feat: Add manylinux_2_34 image

.github/workflows/build.yml

@@ -36,12 +36,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        policy: ["manylinux2014", "musllinux_1_2"]
-        platform: ["i686", "x86_64"]
+        policy: ["manylinux2014", "manylinux_2_28", "manylinux_2_34", "musllinux_1_2"]
+        platform: ["x86_64"]
         include:
-          - policy: "manylinux_2_28"
-            platform: "x86_64"
-
+          - policy: "manylinux2014"
+            platform: "i686"
+          - policy: "musllinux_1_2"
+            platform: "i686"
     env:
       POLICY: ${{ matrix.policy }}
       PLATFORM: ${{ matrix.platform }}

.travis.yml

@@ -45,6 +45,14 @@ jobs:
       env: POLICY="manylinux_2_28" PLATFORM="s390x"
     - arch: ppc64le
       env: POLICY="manylinux_2_28" PLATFORM="ppc64le"
+    - arch: arm64-graviton2
+      virt: vm
+      group: edge
+      env: POLICY="manylinux_2_34" PLATFORM="aarch64"
+    - arch: s390x
+      env: POLICY="manylinux_2_34" PLATFORM="s390x"
+    - arch: ppc64le
+      env: POLICY="manylinux_2_34" PLATFORM="ppc64le"
     - arch: arm64-graviton2
       virt: vm
       group: edge

README.rst

@@ -37,6 +37,8 @@ The manylinux project supports:
 
 - ``manylinux_2_28`` images for ``x86_64``, ``aarch64``, ``ppc64le`` and ``s390x``.
 
+- ``manylinux_2_34`` images for ``x86_64``, ``aarch64``, ``ppc64le`` and ``s390x``.
+
 - ``musllinux_1_2`` images for ``x86_64``, ``i686``, ``aarch64``, ``ppc64le``, ``s390x`` and ``armv7l``.
 
 
@@ -92,6 +94,24 @@ etc., we provide `Docker <https://docker.com/>`_ images where we've
 done the work for you. The images are uploaded to `quay.io`_ and are tagged
 for repeatable builds.
 
+manylinux_2_34 (AlmaLinux 9 based)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Toolchain: GCC 13
+
+- x86_64 image: ``quay.io/pypa/manylinux_2_34_x86_64``
+- aarch64 image: ``quay.io/pypa/manylinux_2_34_aarch64``
+- ppc64le image: ``quay.io/pypa/manylinux_2_34_ppc64le``
+- s390x image: ``quay.io/pypa/manylinux_2_34_s390x``
+
+Built wheels are also expected to be compatible with other
+distros using glibc 2.34 or later, including:
+
+- Debian 12+
+- Ubuntu 21.10+
+- Fedora 35+
+- CentOS/RHEL 9+
+
 
 manylinux_2_28 (AlmaLinux 8 based)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

