manylinux2014

.travis.yml

@@ -22,23 +22,9 @@ env:
 
 jobs:
  include:
- - stage: "Patch glibc"
- env:
- - PLATFORM="x86_64"
- before_install:
- # Load cached docker images
- - if [[ -d $HOME/docker ]]; then ls $HOME/docker/*.tar.gz | xargs -I {file} sh -c "zcat {file} | docker load"; fi
- script:
- - PLATFORM=$PLATFORM TRAVIS_COMMIT=$TRAVIS_COMMIT ./build.sh glibc_only
- before_cache:
- # Save tagged docker images
- - mkdir -p $HOME/docker && docker images -a --filter='dangling=false' --format '{{.Repository}}:{{.Tag}} {{.ID}}' | grep 'centos-with-vsyscall:latest' | xargs -n 2 -t sh -c 'test -e $HOME/docker/$1.tar.gz || docker save $0 | gzip -2 > $HOME/docker/$1.tar.gz'
  - stage: "Build manylinux images"
  env:
  - PLATFORM="x86_64"
- before_install:
- # Load cached docker images
- - if [[ -d $HOME/docker ]]; then ls $HOME/docker/*.tar.gz | xargs -I {file} sh -c "zcat {file} | docker load"; fi
  script:
  - PLATFORM=$PLATFORM TRAVIS_COMMIT=$TRAVIS_COMMIT ./build.sh
  deploy:

build.sh

@@ -4,16 +4,4 @@
 set -ex
 
 
-if [ $PLATFORM == x86_64 ] || [ "$1" == "glibc_only" ]; then
- # Output something every 10 minutes or Travis kills the job
- while sleep 9m; do echo -n -e " \b"; done &
- docker build --rm -t centos-with-vsyscall:latest --cache-from centos-with-vsyscall:latest --target centos-with-vsyscall -f docker/glibc/Dockerfile docker/glibc/
- # Killing background sleep loop
- kill %1
- if [ "$1" == "glibc_only" ]; then
- exit 0
- fi
- docker build --rm -t quay.io/pypa/manylinux2010_centos-6-no-vsyscall --cache-from quay.io/pypa/manylinux2010_centos-6-no-vsyscall:latest --cache-from centos-with-vsyscall:latest -f docker/glibc/Dockerfile docker/glibc/
-fi
-
-docker build --rm -t quay.io/pypa/manylinux2010_$PLATFORM:$TRAVIS_COMMIT -f docker/Dockerfile-$PLATFORM docker/
+docker build --rm -t quay.io/pypa/manylinux2014_$PLATFORM:$TRAVIS_COMMIT -f docker/Dockerfile-$PLATFORM docker/

docker/Dockerfile-x86_64

@@ -1,8 +1,7 @@
-# See docker/glibc/
-FROM quay.io/pypa/manylinux2010_centos-6-no-vsyscall
+FROM centos:7
 LABEL maintainer="The ManyLinux project"
 
-ENV AUDITWHEEL_PLAT manylinux2010_x86_64
+ENV AUDITWHEEL_PLAT manylinux2014_x86_64
 ENV LC_ALL en_US.UTF-8
 ENV LANG en_US.UTF-8
 ENV LANGUAGE en_US.UTF-8

docker/build_scripts/build.sh

@@ -10,14 +10,14 @@ MY_DIR=$(dirname "${BASH_SOURCE[0]}")
 
 # Dependencies for compiling Python that we want to remove from
 # the final image after compiling Python
-PYTHON_COMPILE_DEPS="zlib-devel bzip2-devel expat-devel ncurses-devel readline-devel tk-devel gdbm-devel db4-devel libpcap-devel xz-devel"
+PYTHON_COMPILE_DEPS="zlib-devel bzip2-devel expat-devel ncurses-devel readline-devel tk-devel gdbm-devel db4-devel libpcap-devel xz-devel openssl-devel keyutils-libs-devel krb5-devel libcom_err-devel libidn-devel curl-devel perl-devel"
 
-# Libraries that are allowed as part of the manylinux2010 profile
-# Extract from PEP: https://www.python.org/dev/peps/pep-0571/#the-manylinux2010-policy
+# Libraries that are allowed as part of the manylinux2014 profile
+# Extract from PEP: https://www.python.org/dev/peps/pep-0599/#the-manylinux2014-policy
 # On RPM-based systems, they are provided by these packages:
 # Package: Libraries
 # glib2: libglib-2.0.so.0, libgthread-2.0.so.0, libgobject-2.0.so.0
-# glibc: libresolv.so.2, libutil.so.1, libnsl.so.1, librt.so.1, libcrypt.so.1, libpthread.so.0, libdl.so.2, libm.so.6, libc.so.6
+# glibc: libresolv.so.2, libutil.so.1, libnsl.so.1, librt.so.1, libpthread.so.0, libdl.so.2, libm.so.6, libc.so.6
 # libICE: libICE.so.6
 # libX11: libX11.so.6
 # libXext: libXext.so.6
@@ -46,15 +46,14 @@ echo "multilib_policy=best" >> /etc/yum.conf
 # Decided not to clean at this point: https:/pypa/manylinux/pull/129
 yum -y update
 
-# Software collection (for devtoolset-8) and EPEL support (for cmake28 & yasm)
-yum -y install centos-release-scl https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
+# Software collection (for devtoolset-8) and EPEL support (for yasm)
+yum -y install centos-release-scl https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
 
 # Development tools and libraries
 yum -y install \
  automake \
  bison \
  bzip2 \
- cmake28 \
  devtoolset-8-binutils \
  devtoolset-8-gcc \
  devtoolset-8-gcc-c++ \
@@ -71,14 +70,9 @@ yum -y install \
  yasm \
  ${PYTHON_COMPILE_DEPS}
 
