Merge branch 'main' into sboms

sethmlarson · web-flow · commit 37bae349b5fc · 2025-07-02T10:20:47.000-05:00
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,9 +1,6 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
 
-default_language_version:
-  python: python3.9
-
 exclude: ^src/auditwheel/_vendor/
 
 repos:
@@ -24,16 +21,22 @@ repos:
   - id: trailing-whitespace
 
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.11.9
+  rev: v0.11.13
   hooks:
   - id: ruff
     args: ["--fix", "--show-fixes"]
   - id: ruff-format
 
 - repo: https://github.com/pre-commit/mirrors-mypy
-  rev: v1.15.0
+  rev: v1.16.0
   hooks:
   - id: mypy
-    exclude: ^tests/integration/.*/.*$|^scripts/calculate_symbol_versions.py$
+    exclude: tests/integration/.*/.*|tests/integration/quick_check_numpy.py|tests/unit/test_wheel_abi.py|scripts/calculate_symbol_versions.py
+    args: ["--python-version=3.9"]
     additional_dependencies:
+      - nox
+      - packaging
+      - pyelftools
+      - pytest
+      - types-docker
       - types-requests
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,19 @@
 
 ## HEAD
 
+## 6.4.0
+
+Released May 25, 2025
+
+### User-facing changes
+- [FEATURE] detect architecture/libc from wheel ([#548](https://github.com/pypa/auditwheel/pull/548))
+- [FEATURE] Add libatomic.so.1 to lib_whitelist ([#572](https://github.com/pypa/auditwheel/pull/572))
+- [BUGFIX] Respect `DT_NEEDED` entries order in `lddtree` ([#561](https://github.com/pypa/auditwheel/issues/561), [#586](https://github.com/pypa/auditwheel/pull/586))
+- [BUGFIX] Resolve path of InTemporaryDirectory name ([#565](https://github.com/pypa/auditwheel/issues/565))
+- [BUGFIX] Clip zip timestamp to 1980-01-01 ([#566](https://github.com/pypa/auditwheel/issues/566))
+- [BUGFIX] Compressed tag sets are not sorted when rewriting wheel filename ([#583](https://github.com/pypa/auditwheel/issues/583))
+- [BUGFIX] Remove libpython linkage instead of ignoring it ([#589](https://github.com/pypa/auditwheel/issues/589))
+
 ## 6.3.0
 
 Released March 16, 2025
diff --git a/conftest.py b/conftest.py
@@ -0,0 +1,10 @@
+import os
+
+import pytest
+
+
+@pytest.fixture(autouse=True, scope="session")
+def clean_env():
+    variables = ("AUDITWHEEL_PLAT", "AUDITWHEEL_ZIP_COMPRESSION_LEVEL")
+    for var in variables:
+        os.environ.pop(var, None)
diff --git a/noxfile.py b/noxfile.py
@@ -19,7 +19,7 @@
 sdist = ""
 
 
-@nox.session(python=["3.9"], reuse_venv=True)
+@nox.session(reuse_venv=True)
 def lint(session: nox.Session) -> None:
     """
     Run linters on the codebase.
diff --git a/pyproject.toml b/pyproject.toml
@@ -73,6 +73,7 @@ warn_redundant_casts = true
 warn_unreachable = false
 warn_unused_configs = true
 warn_unused_ignores = true
+untyped_calls_exclude = ["elftools.elf.elffile.ELFFile", "elftools.elf.sections.NoteSection"]
 
 [[tool.mypy.overrides]]
 module = "auditwheel.*"
diff --git a/src/auditwheel/lddtree.py b/src/auditwheel/lddtree.py
@@ -18,6 +18,7 @@
 import glob
 import logging
 import os
+import re
 from dataclasses import dataclass
 from fnmatch import fnmatch
 from pathlib import Path
@@ -31,7 +32,10 @@
 from .libc import Libc
 
 log = logging.getLogger(__name__)
-__all__ = ["DynamicExecutable", "DynamicLibrary", "ldd"]
+__all__ = ["LIBPYTHON_RE", "DynamicExecutable", "DynamicLibrary", "ldd"]
+
+# Regex to match libpython shared library names
+LIBPYTHON_RE = re.compile(r"^libpython\d+\.\d+m?.so(\.\d)*$")
 
