From 694d4816bb1a390ddf0163f9ce23cdab975b3fa7 Mon Sep 17 00:00:00 2001 From: mayeut Date: Sat, 22 Aug 2026 14:47:57 +0200 Subject: [PATCH 1/3] Build abi3.abi3t wheels for CPython 3.15+ --- .github/actions/windows-wheel/action.yml | 4 +-- .github/workflows/wheel-builder.yml | 33 +++++++++++++++++------- pyproject.toml | 1 + 3 files changed, 26 insertions(+), 12 deletions(-) diff --git a/.github/actions/windows-wheel/action.yml b/.github/actions/windows-wheel/action.yml index 064583dc649e..060b4b026d34 100644 --- a/.github/actions/windows-wheel/action.yml +++ b/.github/actions/windows-wheel/action.yml @@ -8,7 +8,7 @@ inputs: description: "Python version to build for (e.g. 3.14, 3.14t, pypy-3.11)" required: true abi-version: - description: "Optional limited-API ABI version (e.g. py39, py311)" + description: "Optional limited-API ABI version (e.g. abi3-py39, abi3-py311, abi3t-py315)" required: false default: "" arch: @@ -73,7 +73,7 @@ runs: shell: bash - run: | if [ -n "${ABI_VERSION}" ]; then - PY_LIMITED_API="--config-settings=build-args=--features=pyo3/abi3-${ABI_VERSION}" + PY_LIMITED_API="--config-settings=build-args=--features=pyo3/${ABI_VERSION}" fi uv build --wheel --require-hashes --build-constraint="${BUILD_REQUIREMENTS_PATH}" cryptography*.tar.gz $PY_LIMITED_API --config-settings=build-args=--sbom-include="C:/openssl-${OPENSSL_NAME}/sbom.json" -o wheelhouse/ diff --git a/.github/workflows/wheel-builder.yml b/.github/workflows/wheel-builder.yml index 9bbb7ee2d51a..e7f75f707b4b 100644 --- a/.github/workflows/wheel-builder.yml +++ b/.github/workflows/wheel-builder.yml @@ -65,9 +65,10 @@ jobs: fail-fast: false matrix: PYTHON: - - { VERSION: "cp311-cp311", ABI_VERSION: 'py39' } - - { VERSION: "cp311-cp311", ABI_VERSION: 'py311' } + - { VERSION: "cp311-cp311", ABI_VERSION: 'abi3-py39' } + - { VERSION: "cp311-cp311", ABI_VERSION: 'abi3-py311' } - { VERSION: "cp314-cp314t" } + - { VERSION: "cp315-cp315", ABI_VERSION: 'abi3t-py315' } - { VERSION: "pp311-pypy311_pp73" } MANYLINUX: - { NAME: "manylinux2014_x86_64", CONTAINER: "cryptography-manylinux2014:x86_64", RUNNER: "ubuntu-latest" } @@ -140,7 +141,7 @@ jobs: - name: Build the wheel run: | if [ -n "${{ matrix.PYTHON.ABI_VERSION }}" ]; then - PY_LIMITED_API="--config-settings=build-args=--features=pyo3/abi3-${{ matrix.PYTHON.ABI_VERSION }}" + PY_LIMITED_API="--config-settings=build-args=--features=pyo3/${{ matrix.PYTHON.ABI_VERSION }}" fi # The manylinux-entrypoint script accounts for uname issues, otherwise @@ -182,14 +183,14 @@ jobs: matrix: PYTHON: - VERSION: '3.11' - ABI_VERSION: 'py39' + ABI_VERSION: 'abi3-py39' DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.14.0/python-3.14.0-macos11.pkg' BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.14/bin/python3' DEPLOYMENT_TARGET: '11.0' ARCHFLAGS: '-arch arm64' _PYTHON_HOST_PLATFORM: 