manylinux2014

Author: mayeut

.travis.yml

@@ -22,23 +22,9 @@ env:
 
 jobs:
   include:
-    - stage: "Patch glibc"
-      env:
-        - PLATFORM="x86_64"
-      before_install:
-        # Load cached docker images
-        - if [[ -d $HOME/docker ]]; then ls $HOME/docker/*.tar.gz | xargs -I {file} sh -c "zcat {file} | docker load"; fi
-      script:
-        - PLATFORM=$PLATFORM TRAVIS_COMMIT=$TRAVIS_COMMIT ./build.sh glibc_only
-      before_cache:
-        # Save tagged docker images
-        - mkdir -p $HOME/docker && docker images -a --filter='dangling=false' --format '{{.Repository}}:{{.Tag}} {{.ID}}' | grep 'centos-with-vsyscall:latest' | xargs -n 2 -t sh -c 'test -e $HOME/docker/$1.tar.gz || docker save $0 | gzip -2 > $HOME/docker/$1.tar.gz'
     - stage: "Build manylinux images"
       env:
         - PLATFORM="x86_64"
-      before_install:
-        # Load cached docker images
-        - if [[ -d $HOME/docker ]]; then ls $HOME/docker/*.tar.gz | xargs -I {file} sh -c "zcat {file} | docker load"; fi
       script:
         - PLATFORM=$PLATFORM TRAVIS_COMMIT=$TRAVIS_COMMIT ./build.sh
       deploy:

build.sh

@@ -4,16 +4,4 @@
 set -ex
 
 
-if [ $PLATFORM == x86_64 ] || [ "$1" == "glibc_only" ]; then
-    # Output something every 10 minutes or Travis kills the job
-    while sleep 9m; do echo -n -e " \b"; done &
-    docker build --rm -t centos-with-vsyscall:latest --cache-from centos-with-vsyscall:latest --target centos-with-vsyscall -f docker/glibc/Dockerfile docker/glibc/
-    # Killing background sleep loop
-    kill %1
-    if [ "$1" == "glibc_only" ]; then
-        exit 0
-    fi
-    docker build --rm -t quay.io/pypa/manylinux2010_centos-6-no-vsyscall --cache-from quay.io/pypa/manylinux2010_centos-6-no-vsyscall:latest --cache-from centos-with-vsyscall:latest -f docker/glibc/Dockerfile docker/glibc/
-fi
-
-docker build --rm -t quay.io/pypa/manylinux2010_$PLATFORM:$TRAVIS_COMMIT -f docker/Dockerfile-$PLATFORM docker/
+docker build --rm -t quay.io/pypa/manylinux2014_$PLATFORM:$TRAVIS_COMMIT -f docker/Dockerfile-$PLATFORM docker/

docker/Dockerfile-x86_64

@@ -1,8 +1,7 @@
-# See docker/glibc/
-FROM quay.io/pypa/manylinux2010_centos-6-no-vsyscall
+FROM centos:7
 LABEL maintainer="The ManyLinux project"
 
-ENV AUDITWHEEL_PLAT manylinux2010_x86_64
+ENV AUDITWHEEL_PLAT manylinux2014_x86_64
 ENV LC_ALL en_US.UTF-8
 ENV LANG en_US.UTF-8
 ENV LANGUAGE en_US.UTF-8

docker/build_scripts/build.sh

@@ -10,14 +10,14 @@ MY_DIR=$(dirname "${BASH_SOURCE[0]}")
 
 # Dependencies for compiling Python that we want to remove from
 # the final image after compiling Python
-PYTHON_COMPILE_DEPS="zlib-devel bzip2-devel expat-devel ncurses-devel readline-devel tk-devel gdbm-devel db4-devel libpcap-devel xz-devel"
+PYTHON_COMPILE_DEPS="zlib-devel bzip2-devel expat-devel ncurses-devel readline-devel tk-devel gdbm-devel db4-devel libpcap-devel xz-devel openssl-devel keyutils-libs-devel krb5-devel libcom_err-devel libidn-devel curl-devel perl-devel"
 