 
 @dataclass(frozen=True)
@@ -563,6 +567,16 @@ def ldd(
             log.info("Excluding %s", soname)
             _excluded_libs.add(soname)
             continue
+
+        # special case for libpython, see https://github.com/pypa/auditwheel/issues/589
+        # we want to return the dependency to be able to remove it later on but
+        # we don't want to analyze it for symbol versions nor do we want to analyze its
+        # dependencies as it will be removed.
+        if LIBPYTHON_RE.match(soname):
+            log.info("Skip %s resolution", soname)
+            _all_libs[soname] = DynamicLibrary(soname, None, None)
+            continue
+
         realpath, fullpath = find_lib(platform, soname, all_ldpaths, root)
         if realpath is not None and any(fnmatch(str(realpath), e) for e in exclude):
             log.info("Excluding %s", realpath)
diff --git a/src/auditwheel/patcher.py b/src/auditwheel/patcher.py
@@ -11,6 +11,9 @@ class ElfPatcher:
     def replace_needed(self, file_name: Path, *old_new_pairs: tuple[str, str]) -> None:
         raise NotImplementedError()
 
+    def remove_needed(self, file_name: Path, *sonames: str) -> None:
+        raise NotImplementedError()
+
     def set_soname(self, file_name: Path, new_so_name: str) -> None:
         raise NotImplementedError()
 
@@ -57,6 +60,15 @@ def replace_needed(self, file_name: Path, *old_new_pairs: tuple[str, str]) -> No
             ]
         )
 
+    def remove_needed(self, file_name: Path, *sonames: str) -> None:
+        check_call(
+            [
+                "patchelf",
+                *chain.from_iterable(("--remove-needed", soname) for soname in sonames),
+                file_name,
+            ]
+        )
+
     def set_soname(self, file_name: Path, new_so_name: str) -> None:
         check_call(["patchelf", "--set-soname", new_so_name, file_name])
 
diff --git a/src/auditwheel/policy/__init__.py b/src/auditwheel/policy/__init__.py
@@ -17,7 +17,6 @@
 from ..tools import is_subdir
 
 _HERE = Path(__file__).parent
-LIBPYTHON_RE = re.compile(r"^libpython\d+\.\d+m?.so(.\d)*$")
 _MUSL_POLICY_RE = re.compile(r"^musllinux_\d+_\d+$")
 
 logger = logging.getLogger(__name__)
@@ -201,9 +200,6 @@ def filter_libs(
                     # 'ld64.so.1' on ppc64le
                     # 'ld-linux*' on other platforms
                     continue
-                if LIBPYTHON_RE.match(lib):
-                    # always exclude libpythonXY
-                    continue
                 if lib in whitelist:
                     # exclude any libs in the whitelist
                     continue
diff --git a/src/auditwheel/repair.py b/src/auditwheel/repair.py
@@ -19,14 +19,14 @@
 
 from .elfutils import elf_read_dt_needed, elf_read_rpaths
 from .hashfile import hashfile
+from .lddtree import LIBPYTHON_RE
 from .policy import get_replace_platforms
 from .tools import is_subdir, unique_by_index
 from .wheel_abi import WheelAbIInfo
 from .wheeltools import InWheelCtx, add_platforms
 
 logger = logging.getLogger(__name__)
 
-
 # Copied from wheel 0.31.1
 WHEEL_INFO_RE = re.compile(
     r"""^(?P<namever>(?P<name>.+?)-(?P<ver>\d.*?))(-(?P<build>\d.*?))?
@@ -56,8 +56,9 @@ def repair_wheel(
     out_dir = out_dir.resolve(strict=True)
     wheel_fname = wheel_path.name
 
