copy the build_scripts from pypa/manylinux2010@1a89865

Author: antocuni

docker/build_scripts/build.sh

@@ -0,0 +1,218 @@
+#!/bin/bash
+# Top-level build script called from Dockerfile
+
+# Stop at any error, show all commands
+set -ex
+
+# Set build environment variables
+MY_DIR=$(dirname "${BASH_SOURCE[0]}")
+. $MY_DIR/build_env.sh
+
+# Dependencies for compiling Python that we want to remove from
+# the final image after compiling Python
+PYTHON_COMPILE_DEPS="zlib-devel bzip2-devel expat-devel ncurses-devel sqlite-devel readline-devel tk-devel gdbm-devel db4-devel libpcap-devel xz-devel"
+
+# Libraries that are allowed as part of the manylinux2010 profile
+# Extract from PEP: https://www.python.org/dev/peps/pep-0571/#the-manylinux2010-policy
+# On RPM-based systems, they are provided by these packages:
+# Package:    Libraries
+# glib2:      libglib-2.0.so.0, libgthread-2.0.so.0, libgobject-2.0.so.0
+# glibc:      libresolv.so.2, libutil.so.1, libnsl.so.1, librt.so.1, libcrypt.so.1, libpthread.so.0, libdl.so.2, libm.so.6, libc.so.6
+# libICE:     libICE.so.6
+# libX11:     libX11.so.6
+# libXext:    libXext.so.6
+# libXrender: libXrender.so.1
+# libgcc:     libgcc_s.so.1
+# libstdc++:  libstdc++.so.6
+# mesa:       libGL.so.1
+#
+# PEP is missing the package for libSM.so.6 for RPM based system
+# Install development packages (except for libgcc which is provided by gcc install)
+MANYLINUX2010_DEPS="glibc-devel libstdc++-devel glib2-devel libX11-devel libXext-devel libXrender-devel mesa-libGL-devel libICE-devel libSM-devel"
+
+# Get build utilities
+source $MY_DIR/build_utils.sh
+
+# See https://unix.stackexchange.com/questions/41784/can-yum-express-a-preference-for-x86-64-over-i386-packages
+echo "multilib_policy=best" >> /etc/yum.conf
+
+# https://hub.docker.com/_/centos/
+# "Additionally, images with minor version tags that correspond to install
+# media are also offered. These images DO NOT recieve updates as they are
+# intended to match installation iso contents. If you choose to use these
+# images it is highly recommended that you include RUN yum -y update && yum
+# clean all in your Dockerfile, or otherwise address any potential security
+# concerns."
+# Decided not to clean at this point: https://github.com/pypa/manylinux/pull/129
+yum -y update
+
+# Software collection (for devtoolset-8) and EPEL support (for cmake28 & yasm)
+yum -y install centos-release-scl https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
+
+# Development tools and libraries
+yum -y install \
+    automake \
+    bison \
+    bzip2 \
+    cmake28 \
+    devtoolset-8-binutils \
+    devtoolset-8-gcc \
+    devtoolset-8-gcc-c++ \
+    devtoolset-8-gcc-gfortran \
+    diffutils \
+    gettext \
+    file \
+    kernel-devel-`uname -r` \
+    libffi-devel \
+    make \
+    patch \
+    perl-devel \
+    unzip \
+    which \
+    yasm \
+    ${PYTHON_COMPILE_DEPS}
+
+# Build an OpenSSL for both curl and the Pythons. We'll delete this at the end.
+build_openssl $OPENSSL_ROOT $OPENSSL_HASH
+
+# Install curl so we can have TLS 1.2 in this ancient container.
+build_curl $CURL_ROOT $CURL_HASH
+hash -r
+curl --version
+curl-config --features
+
+# Install a git we link against OpenSSL so that we can use TLS 1.2
+build_git $GIT_ROOT $GIT_HASH
+git version
+
+# Install newest autoconf
+build_autoconf $AUTOCONF_ROOT $AUTOCONF_HASH
+autoconf --version
+
+# Install newest automake
+build_automake $AUTOMAKE_ROOT $AUTOMAKE_HASH
+automake --version
+
+# Install newest libtool
+build_libtool $LIBTOOL_ROOT $LIBTOOL_HASH
+libtool --version
+
+# Install a more recent SQLite3
+curl -fsSLO $SQLITE_AUTOCONF_DOWNLOAD_URL/$SQLITE_AUTOCONF_VERSION.tar.gz
+check_sha256sum $SQLITE_AUTOCONF_VERSION.tar.gz $SQLITE_AUTOCONF_HASH
+tar xfz $SQLITE_AUTOCONF_VERSION.tar.gz
+cd $SQLITE_AUTOCONF_VERSION
+do_standard_install
+cd ..
+rm -rf $SQLITE_AUTOCONF_VERSION*
+
+# Compile the latest Python releases.
+# (In order to have a proper SSL module, Python is compiled
+# against a recent openssl [see env vars above], which is linked
+# statically.
+mkdir -p /opt/python
+build_cpythons $CPYTHON_VERSIONS
+
+PY36_BIN=/opt/python/cp36-cp36m/bin
+
+# Install certifi and auditwheel
+$PY36_BIN/pip install --require-hashes -r $MY_DIR/py36-requirements.txt
+
+# Our openssl doesn't know how to find the system CA trust store