'macosx-11.0-arm64' - VERSION: '3.14' - ABI_VERSION: 'py311' + ABI_VERSION: 'abi3-py311' DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.14.0/python-3.14.0-macos11.pkg' BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.14/bin/python3' DEPLOYMENT_TARGET: '11.0' @@ -201,6 +202,13 @@ jobs: DEPLOYMENT_TARGET: '11.0' ARCHFLAGS: '-arch arm64' _PYTHON_HOST_PLATFORM: 'macosx-11.0-arm64' + - VERSION: '3.15' + ABI_VERSION: 'abi3t-py315' + DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg' + BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.15/bin/python3' + DEPLOYMENT_TARGET: '11.0' + ARCHFLAGS: '-arch arm64' + _PYTHON_HOST_PLATFORM: 'macosx-11.0-arm64' - VERSION: 'pypy-3.11' BIN_PATH: 'pypy3' DEPLOYMENT_TARGET: '11.0' @@ -266,21 +274,23 @@ jobs: - name: Build the wheel run: | if [ -n "${{ matrix.PYTHON.ABI_VERSION }}" ]; then - PY_LIMITED_API="--config-settings=build-args=--features=pyo3/abi3-${{ matrix.PYTHON.ABI_VERSION }}" + PY_LIMITED_API="--config-settings=build-args=--features=pyo3/${{ matrix.PYTHON.ABI_VERSION }}" fi OPENSSL_DIR="$(readlink -f ../openssl-macos-arm64/)" \ OPENSSL_STATIC=1 \ - uv build --wheel --require-hashes --build-constraint=$BUILD_REQUIREMENTS_PATH $PY_LIMITED_API --config-settings=build-args=--sbom-include="$(readlink -f ../openssl-macos-arm64/sbom.json)" cryptography*.tar.gz -o wheelhouse/ + uv build --python "$PYTHON_BIN_PATH" --wheel --require-hashes --build-constraint=$BUILD_REQUIREMENTS_PATH $PY_LIMITED_API --config-settings=build-args=--sbom-include="$(readlink -f ../openssl-macos-arm64/sbom.json)" cryptography*.tar.gz -o wheelhouse/ env: MACOSX_DEPLOYMENT_TARGET: ${{ matrix.PYTHON.DEPLOYMENT_TARGET }} ARCHFLAGS: ${{ matrix.PYTHON.ARCHFLAGS }} _PYTHON_HOST_PLATFORM: ${{ matrix.PYTHON._PYTHON_HOST_PLATFORM }} + PYTHON_BIN_PATH: ${{ matrix.PYTHON.BIN_PATH }} - name: Smoketest uses: ./.github/actions/wheel-smoketest with: build-requirements-path: ${{ env.BUILD_REQUIREMENTS_PATH }} + python-path: ${{ matrix.PYTHON.BIN_PATH }} - run: | echo "CRYPTOGRAPHY_WHEEL_NAME=$(basename $(ls wheelhouse/cryptography*.whl))" >> $GITHUB_ENV @@ -299,9 +309,10 @@ jobs: WINDOWS: - {ARCH: 'x64', WINDOWS: 'win64', RUST_TRIPLE: 'x86_64-pc-windows-msvc', RUNNER: 'windows-latest'} PYTHON: - - {VERSION: "3.14", "ABI_VERSION": "py39"} - - {VERSION: "3.14", "ABI_VERSION": "py311"} + - {VERSION: "3.14", "ABI_VERSION": "abi3-py39"} + - {VERSION: "3.14", "ABI_VERSION": "abi3-py311"} - {VERSION: "3.14t"} + - {VERSION: "3.15.0-rc.1", "ABI_VERSION": "abi3t-py315"} - {VERSION: "pypy-3.11"} include: # Windows on ARM is in a stability validation period; the work @@ -309,9 +320,11 @@ jobs: # failures don't block the release pipeline and no broken wheel # is uploaded. - WINDOWS: {ARCH: 'arm64', WINDOWS: 'arm64', RUST_TRIPLE: 'aarch64-pc-windows-msvc', RUNNER: 'windows-11-arm'} - PYTHON: {VERSION: "3.14", "ABI_VERSION": "py311"} + PYTHON: {VERSION: "3.14", "ABI_VERSION": "abi3-py311"} - WINDOWS: {ARCH: 'arm64', WINDOWS: 'arm64', RUST_TRIPLE: 'aarch64-pc-windows-msvc', RUNNER: 'windows-11-arm'} PYTHON: {VERSION: "3.14t"} + - WINDOWS: {ARCH: 'arm64', WINDOWS: 'arm64', RUST_TRIPLE: 'aarch64-pc-windows-msvc', RUNNER: 'windows-11-arm'} + PYTHON: {VERSION: "3.15.0-rc.1", "ABI_VERSION": "abi3t-py315"} name: "${{ matrix.PYTHON.VERSION }} ${{ matrix.WINDOWS.WINDOWS }} ${{ matrix.PYTHON.ABI_VERSION }}" steps: - name: Get build-requirements.txt from repository diff --git a/pyproject.toml b/pyproject.toml index b34ba7debd05..4b6dbbac5331 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -42,6 +42,7 @@ classifiers = [ "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", "Programming Language :: Python :: 3.14", + "Programming Language :: Python :: 3.15", "Programming Language :: Python :: Implementation :: CPython", "Programming Language :: Python :: Implementation :: PyPy", "Programming Language :: Python :: Free Threading :: 3 - Stable", From 86db1caed77848c17de6c4b84c1eff6c49dcfe54 Mon Sep 17 00:00:00 2001 From: mayeut Date: Sat, 22 Aug 2026 16:11:08 +0200 Subject: [PATCH 2/3] use freethreaded python version --- .github/actions/windows-wheel/action.yml | 1 + .../macos-pkg-choices-3.15-freethreaded.xml | 14 ++++++++ .github/workflows/wheel-builder.yml | 34 +++++++++++++------ 3 files changed, 38 insertions(+), 11 deletions(-) create mode 100644 .github/config/macos-pkg-choices-3.15-freethreaded.xml diff --git a/.github/actions/windows-wheel/action.yml b/.github/actions/windows-wheel/action.yml index 060b4b026d34..5512c7b42d77 100644 --- a/.github/actions/windows-wheel/action.yml +++ b/.github/actions/windows-wheel/action.yml @@ -43,6 +43,7 @@ runs: with: python-version: ${{ inputs.python-version }} architecture: ${{ inputs.arch }} + allow-prereleases: ${{ inputs.python-version == '3.15t' }} - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with: toolchain: stable diff --git a/.github/config/macos-pkg-choices-3.15-freethreaded.xml b/.github/config/macos-pkg-choices-3.15-freethreaded.xml new file mode 100644 index 000000000000..271377a8d11b --- /dev/null +++ b/.github/config/macos-pkg-choices-3.15-freethreaded.xml @@ -0,0 +1,14 @@ + + + + + + attributeSetting + 1 + choiceAttribute + selected + choiceIdentifier + org.python.Python.PythonTFramework-3.15 + + + diff --git a/.github/workflows/wheel-builder.yml b/.github/workflows/wheel-builder.yml index e7f75f707b4b..7c01ab3df175 100644 --- a/.github/workflows/wheel-builder.yml +++ b/.github/workflows/wheel-builder.yml @@ -68,7 +68,7 @@ jobs: - { VERSION: "cp311-cp311", ABI_VERSION: 'abi3-py39' } - { VERSION: "cp311-cp311", ABI_VERSION: 'abi3-py311' } - { VERSION: "cp314-cp314t" } - - { VERSION: "cp315-cp315", ABI_VERSION: 