dir.exists():
         dest_dir.mkdir(parents=True)
 
+    # we've had issues when relying on the host OS' CA certificates on Windows,
+    # so we use certifi (this sounds odd but requests also does this by default)
+    cafile = os.environ.get('SSL_CERT_FILE', certifi.where())
+    context = ssl.create_default_context(cafile=cafile)
     repeat_num = 3
     for i in range(repeat_num):
         try:
-            response = urllib.request.urlopen(url)
+            response = urllib.request.urlopen(url, context=context)
         except Exception:
             if i == repeat_num - 1:
                 raise
@@ -107,6 +113,9 @@ class DependencyConstraints:
         else:
             return self.base_file_path
 
+    def __str__(self):
+        return f"File '{self.base_file_path}'"
+
 
 class BuildOptions(NamedTuple):
     package_dir: Path
@@ -127,6 +136,7 @@ class BuildOptions(NamedTuple):
 
 resources_dir = Path(__file__).resolve().parent / 'resources'
 get_pip_script = resources_dir / 'get-pip.py'
+install_certifi_script = resources_dir / "install_certifi.py"
 
 
 class NonPlatformWheelError(Exception):

cibuildwheel/windows.py

@@ -58,11 +58,12 @@ def get_python_configurations(build_selector: BuildSelector) -> List[PythonConfi
         PythonConfiguration(version='3.7.8', arch='64', identifier='cp37-win_amd64', url=None),
         PythonConfiguration(version='3.8.4', arch='32', identifier='cp38-win32', url=None),
         PythonConfiguration(version='3.8.4', arch='64', identifier='cp38-win_amd64', url=None),
-        PythonConfiguration(version='3.9.0-rc1', arch='32', identifier='cp39-win32', url=None),
-        PythonConfiguration(version='3.9.0-rc1', arch='64', identifier='cp39-win_amd64', url=None),
+        PythonConfiguration(version='3.9.0', arch='32', identifier='cp39-win32', url=None),
+        PythonConfiguration(version='3.9.0', arch='64', identifier='cp39-win_amd64', url=None),
         # PyPy
-        PythonConfiguration(version='2.7', arch='32', identifier='pp27-win32', url='https://downloads.python.org/pypy/pypy2.7-v7.3.1-win32.zip'),
-        PythonConfiguration(version='3.6', arch='32', identifier='pp36-win32', url='https://downloads.python.org/pypy/pypy3.6-v7.3.1-win32.zip'),
+        PythonConfiguration(version='2.7', arch='32', identifier='pp27-win32', url='https://downloads.python.org/pypy/pypy2.7-v7.3.2-win32.zip'),
+        PythonConfiguration(version='3.6', arch='32', identifier='pp36-win32', url='https://downloads.python.org/pypy/pypy3.6-v7.3.2-win32.zip'),
+        PythonConfiguration(version='3.7', arch='32', identifier='pp37-win32', url='https://downloads.python.org/pypy/pypy3.7-v7.3.2-win32.zip'),
     ]
 
     if IS_RUNNING_ON_TRAVIS:

docs/contributing.md

@@ -38,29 +38,69 @@ cibuildwheel's _minimal_ example configs can be tested on a simple project on ci
 
 To test minimal configs, make sure you have a clean git repo, then run the script:
 
-    bin/run_example_ci_configs.py
+```bash
+bin/run_example_ci_configs.py
+```
 
 The script will create an isolated 'orphan' commit containing all the minimal config CI files, and a simple C extension project, and push that to a branch on the `origin` repo. The project's CI is already set up to run on branch push, so will begin testing.
 
 The script then outputs a Markdown table that can be copy/pasted into a PR to monitor and record the test.
 
+## Preparing environments
+
+The dependency update script in the next section requires multiple python versions installed. One way to do this is to use `pyenv`:
+
+```bash
+pyenv install 2.7.18
+pyenv install 3.5.9
+pyenv install 3.6.11
+pyenv install 3.7.8
+# Optionally add 3.8 and make it the local version;
+# otherwise assuming 3.8+ already is your current python version
+```
+
+Then, you need to make the required virtual environments:
+
+```bash
+$(pyenv prefix 2.7.18)/bin/python -m pip install virtualenv
+$(pyenv prefix 2.7.18)/bin/python -m virtualenv env27
+$(pyenv prefix 3.5.9)/bin/python -m venv env35
+$(pyenv prefix 3.6.11)/bin/python -m venv env36
+$(pyenv prefix 3.7.8)/bin/python -m venv env37
+```
+
+<!-- Note for fish users: use zsh/bash for these lines for now, there's not a nice one-line fish replacement -->
+
+And, you need to install the requirements into each environment:
+
+```bash
+for f in env*/bin/pip; do $f install pip-tools; done
+```
+
+
 ## Making a release
 
 Before making a release, ensure pinned dependencies are up-to-date. Run the script:
 
-    bin/make_dependency_update_pr.py
+```bash
+bin/make_dependency_update_pr.py
+```
 
 If updates are needed, this will push a PR with those updates for the CI to test. Once green, merge this PR.
 