-# Libraries that are allowed as part of the manylinux2010 profile
-# Extract from PEP: https://www.python.org/dev/peps/pep-0571/#the-manylinux2010-policy
+# Libraries that are allowed as part of the manylinux2014 profile
+# Extract from PEP: https://www.python.org/dev/peps/pep-0599/#the-manylinux2014-policy
 # On RPM-based systems, they are provided by these packages:
 # Package:    Libraries
 # glib2:      libglib-2.0.so.0, libgthread-2.0.so.0, libgobject-2.0.so.0
-# glibc:      libresolv.so.2, libutil.so.1, libnsl.so.1, librt.so.1, libcrypt.so.1, libpthread.so.0, libdl.so.2, libm.so.6, libc.so.6
+# glibc:      libresolv.so.2, libutil.so.1, libnsl.so.1, librt.so.1, libpthread.so.0, libdl.so.2, libm.so.6, libc.so.6
 # libICE:     libICE.so.6
 # libX11:     libX11.so.6
 # libXext:    libXext.so.6
@@ -46,15 +46,14 @@ echo "multilib_policy=best" >> /etc/yum.conf
 # Decided not to clean at this point: https://github.com/pypa/manylinux/pull/129
 yum -y update
 
-# Software collection (for devtoolset-8) and EPEL support (for cmake28 & yasm)
-yum -y install centos-release-scl https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
+# Software collection (for devtoolset-8) and EPEL support (for yasm)
+yum -y install centos-release-scl https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
 
 # Development tools and libraries
 yum -y install \
     automake \
     bison \
     bzip2 \
-    cmake28 \
     devtoolset-8-binutils \
     devtoolset-8-gcc \
     devtoolset-8-gcc-c++ \
@@ -71,14 +70,9 @@ yum -y install \
     yasm \
     ${PYTHON_COMPILE_DEPS}
 
-# Install a git we link against system OpenSSL/Curl
-yum -y install openssl-devel keyutils-libs-devel krb5-devel libcom_err-devel libidn-devel curl-devel perl-devel
+# Install git
 build_git $GIT_ROOT $GIT_HASH
 git version
-yum -y erase openssl-devel keyutils-libs-devel krb5-devel libcom_err-devel libidn-devel curl-devel perl-devel
-
-# Build an OpenSSL for Pythons. We'll delete this at the end.
-build_openssl $OPENSSL_ROOT $OPENSSL_HASH
 
 # Install newest autoconf
 build_autoconf $AUTOCONF_ROOT $AUTOCONF_HASH
@@ -127,8 +121,6 @@ ln -s $($PY36_BIN/python -c 'import certifi; print(certifi.where())') \
 # Dockerfiles:
 export SSL_CERT_FILE=/opt/_internal/certs.pem
 
-# Now we can delete our built OpenSSL headers/static libs since we've linked everything we need
-rm -rf /usr/local/ssl
 
 # Install patchelf (latest with unreleased bug fixes)
 curl -fsSL -o patchelf.tar.gz https://github.com/NixOS/patchelf/archive/$PATCHELF_VERSION.tar.gz

docker/build_scripts/build_env.sh

@@ -1,13 +1,7 @@
 # source me
 
 PYTHON_DOWNLOAD_URL=https://www.python.org/ftp/python
-CPYTHON_VERSIONS="2.7.16 3.4.10 3.5.7 3.6.9 3.7.4"
-
-# openssl version to build, with expected sha256 hash of .tar.gz
-# archive.
-OPENSSL_ROOT=openssl-1.0.2t
-OPENSSL_HASH=14cb464efe7ac6b54799b34456bd69558a749a4931ecfd9cf9f71d7881cac7bc
-OPENSSL_DOWNLOAD_URL=https://www.openssl.org/source
+CPYTHON_VERSIONS="3.5.7 3.6.9 3.7.4"
 
 PATCHELF_VERSION=0.10
 PATCHELF_HASH=b3cb6bdedcef5607ce34a350cf0b182eb979f8f7bc31eae55a93a70a3f020d13
@@ -24,16 +18,16 @@ LIBTOOL_ROOT=libtool-2.4.6
 LIBTOOL_HASH=e3bd4d5d3d025a36c21dd6af7ea818a2afcd4dfc1ea5a17b39d7854bcd0c06e3
 LIBTOOL_DOWNLOAD_URL=http://ftp.gnu.org/gnu/libtool
 
-SQLITE_AUTOCONF_VERSION=sqlite-autoconf-3270200
-SQLITE_AUTOCONF_HASH=50c39e85ea28b5ecfdb3f9e860afe9ba606381e21836b2849efca6a0bfe6ef6e
+SQLITE_AUTOCONF_VERSION=sqlite-autoconf-3290000
+SQLITE_AUTOCONF_HASH=8e7c1e2950b5b04c5944a981cb31fffbf9d2ddda939d536838ebc854481afd5b
 SQLITE_AUTOCONF_DOWNLOAD_URL=https://www.sqlite.org/2019
 