'abi3t-py315' } + - { VERSION: "cp315-cp315t", ABI_VERSION: 'abi3t-py315' } - { VERSION: "pp311-pypy311_pp73" } MANYLINUX: - { NAME: "manylinux2014_x86_64", CONTAINER: "cryptography-manylinux2014:x86_64", RUNNER: "ubuntu-latest" } @@ -202,10 +202,10 @@ jobs: DEPLOYMENT_TARGET: '11.0' ARCHFLAGS: '-arch arm64' _PYTHON_HOST_PLATFORM: 'macosx-11.0-arm64' - - VERSION: '3.15' + - VERSION: '3.15t' ABI_VERSION: 'abi3t-py315' DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg' - BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.15/bin/python3' + BIN_PATH: '/Library/Frameworks/PythonT.framework/Versions/3.15/bin/python3.15t' DEPLOYMENT_TARGET: '11.0' ARCHFLAGS: '-arch arm64' _PYTHON_HOST_PLATFORM: 'macosx-11.0-arm64' @@ -226,6 +226,7 @@ jobs: ${{ env.BUILD_REQUIREMENTS_PATH }} ${{ env.UV_REQUIREMENTS_PATH }} .github/config/macos-pkg-choices-freethreaded.xml + .github/config/macos-pkg-choices-3.15-freethreaded.xml .github/actions/wheel-smoketest/ sparse-checkout-cone-mode: false - name: Setup python @@ -234,14 +235,21 @@ jobs: sudo installer -pkg python.pkg -target / env: PYTHON_DOWNLOAD_URL: ${{ matrix.PYTHON.DOWNLOAD_URL }} - if: contains(matrix.PYTHON.VERSION, 'pypy') == false && matrix.PYTHON.VERSION != '3.14t' - - name: Setup free-threaded python + if: contains(matrix.PYTHON.VERSION, 'pypy') == false && matrix.PYTHON.VERSION != '3.14t' && matrix.PYTHON.VERSION != '3.15t' + - name: Setup free-threaded python 3.14 run: | curl --max-time 30 --retry 5 "$PYTHON_DOWNLOAD_URL" -o python.pkg sudo installer -pkg python.pkg -applyChoiceChangesXML .github/config/macos-pkg-choices-freethreaded.xml -target / env: PYTHON_DOWNLOAD_URL: ${{ matrix.PYTHON.DOWNLOAD_URL }} if: matrix.PYTHON.VERSION == '3.14t' + - name: Setup free-threaded python 3.15 + run: | + curl --max-time 30 --retry 5 "$PYTHON_DOWNLOAD_URL" -o python.pkg + sudo installer -pkg python.pkg -applyChoiceChangesXML .github/config/macos-pkg-choices-3.15-freethreaded.xml -target / + env: + PYTHON_DOWNLOAD_URL: ${{ matrix.PYTHON.DOWNLOAD_URL }} + if: matrix.PYTHON.VERSION == '3.15t' - name: Setup pypy uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: @@ -264,12 +272,18 @@ jobs: name: cryptography-sdist - run: ${{ matrix.PYTHON.BIN_PATH }} -m pip install -r "${UV_REQUIREMENTS_PATH}" - - name: add free-threaded python tools directory to PATH + - name: add free-threaded python 3.14 tools directory to PATH # This can be deleted once the mac installer has a way to do this PATH # update automatically, like it does for the GIL-enabled build. # See https://github.com/python/cpython/issues/137450 run: echo "/Library/Frameworks/PythonT.framework/Versions/3.14/bin" >> "$GITHUB_PATH" if: matrix.PYTHON.VERSION == '3.14t' + - name: add free-threaded python 3.15 tools directory to PATH + # This can be deleted once the mac installer has a way to do this PATH + # update automatically, like it does for the GIL-enabled build. + # See https://github.com/python/cpython/issues/137450 + run: echo "/Library/Frameworks/PythonT.framework/Versions/3.15/bin" >> "$GITHUB_PATH" + if: matrix.PYTHON.VERSION == '3.15t' - run: mkdir wheelhouse - name: Build the wheel run: | @@ -279,18 +293,16 @@ jobs: OPENSSL_DIR="$(readlink -f ../openssl-macos-arm64/)" \ OPENSSL_STATIC=1 \ - uv build --python "$PYTHON_BIN_PATH" --wheel --require-hashes --build-constraint=$BUILD_REQUIREMENTS_PATH $PY_LIMITED_API --config-settings=build-args=--sbom-include="$(readlink -f ../openssl-macos-arm64/sbom.json)" cryptography*.tar.gz -o wheelhouse/ + uv build --wheel --require-hashes --build-constraint=$BUILD_REQUIREMENTS_PATH $PY_LIMITED_API --config-settings=build-args=--sbom-include="$(readlink -f ../openssl-macos-arm64/sbom.json)" cryptography*.tar.gz -o wheelhouse/ env: MACOSX_DEPLOYMENT_TARGET: ${{ matrix.PYTHON.DEPLOYMENT_TARGET }} ARCHFLAGS: ${{ matrix.PYTHON.ARCHFLAGS }} _PYTHON_HOST_PLATFORM: ${{ matrix.PYTHON._PYTHON_HOST_PLATFORM }} - PYTHON_BIN_PATH: ${{ matrix.PYTHON.BIN_PATH }} - name: Smoketest uses: ./.github/actions/wheel-smoketest with: build-requirements-path: ${{ env.BUILD_REQUIREMENTS_PATH }} - python-path: ${{ matrix.PYTHON.BIN_PATH }} - run: | echo "CRYPTOGRAPHY_WHEEL_NAME=$(basename $(ls wheelhouse/cryptography*.whl))" >> $GITHUB_ENV @@ -312,7 +324,7 @@ jobs: - {VERSION: "3.14", "ABI_VERSION": "abi3-py39"} - {VERSION: "3.14", "ABI_VERSION": "abi3-py311"} - {VERSION: "3.14t"} - - {VERSION: "3.15.0-rc.1", "ABI_VERSION": "abi3t-py315"} + - {VERSION: "3.15t", "ABI_VERSION": "abi3t-py315"} - {VERSION: "pypy-3.11"} include: # Windows on ARM is in a stability validation period; the work @@ -324,7 +336,7 @@ jobs: - WINDOWS: {ARCH: 'arm64', WINDOWS: 'arm64', RUST_TRIPLE: 'aarch64-pc-windows-msvc', RUNNER: 'windows-11-arm'} PYTHON: {VERSION: "3.14t"} - WINDOWS: {ARCH: 'arm64', WINDOWS: 'arm64', RUST_TRIPLE: 'aarch64-pc-windows-msvc', RUNNER: 'windows-11-arm'} - PYTHON: {VERSION: "3.15.0-rc.1", "ABI_VERSION": "abi3t-py315"} + PYTHON: {VERSION: "3.15t", "ABI_VERSION": "abi3t-py315"} name: "${{ matrix.PYTHON.VERSION }} ${{ matrix.WINDOWS.WINDOWS }} ${{ matrix.PYTHON.ABI_VERSION }}" steps: - name: Get build-requirements.txt from repository From 1872e944ec351c8afa09dc69f6a3f3b8dde18a0d Mon Sep 17 00:00:00 2001 From: mayeut Date: Sat, 22 Aug 2026 17:06:38 +0200 Subject: [PATCH 3/3] do not use allow-prereleases --- .github/actions/windows-wheel/action.yml | 5 ++++- .github/workflows/wheel-builder.yml | 17 +++++++++-------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/actions/windows-wheel/action.yml b/.github/actions/windows-wheel/action.yml index 5512c7b42d77..73283b7986a5 100644 --- a/.github/actions/windows-wheel/action.yml +++ b/.github/actions/windows-wheel/action.yml @@ -11,6 +11,9 @@ inputs: description: "Optional limited-API ABI version (e.g. abi3-py39, abi3-py311, abi3t-py315)" required: false default: "" + freethreaded: + description: "actions/setup-python freethreaded" + required: true arch: description: "actions/setup-python architecture (x86, x64, arm64)" required: true @@ -43,7 +46,7 @@ runs: with: python-version: ${{ inputs.python-version }} architecture: ${{ inputs.arch }} - allow-prereleases: ${{ inputs.python-version == '3.15t' }} + freethreaded: ${{ inputs.freethreaded }} - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with: toolchain: stable diff --git a/.github/workflows/wheel-builder.yml b/.github/workflows/wheel-builder.yml index 7c01ab3df175..8a1d83bfe798 100644 --- a/.github/workflows/wheel-builder.yml +++ b/.github/workflows/wheel-builder.yml @@ -321,22 +321,22 @@ jobs: WINDOWS: - {ARCH: 'x64', WINDOWS: 'win64', RUST_TRIPLE: 'x86_64-pc-windows-msvc', RUNNER: 'windows-latest'} PYTHON: - - {VERSION: "3.14", "ABI_VERSION": "abi3-py39"} - - {VERSION: "3.14", "ABI_VERSION": "abi3-py311"} - - {VERSION: "3.14t"} - - {VERSION: "3.15t", "ABI_VERSION": "abi3t-py315"} - - {VERSION: "pypy-3.11"} + - {VERSION: "3.14", "ABI_VERSION": "abi3-py39", FREETHREADED: false} + - {VERSION: "3.14", "ABI_VERSION": "abi3-py311", FREETHREADED: false} + - {VERSION: "3.14t", FREETHREADED: true} + - {VERSION: "3.15.0-rc.1", "ABI_VERSION": "abi3t-py315", FREETHREADED: true} + - {VERSION: "pypy-3.11", FREETHREADED: false} include: # Windows on ARM is in a stability validation period; the work # step uses `continue-on-error` only for these entries so transient # failures don't block the release pipeline and no broken wheel # is uploaded. - WINDOWS: {ARCH: 'arm64', WINDOWS: 'arm64', RUST_TRIPLE: 'aarch64-pc-windows-msvc', RUNNER: 'windows-11-arm'} - PYTHON: {VERSION: "3.14", "ABI_VERSION": "abi3-py311"} + PYTHON: {VERSION: "3.14", "ABI_VERSION": "abi3-py311", FREETHREADED: false} - WINDOWS: {ARCH: 'arm64', WINDOWS: 'arm64', RUST_TRIPLE: 'aarch64-pc-windows-msvc', RUNNER: 'windows-11-arm'} - PYTHON: {VERSION: "3.14t"} + PYTHON: {VERSION: "3.14t", FREETHREADED: true} - WINDOWS: {ARCH: 'arm64', WINDOWS: 'arm64', RUST_TRIPLE: 'aarch64-pc-windows-msvc', RUNNER: 'windows-11-arm'} - PYTHON: {VERSION: "3.15t", "ABI_VERSION": "abi3t-py315"} + PYTHON: {VERSION: "3.15.0-rc.1", "ABI_VERSION": "abi3t-py315", FREETHREADED: true} name: "${{ matrix.PYTHON.VERSION }} ${{ matrix.WINDOWS.WINDOWS }} ${{ matrix.PYTHON.ABI_VERSION }}" steps: - name: Get build-requirements.txt from repository @@ -358,6 +358,7 @@ jobs: with: python-version: ${{ matrix.PYTHON.VERSION }} abi-version: ${{ matrix.PYTHON.ABI_VERSION }} + freethreaded: ${{ matrix.PYTHON.FREETHREADED }} arch: ${{ matrix.WINDOWS.ARCH }} rust-triple: ${{ matrix.WINDOWS.RUST_TRIPLE }} openssl-name: ${{ matrix.WINDOWS.WINDOWS }}