 Then, increment the project version number using:
 
-    bin/bump_version.py
+```bash
+bin/bump_version.py
+```
 
 You'll be prompted to enter the new version number. Update the changelog when prompted. The script will create a 'bump version' commit and version tag.
 
 Finally, cut the release and upload to PyPI/Github.
 
-    rm -rf dist
-    python setup.py sdist bdist_wheel
-    twine upload dist/*
-    git push && git push --tags
+```bash
+rm -rf dist
+python setup.py sdist bdist_wheel
+twine upload dist/*
+git push && git push --tags
+```

docs/options.md

@@ -86,13 +86,16 @@ When setting the options, you can use shell-style globbing syntax (as per [`fnma
 | Python 3.6      | cp36-macosx_x86_64  | cp36-manylinux_x86_64  | cp36-manylinux_i686  | cp36-win_amd64  | cp36-win32     | cp36-manylinux_aarch64 | cp36-manylinux_ppc64le | cp36-manylinux_s390x |
 | Python 3.7      | cp37-macosx_x86_64  | cp37-manylinux_x86_64  | cp37-manylinux_i686  | cp37-win_amd64  | cp37-win32     | cp37-manylinux_aarch64 | cp37-manylinux_ppc64le | cp37-manylinux_s390x |
 | Python 3.8      | cp38-macosx_x86_64  | cp38-manylinux_x86_64  | cp38-manylinux_i686  | cp38-win_amd64  | cp38-win32     | cp38-manylinux_aarch64 | cp38-manylinux_ppc64le | cp38-manylinux_s390x |
-| PyPy 2.7 v7.3.0 | pp27-macosx_x86_64  | pp27-manylinux_x86_64  |                      |                 | pp27-win32     |                        |                        |                      |
-| PyPy 3.6 v7.3.0 | pp36-macosx_x86_64  | pp36-manylinux_x86_64  |                      |                 | pp36-win32     |                        |                        |                      |
+| Python 3.9      | cp39-macosx_x86_64  | cp39-manylinux_x86_64  | cp39-manylinux_i686  | cp39-win_amd64  | cp39-win32     | cp39-manylinux_aarch64 | cp39-manylinux_ppc64le | cp39-manylinux_s390x |
+| PyPy 2.7 v7.3.2 | pp27-macosx_x86_64  | pp27-manylinux_x86_64  |                      |                 | pp27-win32     |                        |                        |                      |
+| PyPy 3.6 v7.3.2 | pp36-macosx_x86_64  | pp36-manylinux_x86_64  |                      |                 | pp36-win32     |                        |                        |                      |
+| PyPy 3.7 (alpha) v7.3.2 | pp37-macosx_x86_64  | pp37-manylinux_x86_64  |                      |                 | pp37-win32     |                        |                        |                      |
+
 
 The list of supported and currently selected build identifiers can also be retrieved by passing the `--print-build-identifiers` flag to `cibuildwheel`.
 The format is `python_tag-platform_tag`, with tags similar to those in [PEP 425](https://www.python.org/dev/peps/pep-0425/#details).
 
-For CPython, the minimally supported macOS version is 10.9; for PyPy 2.7 and PyPy 3.6, respectively macOS 10.7 and 10.13 or higher is required.
+For CPython, the minimally supported macOS version is 10.9; for PyPy 2.7 and PyPy 3.6/3.7, respectively macOS 10.7 and 10.13 or higher is required.
 
