Sync upstream tag 20260825 - #22
Draft
Schamper wants to merge 71 commits into
Draft
Conversation
As reported in astral-sh#956, executable stacks cause thread creation to fail under MemoryDenyWriteExecute=true. In kernel 6.3+ (which the GitHub Actions runners should have) this is implemented using prctl(PR_SET_MDWE). In older versions systemd uses a more complicated seccomp filter.
…h#1075) Currently, pull requests run all targets by default and labels can be used to select a subset of the matrix. However, CI is quite expensive and it's very rare to need to test the whole matrix, so the default is a bit backwards. In this change, we update pull requests to run on a subset of targets by default: Python 3.14 on macOS, Linux, and Windows with the most popular architecture. We include both glibc and musl variants of Linux. We include armv7 as an arbitrary cross-compile case — I'd be happy to take suggestions on an alternative there. This breaks our labeling concept a bit, as our labels currently do pure subsetting of the matrix. The labels will continue to subset, but with some nuances: - Applying a label will generally subset the default selection, e.g., `platform:linux` will only run the Linux subset of the defaults described above. - Labels that would null the default subset, e.g., `python:3.12` or `build:debug`, will instead change the default set to target that variant. - There are new `platform:all`, `python:all`, `arch:all`, `libc:all`, and `build:all` labels that can be used to expand the targets.
Statically link `python` to `libpython` on macOS. A dynamic `libpython` is still built and included in the distribution for embedded use. Remove patches that disable linking the libraries in statically linked Python stdlib modules to python as these are now needed. closes astral-sh#636
…sh#1104) Remove the Tcl/Tk translation files (.msg) and the Tk demos from the distribution artifacts. The former would only be needed in edge cases and the later is never be needed. closes astral-sh#1095
This patch addresses a segmentation fault issue on `LoongArch64` platforms caused by incorrect ELF segment alignment during the build process. - fix: astral-sh#1106 Signed-off-by: 吴小白 <296015668@qq.com>
* Update CPython 3.15 to 3.15.0b1
* Update CPython 3.14.5rc1 -> 3.14.5
Use the same LLVM toolchain that is used for native x86-64 builds to cross compile for riscv64 using a sysroot.
Following the behavior of CPython which dropped uplink support in 3.12, build OpenSSL with the `no-uplink` option starting with CPython 3.12. This allows a SSLContext to be created even when a SSLKEYLOGFILE environment variable is set on Windows. closes astral-sh#640
Include vm_sockets.h which is missing from the kernel UAPI headers in version 3.16 of the kernel. This file is missing due to a typo in the Kbuild file. The file is needed for CPython to make socket.AF_VSOCK available. closes astral-sh#1050
Signed-off-by: Mohammad Miadh Angkad <176301910+mmangkad@users.noreply.github.com>
3.15.0b1 -> 3.15.0b2. Remove patch introduced in astral-sh#1123 as a different fix was merged upstream in python/cpython#149799 This makes astral-sh#1130 unnecessary
* CPython 3.13.13 -> 3.13.14 * CPython 3.14.5 -> 3.14.6
…3.11 (astral-sh#1147) This fixes the inability to load DER correctly with OpenSSL 3.5.7.
A maximum python version was not added when this file was added in astral-sh#1146. This will likely need to be removed or reverted when the next beta of 3.15 is released.
…-sh#1116)" (astral-sh#1150) This reverts commit 96a589a. Having a split LLVM / older GNU ld toolchain causes issues with relocation symbols and truncations.
…1152) Safely remove PYTHON* environment variables when running the distibution tests. Since the env dictionary is mutated within the loop a copy must be made.
libedit is used for command-line editing, readline is not used.
* zlib 1.3.1 -> 1.3.2
Disable the vectorized crc32 algorithm on s390x which requires z13. The current s390x target is z10.
This xz release includes a fix for CVE-2026-34743
* libX11 1.6.12 -> 1.8.13 * libXau 1.0.11 -> 1.0.12 * xorgproto 2024.1 -> 2025.1
Use the pattern from astral-sh#1164 to make `os.copy_file_range` available at runtime when the host glibc version provides the function.