-# Install a git we link against system OpenSSL/Curl
-yum -y install openssl-devel keyutils-libs-devel krb5-devel libcom_err-devel libidn-devel curl-devel perl-devel
+# Install git
 build_git $GIT_ROOT $GIT_HASH
 git version
-yum -y erase openssl-devel keyutils-libs-devel krb5-devel libcom_err-devel libidn-devel curl-devel perl-devel
-
-# Build an OpenSSL for Pythons. We'll delete this at the end.
-build_openssl $OPENSSL_ROOT $OPENSSL_HASH
 
 # Install newest autoconf
 build_autoconf $AUTOCONF_ROOT $AUTOCONF_HASH
@@ -127,8 +121,6 @@ ln -s $($PY36_BIN/python -c 'import certifi; print(certifi.where())') \
 # Dockerfiles:
 export SSL_CERT_FILE=/opt/_internal/certs.pem
 
-# Now we can delete our built OpenSSL headers/static libs since we've linked everything we need
-rm -rf /usr/local/ssl
 
 # Install patchelf (latest with unreleased bug fixes)
 curl -fsSL -o patchelf.tar.gz https:/NixOS/patchelf/archive/$PATCHELF_VERSION.tar.gz

docker/build_scripts/build_env.sh

@@ -1,13 +1,7 @@
 # source me
 
 PYTHON_DOWNLOAD_URL=https://www.python.org/ftp/python
-CPYTHON_VERSIONS="2.7.16 3.4.10 3.5.7 3.6.9 3.7.4"
-
-# openssl version to build, with expected sha256 hash of .tar.gz
-# archive.
-OPENSSL_ROOT=openssl-1.0.2t
-OPENSSL_HASH=14cb464efe7ac6b54799b34456bd69558a749a4931ecfd9cf9f71d7881cac7bc
-OPENSSL_DOWNLOAD_URL=https://www.openssl.org/source
+CPYTHON_VERSIONS="3.5.7 3.6.9 3.7.4"
 
 PATCHELF_VERSION=0.10
 PATCHELF_HASH=b3cb6bdedcef5607ce34a350cf0b182eb979f8f7bc31eae55a93a70a3f020d13

docker/build_scripts/build_utils.sh

@@ -31,27 +31,18 @@ function pyver_dist_dir {
 function do_cpython_build {
  local py_ver=$1
  check_var $py_ver
- local ucs_setting=$2
- check_var $ucs_setting
  tar -xzf Python-$py_ver.tgz
  pushd Python-$py_ver
- if [ "$ucs_setting" = "none" ]; then
- unicode_flags=""
- dir_suffix=""
- else
- local unicode_flags="--enable-unicode=$ucs_setting"
- local dir_suffix="-$ucs_setting"
- fi
- local prefix="/opt/_internal/cpython-${py_ver}${dir_suffix}"
+ local prefix="/opt/_internal/cpython-${py_ver}"
  mkdir -p ${prefix}/lib
- ./configure --prefix=${prefix} --disable-shared $unicode_flags > /dev/null
+ ./configure --prefix=${prefix} --disable-shared > /dev/null
  make -j2 > /dev/null
  make install > /dev/null
  popd
  rm -rf Python-$py_ver
  # Some python's install as bin/python3. Make them available as
  # bin/python.
- if [ -e ${prefix}/bin/python3 ]; then
+ if [ -e ${prefix}/bin/python3 ] && [ ! -e ${prefix}/bin/python ]; then
  ln -s python3 ${prefix}/bin/python
  fi
  ${prefix}/bin/python get-pip.py
@@ -74,12 +65,7 @@ function build_cpython {
  curl -fsSLO $PYTHON_DOWNLOAD_URL/$py_dist_dir/Python-$py_ver.tgz
  curl -fsSLO $PYTHON_DOWNLOAD_URL/$py_dist_dir/Python-$py_ver.tgz.asc
  gpg --verify Python-$py_ver.tgz.asc
- if [ $(lex_pyver $py_ver) -lt $(lex_pyver 3.3) ]; then
- do_cpython_build $py_ver ucs2
- do_cpython_build $py_ver ucs4
- else
- do_cpython_build $py_ver none
- fi
+ do_cpython_build $py_ver
  rm -f Python-$py_ver.tgz
  rm -f Python-$py_ver.tgz.asc
 }
@@ -100,13 +86,6 @@ function build_cpythons {
 }
 
 
-function do_openssl_build {
- ./config no-ssl2 no-shared -fPIC --prefix=/usr/local/ssl > /dev/null
- make > /dev/null
- make install_sw > /dev/null
-}
-
-
 function fetch_source {
  # This is called both inside and outside the build context (e.g. in Travis) to prefetch
  # source tarballs, where curl exists (and works)
@@ -134,19 +113,6 @@ function check_sha256sum {
 }
 
 
-function build_openssl {
- local openssl_fname=$1
- check_var ${openssl_fname}
- local openssl_sha256=$2
- check_var ${openssl_sha256}
- fetch_source ${openssl_fname}.tar.gz ${OPENSSL_DOWNLOAD_URL}
- check_sha256sum ${openssl_fname}.tar.gz ${openssl_sha256}
- tar -xzf ${openssl_fname}.tar.gz
- (cd ${openssl_fname} && do_openssl_build)
- rm -rf ${openssl_fname} ${openssl_fname}.tar.gz
-}
-
-
 function build_git {
  local git_fname=$1
  check_var ${git_fname}