 #### Examples
 

examples/appveyor-minimal.yml

@@ -12,7 +12,7 @@ stack: python 3.7
 init:
 - cmd: set PATH=C:\Python37;C:\Python37\Scripts;%PATH%
 
-install: python -m pip install cibuildwheel==1.6.1
+install: python -m pip install cibuildwheel==1.6.4
 
 build_script: python -m cibuildwheel --output-dir wheelhouse
 

examples/azure-pipelines-minimal.yml

@@ -5,7 +5,7 @@ jobs:
     - task: UsePythonVersion@0
     - bash: |
         python3 -m pip install --upgrade pip
-        pip3 install cibuildwheel==1.6.1
+        pip3 install cibuildwheel==1.6.4
         cibuildwheel --output-dir wheelhouse .
     - task: PublishBuildArtifacts@1
       inputs: {pathtoPublish: 'wheelhouse'}
@@ -16,7 +16,7 @@ jobs:
     - task: UsePythonVersion@0
     - bash: |
         python3 -m pip install --upgrade pip
-        pip3 install cibuildwheel==1.6.1
+        pip3 install cibuildwheel==1.6.4
         cibuildwheel --output-dir wheelhouse .
     - task: PublishBuildArtifacts@1
       inputs: {pathtoPublish: 'wheelhouse'}
@@ -29,7 +29,7 @@ jobs:
       displayName: Install Visual C++ for Python 2.7
     - bash: |
         python -m pip install --upgrade pip
-        pip install cibuildwheel==1.6.1
+        pip install cibuildwheel==1.6.4
         cibuildwheel --output-dir wheelhouse .
     - task: PublishBuildArtifacts@1
       inputs: {pathtoPublish: 'wheelhouse'}

examples/circleci-minimal.yml

@@ -11,7 +11,7 @@ jobs:
       - run:
           name: Build the Linux wheels.
           command: |
-            pip3 install --user cibuildwheel==1.6.1
+            pip3 install --user cibuildwheel==1.6.4
             cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/
@@ -19,13 +19,14 @@ jobs:
   osx-wheels:
     working_directory: ~/osx-wheels
     macos:
-      xcode: "10.0.0"
+      # PyPy 7.3.2 needs macOS >= 10.14
+      xcode: 10.2.1
     steps:
       - checkout
       - run:
           name: Build the OS X wheels.
           command: |
-            pip3 install cibuildwheel==1.6.1
+            pip3 install cibuildwheel==1.6.4
             cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/

examples/github-deploy.yml

@@ -28,7 +28,7 @@ jobs:
 
       - name: Install cibuildwheel
         run: |
-          python -m pip install cibuildwheel==1.6.1
+          python -m pip install cibuildwheel==1.6.4
 
       - name: Install Visual C++ for Python 2.7
         if: runner.os == 'Windows'

examples/github-minimal.yml

@@ -20,7 +20,7 @@ jobs:
 
       - name: Install cibuildwheel
         run: |
-          python -m pip install cibuildwheel==1.6.1
+          python -m pip install cibuildwheel==1.6.4
 
       - name: Install Visual C++ for Python 2.7
         if: runner.os == 'Windows'

examples/travis-ci-deploy.yml

@@ -9,6 +9,8 @@ jobs:
     - services: docker
     # and a mac build
     - os: osx
+      # PyPy 7.3.2 needs macOS >= 10.14
+      osx_image: xcode10.2
       language: shell
     # and a windows build
     - os: windows
@@ -25,7 +27,7 @@ env:
     # Note: TWINE_PASSWORD is set to a PyPI API token in Travis settings
 
 install:
-  - python3 -m pip install cibuildwheel==1.6.1
+  - python3 -m pip install cibuildwheel==1.6.4
 
 script:
   # build the wheels, put them into './wheelhouse'

examples/travis-ci-minimal.yml

@@ -15,6 +15,8 @@ jobs:
       arch: s390x
     # and a mac build
     - os: osx
+      # PyPy 7.3.2 needs macOS >= 10.14
+      osx_image: xcode10.2
       language: shell
     # and a windows build
     - os: windows
@@ -26,7 +28,7 @@ jobs:
         - ln -s /c/Python38/python.exe /c/Python38/python3.exe
 
 install:
-  - python3 -m pip install cibuildwheel==1.6.1
+  - python3 -m pip install cibuildwheel==1.6.4
 
 script:
   # build the wheels, put them into './wheelhouse'