build.sh

@@ -14,22 +14,16 @@ export PLATFORM
 # get docker default multiarch image prefix for PLATFORM
 if [ "${PLATFORM}" == "x86_64" ]; then
 	GOARCH="amd64"
-	MULTIARCH_PREFIX="amd64/"
 elif [ "${PLATFORM}" == "i686" ]; then
 	GOARCH="386"
-	MULTIARCH_PREFIX="i386/"
 elif [ "${PLATFORM}" == "aarch64" ]; then
 	GOARCH="arm64"
-	MULTIARCH_PREFIX="arm64v8/"
 elif [ "${PLATFORM}" == "ppc64le" ]; then
 	GOARCH="ppc64le"
-	MULTIARCH_PREFIX="ppc64le/"
 elif [ "${PLATFORM}" == "s390x" ]; then
 	GOARCH="s390x"
-	MULTIARCH_PREFIX="s390x/"
 elif [ "${PLATFORM}" == "armv7l" ]; then
 	GOARCH="arm/v7"
-	MULTIARCH_PREFIX="arm32v7/"
 else
 	echo "Unsupported platform: '${PLATFORM}'"
 	exit 1
@@ -38,9 +32,9 @@ fi
 # setup BASEIMAGE and its specific properties
 if [ "${POLICY}" == "manylinux2014" ]; then
 	if [ "${PLATFORM}" == "s390x" ]; then
-		BASEIMAGE="s390x/clefos:7"
+		BASEIMAGE="clefos:7"
 	else
-		BASEIMAGE="${MULTIARCH_PREFIX}centos:7"
+		BASEIMAGE="centos:7"
 	fi
 	DEVTOOLSET_ROOTPATH="/opt/rh/devtoolset-10/root"
 	PREPEND_PATH="${DEVTOOLSET_ROOTPATH}/usr/bin:"
@@ -50,12 +44,17 @@ if [ "${POLICY}" == "manylinux2014" ]; then
 		LD_LIBRARY_PATH_ARG="${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst:/usr/local/lib64"
 	fi
 elif [ "${POLICY}" == "manylinux_2_28" ]; then
-	BASEIMAGE="${MULTIARCH_PREFIX}almalinux:8"
+	BASEIMAGE="almalinux:8"
 	DEVTOOLSET_ROOTPATH="/opt/rh/gcc-toolset-12/root"
 	PREPEND_PATH="${DEVTOOLSET_ROOTPATH}/usr/bin:"
 	LD_LIBRARY_PATH_ARG="${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst"
+elif [ "${POLICY}" == "manylinux_2_34" ]; then
+	BASEIMAGE="almalinux:9"
+	DEVTOOLSET_ROOTPATH="/opt/rh/gcc-toolset-13/root"
+	PREPEND_PATH="${DEVTOOLSET_ROOTPATH}/usr/bin:"
+	LD_LIBRARY_PATH_ARG="${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst"
 elif [ "${POLICY}" == "musllinux_1_2" ]; then
-	BASEIMAGE="${MULTIARCH_PREFIX}alpine:3.20"
+	BASEIMAGE="alpine:3.20"
 	DEVTOOLSET_ROOTPATH=
 	PREPEND_PATH=
 	LD_LIBRARY_PATH_ARG=

docker/Dockerfile

@@ -1,8 +1,8 @@
 # default to latest supported policy, x86_64
-ARG BASEIMAGE=amd64/almalinux:8
-ARG POLICY=manylinux_2_28
+ARG BASEIMAGE=amd64/almalinux:9
+ARG POLICY=manylinux_2_34
 ARG PLATFORM=x86_64
-ARG DEVTOOLSET_ROOTPATH=/opt/rh/gcc-toolset-12/root
+ARG DEVTOOLSET_ROOTPATH=/opt/rh/gcc-toolset-13/root
 ARG LD_LIBRARY_PATH_ARG=${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst
 ARG PREPEND_PATH=${DEVTOOLSET_ROOTPATH}/usr/bin:
 

docker/build_scripts/build-cpython.sh

@@ -54,6 +54,14 @@ if [ "${BASE_POLICY}_${AUDITWHEEL_ARCH}" == "musllinux_armv7l" ]; then
 	CONFIGURE_ARGS="${CONFIGURE_ARGS} --build=arm-linux-musleabihf"
 fi
 
+SQLITE_PREFIX=$(find /opt/_internal -maxdepth 1 -name 'sqlite*')
+if [ "${SQLITE_PREFIX}" != "" ]; then
+	case "${CPYTHON_VERSION}" in
+		3.6.*|3.7.*|3.8.*|3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,--enable-new-dtags,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
+		*) ;;
+	esac
+fi
+
 OPENSSL_PREFIX=$(find /opt/_internal -maxdepth 1 -name 'openssl*')
 if [ "${OPENSSL_PREFIX}" != "" ]; then
 	CONFIGURE_ARGS="${CONFIGURE_ARGS} --with-openssl=${OPENSSL_PREFIX}"
@@ -63,6 +71,8 @@ if [ "${OPENSSL_PREFIX}" != "" ]; then
 	esac
 fi
 
+unset _PYTHON_HOST_PLATFORM
+
 # configure with hardening options only for the interpreter & stdlib C extensions
 # do not change the default for user built extension (yet?)
 ./configure \

docker/build_scripts/build-openssl.sh

@@ -29,10 +29,10 @@ if [ "${SMALLEST}" = "${OPENSSL_MIN_VERSION}" ]; then
 	exit 0
 fi
 
-if which yum; then
-	yum erase -y openssl-devel
-else
-	apk del openssl-dev
+if [ "${OS_ID_LIKE}" = "rhel" ];then
+	manylinux_pkg_remove openssl-devel
+elif [ "${OS_ID_LIKE}" = "alpine" ]; then
+	manylinux_pkg_remove openssl-dev
 fi
 