Optimized x86-64 GNU/Linux builds can perform invalid stack writes in the HACL SHA-2 and BLAKE2 compressors because BOLT's allocation combiner removes their required stack allocation while retaining frame-pointer-relative accesses below the red zone. Extend `-skip-funcs` for the affected compressor symbols so BOLT leaves these functions intact while continuing to optimize the rest of the interpreter. See astral-sh#1186
Update to astral-sh#1056 to use `docker buildx` for reliable handeling of the `platform` argument. --------- Co-authored-by: Gregory Szorc <gregory.szorc@gmail.com>
Signed-off-by: Mohammad Miadh Angkad <176301910+mmangkad@users.noreply.github.com>
* CPython 3.15.0b4 -> 3.15.0rc1
Update to the CPython provided Tcl/Tk 9.0.4 for 3.15+ on Windows.
Update: * Tcl 9.0.3 -> 9.0.4 * Tk 9.0.3 -> 9.0.4 Update build scripts to account for the bundled versions of itcl and thread. Include a fix for the Thread package's zipfs logic.
Switch macOS `pythonbuild` crate and CPython distribution builds from Depot to the existing `namespace-profile-macos-15` runner profile through `ci-runners.yaml`. Preserve the existing shared matrix and runner configuration for other platforms.
Use a sparse checkout of only the files needed during validations to speed up the checkout of the macOS SDKs repository. A full check out typically takes between 2-3 minutes although occasionally the checkout can take much longer.
* CPython 3.14.6 -> 3.14.7 On Windows, CPython 3.14 is built against Tcl/Tk 9.0.4.
* CPython 3.13.14 -> 3.13.15 Include backports from 3.15 in the `_testlimitedcapi` module.
Comes with one bug fix for using keyring from a non-activated virtual environment when installing build dependencies Signed-off-by: Mohammad Miadh Angkad <176301910+mmangkad@users.noreply.github.com>
Select the musl-static toolchain and tarball for static builds. Prior to this change `musl-static-<ver>-<target>.tar` was not declared as a dependency despite being a possible output of `build-musl.sh`.
Enable static builds for the `aarch64-unknown-linux-musl` target. --------- Co-authored-by: Tomasz Kramkowski <tomasz@kramkow.ski>
…1216) glibc only grew the copy_file_range() and memfd_create() wrappers in 2.27, and CPython compiles os.copy_file_range() and os.memfd_create() out when the libc it is built against lacks them. We worked around that by forcing the configure checks on and weak linking the wrappers, which kept the functions out of the os module whenever the runtime glibc was older than 2.27, even on kernels implementing the syscalls. Backport python/cpython#155520 instead, which calls the wrappers when they exist and issues the raw syscalls when they don't, so both functions work on any sufficiently new kernel regardless of the glibc in use. The UAPI header overlay already provides the __NR_ constants and the MFD_ flags for all glibc targets. A single patch covers 3.10 through 3.15, so the weak linking patches and the 3.10 specific configure patch go away. The distribution tests now assert that both functions are always present on Linux GNU targets instead of tying their availability to the runtime libc. Signed-off-by: Daan De Meyer <daan@amutable.com>
when packaging a `uv python` installed python into a .msix app for the microsoft app store, i hit some `signtool` failures with error `0x800700C1`. these are caused by `AppxSIP` going thru every binary in your package and validating them in some way. `llvm-strip` removes the signature from a bunch of DLLs that come with these python buidls, but it keeps the certificate table entry in the PE optional header , which makes the entry point past the end of the file. this is *exactly* the bug from astral-sh#855 that astral-sh#856 solved. i'm extending it to more DLLs and adding a comment explaining it. a more permanent fix might be detecting signatures on files and skipping if we see them? let me know if you'd rather that, i could wireup detecting signatures and/or zipfs to get rid of the hardcoded list that'll probably regress as versions change what DLLs are shipped.
* expat 2.8.2 -> 2.8.3
* CPython 3.10.20 -> 3.10.21 * CPython 3.11.15 -> 3.11.16 * CPython 3.12.13 -> 3.12.14 Remove DER parsing patch that was merged upstream in these releases.