examples/travis-ci-test-and-deploy.yml

@@ -55,7 +55,7 @@ jobs:
     - stage: deploy
       name: Build and deploy Linux wheels
       services: docker
-      install: python3 -m pip install cibuildwheel==1.6.1
+      install: python3 -m pip install cibuildwheel==1.6.4
       script: python3 -m cibuildwheel --output-dir wheelhouse
       after_success: |
         python3 -m pip install twine
@@ -64,8 +64,10 @@ jobs:
     - stage: deploy
       name: Build and deploy macOS wheels
       os: osx
+      # PyPy 7.3.2 needs macOS >= 10.14
+      osx_image: xcode10.2
       language: shell
-      install: python3 -m pip install cibuildwheel==1.6.1
+      install: python3 -m pip install cibuildwheel==1.6.4
       script: python3 -m cibuildwheel --output-dir wheelhouse
       after_success: |
         python3 -m pip install twine
@@ -75,7 +77,7 @@ jobs:
       name: Build and deploy Windows wheels
       os: windows
       language: shell
-      install: python3 -m pip install cibuildwheel==1.6.1
+      install: python3 -m pip install cibuildwheel==1.6.4
       script: python3 -m cibuildwheel --output-dir wheelhouse
       after_success: |
         python3 -m pip install twine

setup.py

@@ -11,8 +11,8 @@ long_description = (this_directory / 'README.md').read_text(encoding='utf-8')
 
 setup(
     name='cibuildwheel',
-    version='1.6.1',
-    install_requires=['bashlex!=0.13', 'toml'],
+    version='1.6.4',
+    install_requires=['bashlex!=0.13', 'toml', 'certifi'],
     description="Build Python wheels on CI with minimal configuration.",
     long_description=long_description,
     long_description_content_type='text/markdown',

test/test_dependency_versions.py

@@ -66,6 +66,9 @@ def test_pinned_versions(tmp_path, python_version):
     elif python_version == '3.6':
         constraint_filename = 'constraints-python36.txt'
         build_pattern = '[cp]p36-*'
+    elif python_version == '3.7':
+        constraint_filename = 'constraints-python37.txt'
+        build_pattern = '[cp]p37-*'
     else:
         constraint_filename = 'constraints.txt'
         build_pattern = '[cp]p38-*'

test/test_ssl.py

@@ -13,11 +13,10 @@ project_with_ssl_tests = test_projects.new_c_project(
         else:
             from urllib.request import urlopen
 
-        if sys.version_info[0:2] == (3, 3):
-            data = urlopen("https://www.nist.gov")
-        else:
-            context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
-            data = urlopen("https://www.nist.gov", context=context)
+        context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
+        data = urlopen("https://www.nist.gov", context=context)
+        data = urlopen("https://raw.githubusercontent.com/joerick/cibuildwheel/master/CI.md", context=context)
+        data = urlopen("https://raw.githubusercontent.com/joerick/cibuildwheel/master/CI.md")
     ''')
 )
 

test/utils.py

@@ -94,7 +94,7 @@ def expected_wheels(package_name, package_version, manylinux_versions=None,
     python_abi_tags = ['cp35-cp35m', 'cp36-cp36m', 'cp37-cp37m', 'cp38-cp38', 'cp39-cp39']
 
     if pm.machine() in ['x86_64', 'AMD64', 'x86']:
-        python_abi_tags += ['cp27-cp27m', 'pp27-pypy_73', 'pp36-pypy36_pp73']
+        python_abi_tags += ['cp27-cp27m', 'pp27-pypy_73', 'pp36-pypy36_pp73', 'pp37-pypy37_pp73']
 
         if platform == 'linux':
             python_abi_tags.append('cp27-cp27mu')  # python 2.7 has 2 different ABI on manylinux

unit_test/download_test.py

@@ -0,0 +1,31 @@
+import certifi
+import pytest
+import ssl
+
+from cibuildwheel.util import download
+
+
+DOWNLOAD_URL = 'https://raw.githubusercontent.com/joerick/cibuildwheel/v1.6.3/requirements-dev.txt'
+
+
+def test_download(monkeypatch, tmp_path):
+    monkeypatch.delenv('SSL_CERT_FILE', raising=False)
+    dest = tmp_path / 'file.txt'
+    download(DOWNLOAD_URL, dest)
+    assert len(dest.read_bytes()) == 134
+
+
+def test_download_good_ssl_cert_file(monkeypatch, tmp_path):
+    monkeypatch.setenv('SSL_CERT_FILE', certifi.where())
+    dest = tmp_path / 'file.txt'
+    download(DOWNLOAD_URL, dest)
+    assert len(dest.read_bytes()) == 134
+
+
+def test_download_bad_ssl_cert_file(monkeypatch, tmp_path):
+    bad_cafile = tmp_path / 'ca.pem'
+    bad_cafile.write_text('bad certificates')
+    monkeypatch.setenv('SSL_CERT_FILE', str(bad_cafile))
+    dest = tmp_path / 'file.txt'
+    with pytest.raises(ssl.SSLError):
+        download(DOWNLOAD_URL, dest)