 PREFIX=/opt/_internal/openssl-${OPENSSL_VERSION%.*}

docker/build_scripts/build-sqlite3.sh

@@ -10,6 +10,12 @@ MY_DIR=$(dirname "${BASH_SOURCE[0]}")
 # Get build utilities
 source $MY_DIR/build_utils.sh
 
+if [ "${AUDITWHEEL_POLICY}" == "manylinux2014" ] || [ "${AUDITWHEEL_POLICY}" == "manylinux_2_28" ] || [ "${AUDITWHEEL_POLICY}" == "musllinux_1_2" ]; then
+	PREFIX=/usr/local
+else
+	PREFIX=/opt/_internal/sqlite3
+fi
+
 # Install a more recent SQLite3
 check_var ${SQLITE_AUTOCONF_ROOT}
 check_var ${SQLITE_AUTOCONF_HASH}
@@ -18,23 +24,30 @@ fetch_source ${SQLITE_AUTOCONF_ROOT}.tar.gz ${SQLITE_AUTOCONF_DOWNLOAD_URL}
 check_sha256sum ${SQLITE_AUTOCONF_ROOT}.tar.gz ${SQLITE_AUTOCONF_HASH}
 tar xfz ${SQLITE_AUTOCONF_ROOT}.tar.gz
 pushd ${SQLITE_AUTOCONF_ROOT}
-DESTDIR=/manylinux-rootfs do_standard_install
+# add rpath
+sed -i "s|^Libs:|Libs: -Wl,--enable-new-dtags,-rpath=\${libdir} |g" sqlite3.pc.in
+DESTDIR=/manylinux-rootfs do_standard_install --prefix=${PREFIX}
 popd
 rm -rf ${SQLITE_AUTOCONF_ROOT} ${SQLITE_AUTOCONF_ROOT}.tar.gz
 
-# static library is unused, remove it
-rm /manylinux-rootfs/usr/local/lib/libsqlite3.a
+# Remove unused files
+rm /manylinux-rootfs${PREFIX}/lib/libsqlite3.a
+rm -rf /manylinux-rootfs${PREFIX}/share
 
 # Strip what we can
 strip_ /manylinux-rootfs
 
 # Install
 cp -rlf /manylinux-rootfs/* /
-if [ "${BASE_POLICY}" == "musllinux" ]; then
-	ldconfig /
-elif [ "${BASE_POLICY}" == "manylinux" ]; then
-	ldconfig
-fi
 
-# Clean-up for runtime
-rm -rf /manylinux-rootfs/usr/local/share
+if [ "${PREFIX}" == "/usr/local" ]; then
+	if [ "${BASE_POLICY}" == "musllinux" ]; then
+		ldconfig /
+	elif [ "${BASE_POLICY}" == "manylinux" ]; then
+		ldconfig
+	fi
+else
+	# python >= 3.11
+	mkdir -p /usr/local/lib/pkgconfig/
+	ln -s ${PREFIX}/lib/pkgconfig/sqlite3.pc /usr/local/lib/pkgconfig/sqlite3.pc
+fi

docker/build_scripts/build_utils.sh

@@ -10,50 +10,67 @@ MANYLINUX_CFLAGS="-g -O2 -Wall -fdebug-prefix-map=/=. -fstack-protector-strong -
 MANYLINUX_CXXFLAGS="-g -O2 -Wall -fdebug-prefix-map=/=. -fstack-protector-strong -Wformat -Werror=format-security"
 MANYLINUX_LDFLAGS="-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now"
 
-export BASE_POLICY=manylinux
 if [ "${AUDITWHEEL_POLICY:0:10}" == "musllinux_" ]; then
 	export BASE_POLICY=musllinux
+	PACKAGE_MANAGER=apk
+else
+	export BASE_POLICY=manylinux
+	if command -v dnf >/dev/null 2>&1; then
+		PACKAGE_MANAGER=dnf
+	elif command -v yum >/dev/null 2>&1; then
+		PACKAGE_MANAGER=yum
+	else
+		echo "unsupported image"
+		exit 1
+	fi
 fi
 
