Skip to content

Audit - general approach to auditing wheels with abi3audit default#2805

Open
joerick wants to merge 52 commits intomainfrom
audit2
Open

Audit - general approach to auditing wheels with abi3audit default#2805
joerick wants to merge 52 commits intomainfrom
audit2

Conversation

@joerick
Copy link
Copy Markdown
Contributor

@joerick joerick commented Apr 1, 2026

Following on from #2745. I've only sketched out the functionality in documentation form so far - implementation to come.

The idea is that audit commands can specify {abi3wheel} or {wheel} placeholders, which determine whether they're run for a particular wheel.

I think the best approach here would be to run the audit on each wheel as it's built, similar to @agriyakhetarpal's approach. As I've been thinking about it, it turns out there's nothing stopping that as far as I'm aware and it prevents the frustration of leaving the failure to the end of the build.

Todos

  • Specify the abi3audit default in the options system
  • Unit tests for audit-requires
  • Integration tests for the configurability
  • (optional) Allow inherit to work outside of overrides, making it easier for audit configs to extend the default

@joerick
Copy link
Copy Markdown
Contributor Author

joerick commented Apr 1, 2026

Any feedback on the documentation welcome!

@agriyakhetarpal
Copy link
Copy Markdown
Member

Thanks very much for writing this @joerick! I read the documentation you added and it all looks good to me on a high level. Would you like that I close my PR? I admit that I have been stretched thin for time to take a look at it again after the review comments, and was planning to get to it at some point in April – so if it is the case that you would like to take over, please let me know!

@joerick
Copy link
Copy Markdown
Contributor Author

joerick commented Apr 2, 2026

Thanks @agriyakhetarpal. Yes let's close out #2745 and continue work here. Happy for you to contribute too if you want as well! I've added a todo list to the PR description.

@agriyakhetarpal
Copy link
Copy Markdown
Member

Awesome, thank you! Please let me know when you are done with your changes, and I'd be happy to create some PRs against this branch – so as to save ourselves from the trouble of mutual merge conflicts :D

I had a fun time writing the tests out in #2745, so I'm happy to continue in that direction.

@mayeut
Copy link
Copy Markdown
Member

mayeut commented Apr 4, 2026

I really like the fact that running both twine check on all wheels but abi3audit only on abi3 wheels is already being thought of !

@agriyakhetarpal agriyakhetarpal self-assigned this Apr 6, 2026
@agriyakhetarpal
Copy link
Copy Markdown
Member

Alright – I think I have made all the changes I wanted to make here, but will self-review a little later once others have a chance to look at them. I'm all done, so I'll unassign myself now :D I've retriggered the CI for the Azure Windows timeout, and all other CI tests look green.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 31 out of 33 changed files in this pull request and generated 5 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread test/test_abi3audit.py
Comment thread test/test_abi3audit.py
Comment thread cibuildwheel/options.py Outdated
Comment thread cibuildwheel/audit.py
Comment thread docs/options.md Outdated
@agriyakhetarpal agriyakhetarpal marked this pull request as ready for review April 13, 2026 13:46
@agriyakhetarpal agriyakhetarpal removed their assignment Apr 13, 2026
Copy link
Copy Markdown
Member

@mhsmith mhsmith left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine as far as Android is concerned. I haven't used abi3audit myself, but if it works for Linux then in principle it should work for Android too.

Comment thread cibuildwheel/audit.py Outdated
joerick added 2 commits April 24, 2026 16:40
On win / python 3.13, virtualenv creates a venv where the 'home'
points back to the venv that sys.executable was running in, rather
than the root install. that seemingly leads to problems with package
resolution, where pip.exe couldn't find the pip python package.
this appears to fix it!
@agriyakhetarpal
Copy link
Copy Markdown
Member

Looks like the CI passed! I guess this is a Windows + CPython bug, in that case? Should we raise it elsewhere?

@joerick
Copy link
Copy Markdown
Contributor Author

joerick commented Apr 25, 2026

It might be worth raising with virtualenv, because uv didn't have the bug. But before I do that I'd wanna check it's not a bug with how we activate venvs. The workaround works for now anyway :)

@joerick
Copy link
Copy Markdown
Contributor Author

joerick commented Apr 25, 2026

This is ready for a wider review now I think. @woodruffw might also be interested!

@agriyakhetarpal
Copy link
Copy Markdown
Member

@ngoldbaum you might be interested in this for NumPy too :)

@ngoldbaum
Copy link
Copy Markdown
Contributor

@agriyakhetarpal numpy doesn't publish abi3 wheels - how would this impact NumPy's release automation?

@agriyakhetarpal
Copy link
Copy Markdown
Member

@agriyakhetarpal numpy doesn't publish abi3 wheels - how would this impact NumPy's release automation?

@ngoldbaum, ah, sorry, not NumPy – PyTables, rather. You asked about it in the PyPA Discord but I incorrectly assumed that was NumPy. I just realised when I went to check there again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Consider running abi3audit on abi3 wheels

8 participants