-LIBXCRYPT_VERSION=4.4.6
+LIBXCRYPT_VERSION=4.4.10
 LIBXCRYPT_DOWNLOAD_URL=https://codeload.github.com/besser82/libxcrypt/tar.gz
-LIBXCRYPT_HASH=4c33b80d3e1363c218ec6132bae0ea9eae181af9f9892939e90ec44b246ebe23
+LIBXCRYPT_HASH=7da15438d93883be434b0b44a8c22f726b5f605c6d88a315e17d4f4e929c20a8
 
-GIT_ROOT=2.21.0
-GIT_HASH=7a601275abcc6ff51cc79a6d402e83c90ae37d743b0b8d073aa009dd4b22d432
+GIT_ROOT=2.23.0
+GIT_HASH=7d84f5d6f48e95b467a04a8aa1d474e0d21abc7877998af945568d2634fea46a
 GIT_DOWNLOAD_URL=https://github.com/git/git/archive
 
 GET_PIP_URL=https://bootstrap.pypa.io/get-pip.py

docker/build_scripts/build_utils.sh

@@ -31,27 +31,18 @@ function pyver_dist_dir {
 function do_cpython_build {
     local py_ver=$1
     check_var $py_ver
-    local ucs_setting=$2
-    check_var $ucs_setting
     tar -xzf Python-$py_ver.tgz
     pushd Python-$py_ver
-    if [ "$ucs_setting" = "none" ]; then
-        unicode_flags=""
-        dir_suffix=""
-    else
-        local unicode_flags="--enable-unicode=$ucs_setting"
-        local dir_suffix="-$ucs_setting"
-    fi
-    local prefix="/opt/_internal/cpython-${py_ver}${dir_suffix}"
+    local prefix="/opt/_internal/cpython-${py_ver}"
     mkdir -p ${prefix}/lib
-    ./configure --prefix=${prefix} --disable-shared $unicode_flags > /dev/null
+    ./configure --prefix=${prefix} --disable-shared > /dev/null
     make -j2 > /dev/null
     make install > /dev/null
     popd
     rm -rf Python-$py_ver
     # Some python's install as bin/python3. Make them available as
     # bin/python.
-    if [ -e ${prefix}/bin/python3 ]; then
+    if [ -e ${prefix}/bin/python3 ] && [ ! -e ${prefix}/bin/python ]; then
         ln -s python3 ${prefix}/bin/python
     fi
     ${prefix}/bin/python get-pip.py
@@ -74,12 +65,7 @@ function build_cpython {
     curl -fsSLO $PYTHON_DOWNLOAD_URL/$py_dist_dir/Python-$py_ver.tgz
     curl -fsSLO $PYTHON_DOWNLOAD_URL/$py_dist_dir/Python-$py_ver.tgz.asc
     gpg --verify Python-$py_ver.tgz.asc
-    if [ $(lex_pyver $py_ver) -lt $(lex_pyver 3.3) ]; then
-        do_cpython_build $py_ver ucs2
-        do_cpython_build $py_ver ucs4
-    else
-        do_cpython_build $py_ver none
-    fi
+    do_cpython_build $py_ver
     rm -f Python-$py_ver.tgz
     rm -f Python-$py_ver.tgz.asc
 }
@@ -100,13 +86,6 @@ function build_cpythons {
 }
 
 
-function do_openssl_build {
-    ./config no-ssl2 no-shared -fPIC --prefix=/usr/local/ssl > /dev/null
-    make > /dev/null
-    make install_sw > /dev/null
-}
-
-
 function fetch_source {
     # This is called both inside and outside the build context (e.g. in Travis) to prefetch
     # source tarballs, where curl exists (and works)
@@ -134,19 +113,6 @@ function check_sha256sum {
 }
 
 
-function build_openssl {
-    local openssl_fname=$1
-    check_var ${openssl_fname}
-    local openssl_sha256=$2
-    check_var ${openssl_sha256}
-    fetch_source ${openssl_fname}.tar.gz ${OPENSSL_DOWNLOAD_URL}
-    check_sha256sum ${openssl_fname}.tar.gz ${openssl_sha256}
-    tar -xzf ${openssl_fname}.tar.gz
-    (cd ${openssl_fname} && do_openssl_build)
-    rm -rf ${openssl_fname} ${openssl_fname}.tar.gz
-}
-
-
 function build_git {
     local git_fname=$1
     check_var ${git_fname}