+OS_ID_LIKE=$(. /etc/os-release; echo "${ID} ${ID_LIKE:-}")
+case "${OS_ID_LIKE}" in
+	*rhel*) OS_ID_LIKE=rhel;;
+	*alpine*) OS_ID_LIKE=alpine;;
+	*) echo "unsupported image"; exit 1;;
+esac
+
 function check_var {
-    if [ -z "$1" ]; then
-        echo "required variable not defined"
-        exit 1
-    fi
+	if [ -z "$1" ]; then
+		echo "required variable not defined"
+		exit 1
+	fi
 }
 
 
 function fetch_source {
-    # This is called both inside and outside the build context (e.g. in Travis) to prefetch
-    # source tarballs, where curl exists (and works)
-    local file=$1
-    check_var ${file}
-    local url=$2
-    check_var ${url}
-    if [ -f ${file} ]; then
-        echo "${file} exists, skipping fetch"
-    else
-        curl -fsSL -o ${file} ${url}/${file}
-    fi
+	# This is called both inside and outside the build context (e.g. in Travis) to prefetch
+	# source tarballs, where curl exists (and works)
+	local file=$1
+	check_var ${file}
+	local url=$2
+	check_var ${url}
+	if [ -f ${file} ]; then
+		echo "${file} exists, skipping fetch"
+	else
+		curl -fsSL -o ${file} ${url}/${file}
+	fi
 }
 
 
 function check_sha256sum {
-    local fname=$1
-    check_var ${fname}
-    local sha256=$2
-    check_var ${sha256}
-
-    echo "${sha256}  ${fname}" > ${fname}.sha256
-    sha256sum -c ${fname}.sha256
-    rm -f ${fname}.sha256
+	local fname=$1
+	check_var ${fname}
+	local sha256=$2
+	check_var ${sha256}
+
+	echo "${sha256}  ${fname}" > ${fname}.sha256
+	sha256sum -c ${fname}.sha256
+	rm -f ${fname}.sha256
 }
 
 
 function do_standard_install {
-    ./configure "$@" CPPFLAGS="${MANYLINUX_CPPFLAGS}" CFLAGS="${MANYLINUX_CFLAGS}" "CXXFLAGS=${MANYLINUX_CXXFLAGS}" LDFLAGS="${MANYLINUX_LDFLAGS}" > /dev/null
-    make > /dev/null
-    make install > /dev/null
+	./configure "$@" CPPFLAGS="${MANYLINUX_CPPFLAGS}" CFLAGS="${MANYLINUX_CFLAGS}" "CXXFLAGS=${MANYLINUX_CXXFLAGS}" LDFLAGS="${MANYLINUX_LDFLAGS}" > /dev/null
+	make > /dev/null
+	make install > /dev/null
 }
 
 function strip_ {
@@ -65,3 +82,41 @@ function strip_ {
 function clean_pyc {
 	find $1 -type f -a \( -name '*.pyc' -o -name '*.pyo' \) -delete
 }
+
+function manylinux_pkg_install {
+	if [ "${PACKAGE_MANAGER}" = "yum" ]; then
+		yum -y install "$@"
+	elif [ "${PACKAGE_MANAGER}" = "dnf" ]; then
+		dnf -y install --allowerasing "$@"
+	elif [ "${PACKAGE_MANAGER}" = "apk" ]; then
+		apk add --no-cache "$@"
+	else
+		return 1
+	fi
+}
+
+function manylinux_pkg_remove {
+	if [ "${PACKAGE_MANAGER}" = "yum" ]; then
+		yum erase -y "$@"
+	elif [ "${PACKAGE_MANAGER}" = "dnf" ];then
+		dnf erase -y "$@"
+	elif [ "${PACKAGE_MANAGER}" = "apk" ]; then
+		apk del "$@"
+	else
+		return 1
+	fi
+}
+
+function manylinux_pkg_clean {
+	if [ "${PACKAGE_MANAGER}" = "yum" ]; then
+		yum clean all
+		rm -rf /var/cache/yum
+	elif [ "${PACKAGE_MANAGER}" = "dnf" ]; then
+		dnf clean all
+		rm -rf /var/cache/dnf
+	elif [ "${PACKAGE_MANAGER}" = "apk" ]; then
+		:
+	else
+		return 1
+	fi
+}