+    output_wheel = out_dir / wheel_fname
     with InWheelCtx(wheel_path) as ctx:
-        ctx.out_wheel = out_dir / wheel_fname
+        ctx.out_wheel = output_wheel
         ctx.zip_compression_level = zip_compression_level
 
         match = WHEEL_INFO_RE(wheel_fname)
@@ -76,6 +77,16 @@ def repair_wheel(
             ext_libs = v[abis[0]].libs
             replacements: list[tuple[str, str]] = []
             for soname, src_path in ext_libs.items():
+                # Handle libpython dependencies by removing them
+                if LIBPYTHON_RE.match(soname):
+                    logger.warning(
+                        "Removing %s dependency from %s. Linking with libpython is forbidden for manylinux/musllinux wheels.",
+                        soname,
+                        str(fn),
+                    )
+                    patcher.remove_needed(fn, soname)
+                    continue
+
                 if src_path is None:
                     msg = (
                         "Cannot repair wheel, because required "
@@ -134,7 +145,7 @@ def repair_wheel(
             sbom_dir.mkdir(exist_ok=True)
             (sbom_dir / "auditwheel.cdx.json").write_text(json.dumps(sbom_data))
 
-    return ctx.out_wheel
+    return output_wheel
 
 
 def strip_symbols(libraries: Iterable[Path]) -> None:
diff --git a/tests/integration/__init__.py b/tests/integration/__init__.py
diff --git a/tests/integration/python_mscl-67.0.1.0-cp313-cp313-manylinux2014_aarch64.whl b/tests/integration/python_mscl-67.0.1.0-cp313-cp313-manylinux2014_aarch64.whl
diff --git a/tests/integration/test_bundled_wheels.py b/tests/integration/test_bundled_wheels.py
@@ -9,7 +9,6 @@
 from datetime import datetime, timezone
 from os.path import isabs
 from pathlib import Path
-from unittest import mock
 from unittest.mock import Mock
 
 import pytest
@@ -26,29 +25,41 @@
 @pytest.mark.parametrize(
     ("file", "external_libs", "exclude"),
     [
-        ("cffi-1.5.0-cp27-none-linux_x86_64.whl", {"libffi.so.5"}, frozenset()),
-        ("cffi-1.5.0-cp27-none-linux_x86_64.whl", set(), frozenset(["libffi.so.5"])),
         (
             "cffi-1.5.0-cp27-none-linux_x86_64.whl",
-            {"libffi.so.5"},
-            frozenset(["libffi.so.noexist", "libnoexist.so.*"]),
+            {"libffi.so.5", "libpython2.7.so.1.0"},
+            frozenset(),
         ),
         (
             "cffi-1.5.0-cp27-none-linux_x86_64.whl",
             set(),
+            frozenset(["libffi.so.5", "libpython2.7.so.1.0"]),
+        ),
+        (
+            "cffi-1.5.0-cp27-none-linux_x86_64.whl",
+            {"libffi.so.5", "libpython2.7.so.1.0"},
+            frozenset(["libffi.so.noexist", "libnoexist.so.*"]),
+        ),
+        (
+            "cffi-1.5.0-cp27-none-linux_x86_64.whl",
+            {"libpython2.7.so.1.0"},
             frozenset(["libffi.so.[4,5]"]),
         ),
         (
             "cffi-1.5.0-cp27-none-linux_x86_64.whl",
-            {"libffi.so.5"},
+            {"libffi.so.5", "libpython2.7.so.1.0"},
             frozenset(["libffi.so.[6,7]"]),
         ),
         (
             "cffi-1.5.0-cp27-none-linux_x86_64.whl",
-            set(),
+            {"libpython2.7.so.1.0"},
             frozenset([f"{HERE}/*"]),
         ),
-        ("cffi-1.5.0-cp27-none-linux_x86_64.whl", set(), frozenset(["libffi.so.*"])),
+        (
+            "cffi-1.5.0-cp27-none-linux_x86_64.whl",
+            {"libpython2.7.so.1.0"},
+            frozenset(["libffi.so.*"]),
+        ),
         ("cffi-1.5.0-cp27-none-linux_x86_64.whl", set(), frozenset(["*"])),
         (
             "python_snappy-0.5.2-pp260-pypy_41-linux_x86_64.whl",
@@ -170,13 +181,37 @@ def test_wheel_source_date_epoch(timestamp, tmp_path, monkeypatch):
     )
 