Require wheels when installing the Python dependencies used by the build tooling, with a named exception for the local `python-build-standalone` package. This avoids implicit third-party source builds without changing the interpreter builds performed by the project. Pin the isolated build dependencies for the source-build exceptions, including their transitive build requirements. --------- Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
## Summary Use `gh pr merge --squash --admin` when merging the versions bot's release-manifest PR. The `versions` ruleset requires human review but grants `astral-versions-bot` a pull-request-only bypass. Plain `gh pr merge` stops at its blocked-PR preflight check instead of attempting the merge with that permission. This completes the workflow-side change for astral-sh/github-policies#31 and astral-sh/github-policies#34. The failure was observed in astral-sh/versions#163 ([release job](https://github.com/astral-sh/ty/actions/runs/32198672332/job/95944618373)).
Switch CPython 3.12+ builds to the upstream Setup.stdlib extension-building mechanism while preserving the existing static/shared linkage behavior. * Build pkgconf on macOS so that bundled dependencies can be discovered and configured. * Generate a minimal Setup.local for shared and disabled overrides on CPython 3.12+. * Restore CPython’s post-build extension checks and remove obsolete patches/workarounds. * Preserve SQLite extension loading and macOS symbol hiding. * Explicitly disable the clinic test and `xxlimited_3_13` extensions. c.f. astral-sh#1185 With this change, `extension-modules.yml` is still used for the following in CPython 3.12: * Disabling modules * Specifying static vs shared linkage * Validating the extension modules specified in the CPython source archive. * Constructing `PYTHON.json` Constructing `PYTHON.json` for CPython 3.12+ from other sources is a needed follow up. Makes various patches unnecessary: * closes astral-sh#869 * closes astral-sh#875 (This patch is only applied on Python 3.11) * closes astral-sh#876 (this patch is only applied on Python 3.11) Configuration can now appropriately detect SIMD support in the toolchain and adjusts `libhacl` flags accordingly. * closes astral-sh#883 * closes astral-sh#645 This does not add shared extension suggested in astral-sh#227. This could be done with a small change as a follow up.
The `_testclinic` module introduced in 3.12.0 was backported to 3.10 (python/cpython@3144aca) and 3.11 (python/cpython@dd323af). Disable the module on all Python versions as it is only needed for testing. closes astral-sh#1222
* libffi 3.4.6 -> 3.4.8 Remove the inline patches which have been merged upstream.
Use the same libffi version for musl builds by patching libffi so that PATH_MAX is provided by the libc limits.h rather than the Linux kernel linux/limits.h. Remove the unused libffi-3.3 package. closes astral-sh#814
Add a document (`BENCHMARKS.md`) which discusses the performance on python-build-standalone in pyperformance benchmarks compared to other CPython distributions. --------- Co-authored-by: Brent Westbrook <36778786+ntBre@users.noreply.github.com>
Linux distributions built here carry no `.note.gnu.build-id`. That makes them invisible to debuginfod: the protocol is keyed entirely on that ID, so a debugger reading one of these binaries has nothing to ask with, and no symbol server — yours or anyone else's — ever receives a request. This adds `-Wl,--build-id=sha1` to `target_ldflags` for the Linux targets. Refs astral-sh#522. `sha1` rather than `uuid`: it is derived from the linked content, so it does not affect build reproducibility. ## What I measured `.note.gnu.build-id` in `install_only_stripped` artifacts: | release | target | build ID | |---|---|---| | 20250205 (3.12.9) | aarch64 | present — `54c37326ccd9e6e2e10a1c0857b5977aecfdc103` | | 20250612, 20250626, **20250630** | aarch64 | present | | **20250702**, 20250807, 20250828, 20251010 | aarch64 | absent | | 20260814 (3.13.15) | aarch64 | absent | | 20250630, 20250702 (3.12.11) | x86_64 | absent | | 20260814 (3.10.21 / 3.12.14 / 3.13.15) | x86_64 | absent | Two separate things, worth separating: - **x86_64 never had build IDs**, on either side of that window. - **aarch64 lost them between 20250630 and 20250702**, which lines up with 21cf744 ("Enable native builds on Linux aarch64"). Before it, aarch64 was cross-compiled with a host toolchain; afterwards it uses the in-tree one, as x86_64 always did. Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Merge conflicts detected when merging upstream tag 20260825 into main.
The conflict markers have been committed so they are visible in the PR diff.
Conflicting files
Resolution