     monkeypatch.setenv("SOURCE_DATE_EPOCH", str(timestamp[0]))
-    # patchelf might not be available as we aren't running in a manylinux container
-    # here. We don't need need it in this test, so just patch it.
-    with mock.patch("auditwheel.patcher._verify_patchelf"):
-        main_repair.execute(args, Mock())
-
+    main_repair.execute(args, Mock())
     output_wheel, *_ = list(wheel_output_path.glob("*.whl"))
     with zipfile.ZipFile(output_wheel) as wheel_file:
         for file in wheel_file.infolist():
             file_date_time = datetime(*file.date_time, tzinfo=timezone.utc)
             assert file_date_time.timestamp() == timestamp[1]
+
+
+def test_libpython(tmp_path, caplog):
+    wheel = HERE / "python_mscl-67.0.1.0-cp313-cp313-manylinux2014_aarch64.whl"
+    args = Namespace(
+        LIB_SDIR=".libs",
+        ONLY_PLAT=False,
+        PLAT="auto",
+        STRIP=False,
+        UPDATE_TAGS=True,
+        WHEEL_DIR=tmp_path,
+        WHEEL_FILE=[wheel],
+        EXCLUDE=[],
+        DISABLE_ISA_EXT_CHECK=False,
+        ZIP_COMPRESSION_LEVEL=6,
+        cmd="repair",
+        func=Mock(),
+        prog="auditwheel",
+        verbose=0,
+    )
+    main_repair.execute(args, Mock())
+    assert (
+        "Removing libpython3.13.so.1.0 dependency from python_mscl/_mscl.so"
+        in caplog.text
+    )
+    assert tuple(path.name for path in tmp_path.glob("*.whl")) == (
+        "python_mscl-67.0.1.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_31_aarch64.whl",
+    )
diff --git a/tests/integration/test_manylinux.py b/tests/integration/test_manylinux.py
@@ -293,6 +293,7 @@ def docker_start(
         environment=env_variables,
         platform=f"linux/{goarch}",
     )
+    assert isinstance(con.id, str)
     logger.info("Started container %s", con.id[:12])
     return con
 
@@ -333,6 +334,7 @@ def docker_exec(
     cwd: str | None = None,
     env: dict[str, str] | None = None,
 ) -> str:
+    assert isinstance(container.id, str)
     logger.info("docker exec %s: %r", container.id[:12], cmd)
     ec, output = container.exec_run(cmd, workdir=cwd, environment=env)
     output = output.decode("utf-8")
diff --git a/tests/unit/test_elfpatcher.py b/tests/unit/test_elfpatcher.py
@@ -110,3 +110,20 @@ def test_get_rpath(self, _0, check_output, _1):  # noqa: PT019
 
         assert result == check_output.return_value.decode()
         assert check_output.call_args_list == check_output_expected_args
+
+    def test_remove_needed(self, check_call, _0, _1):  # noqa: PT019
+        patcher = Patchelf()
+        filename = Path("test.so")
+        soname_1 = "TEST_REM_1"
+        soname_2 = "TEST_REM_2"
+        patcher.remove_needed(filename, soname_1, soname_2)
+        check_call.assert_called_once_with(
+            [
+                "patchelf",
+                "--remove-needed",
+                soname_1,
+                "--remove-needed",
+                soname_2,
+                filename,
+            ]
+        )
diff --git a/tests/unit/test_lddtree.py b/tests/unit/test_lddtree.py
diff --git a/tests/unit/test_policy.py b/tests/unit/test_policy.py