+#   (https://github.com/pypa/manylinux/issues/53)
+# And it's not clear how up-to-date that is anyway
+# So let's just use the same one pip and everyone uses
+ln -s $($PY36_BIN/python -c 'import certifi; print(certifi.where())') \
+      /opt/_internal/certs.pem
+# If you modify this line you also have to modify the versions in the
+# Dockerfiles:
+export SSL_CERT_FILE=/opt/_internal/certs.pem
+
+# Now we can delete our built OpenSSL headers/static libs since we've linked everything we need
+rm -rf /usr/local/ssl
+
+# Install patchelf (latest with unreleased bug fixes)
+curl -fsSL -o patchelf.tar.gz https://github.com/NixOS/patchelf/archive/$PATCHELF_VERSION.tar.gz
+check_sha256sum patchelf.tar.gz $PATCHELF_HASH
+tar -xzf patchelf.tar.gz
+(cd patchelf-$PATCHELF_VERSION && ./bootstrap.sh && do_standard_install)
+rm -rf patchelf.tar.gz patchelf-$PATCHELF_VERSION
+
+ln -s $PY36_BIN/auditwheel /usr/local/bin/auditwheel
+
+# HACK: The newly compiled and installed curl messes with the system's
+# py2.6 installation, on which yum depends.  Work around it by
+# rewiring libcurl.so specifically for yum.  /usr/local/bin/ has higher
+# priority on the PATH than /usr/bin/
+cat <<'EOF' > /usr/local/bin/yum && chmod +x /usr/local/bin/yum
+#!/bin/bash
+if [ "x$(arch)" != xi686 ]; then
+  LD_PRELOAD=/usr/lib64/libcurl.so.4
+else
+  LD_PRELOAD=/usr/lib/libcurl.so.4
+fi
+export LD_PRELOAD
+/usr/bin/yum "$@"
+EOF
+# the above might not shadow the real yum just yet, so call hash to be
+# sure:
+type yum
+hash yum
+
+
+# Clean up development headers and other unnecessary stuff for
+# final image
+yum -y erase \
+    avahi \
+    bitstream-vera-fonts \
+    freetype \
+    gettext \
+    gtk2 \
+    hicolor-icon-theme \
+    libX11 \
+    wireless-tools \
+    ${PYTHON_COMPILE_DEPS} > /dev/null 2>&1
+yum -y install ${MANYLINUX2010_DEPS}
+yum -y clean all > /dev/null 2>&1
+yum list installed
+
+# we don't need libpython*.a, and they're many megabytes
+find /opt/_internal -name '*.a' -print0 | xargs -0 rm -f
+
+# Strip what we can -- and ignore errors, because this just attempts to strip
+# *everything*, including non-ELF files:
+find /opt/_internal -type f -print0 \
+    | xargs -0 -n1 strip --strip-unneeded 2>/dev/null || true
+find /usr/local -type f -print0 \
+    | xargs -0 -n1 strip --strip-unneeded 2>/dev/null || true
+
+for PYTHON in /opt/python/*/bin/python; do
+    # Smoke test to make sure that our Pythons work, and do indeed detect as
+    # being manylinux compatible:
+    $PYTHON $MY_DIR/manylinux-check.py
+    # Make sure that SSL cert checking works
+    $PYTHON $MY_DIR/ssl-check.py
+done
+
+# We do not need the Python test suites, or indeed the precompiled .pyc and
+# .pyo files. Partially cribbed from:
+#    https://github.com/docker-library/python/blob/master/3.4/slim/Dockerfile
+find /opt/_internal -depth \
+     \( -type d -a -name test -o -name tests \) \
+  -o \( -type f -a -name '*.pyc' -o -name '*.pyo' \) | xargs rm -rf
+
+# Fix libc headers to remain compatible with C99 compilers.
+find /usr/include/ -type f -exec sed -i 's/\bextern _*inline_*\b/extern __inline __attribute__ ((__gnu_inline__))/g' {} +
+
+# remove useless things that have been installed by devtoolset-8
+rm -rf /opt/rh/devtoolset-8/root/usr/share/man
+find /opt/rh/devtoolset-8/root/usr/share/locale -mindepth 1 -maxdepth 1 -not \( -name 'en*' -or -name 'locale.alias' \) | xargs rm -rf
+rm -rf /usr/share/backgrounds
+# if we updated glibc, we need to strip locales again...
+localedef --list-archive | grep -v -i ^en_US.utf8 | xargs localedef --delete-from-archive
+mv -f /usr/lib/locale/locale-archive /usr/lib/locale/locale-archive.tmpl
+build-locale-archive
+find /usr/share/locale -mindepth 1 -maxdepth 1 -not \( -name 'en*' -or -name 'locale.alias' \) | xargs rm -rf
+find /usr/local/share/locale -mindepth 1 -maxdepth 1 -not \( -name 'en*' -or -name 'locale.alias' \) | xargs rm -rf
+rm -rf /usr/local/share/man
+

docker/build_scripts/build_env.sh

@@ -0,0 +1,39 @@
+# source me
+
+PYTHON_DOWNLOAD_URL=https://www.python.org/ftp/python
+CPYTHON_VERSIONS="2.7.16 3.4.10 3.5.7 3.6.8 3.7.3"
+
+# openssl version to build, with expected sha256 hash of .tar.gz
+# archive.
+OPENSSL_ROOT=openssl-1.0.2r
+OPENSSL_HASH=ae51d08bba8a83958e894946f15303ff894d75c2b8bbd44a852b64e3fe11d0d6
+OPENSSL_DOWNLOAD_URL=https://www.openssl.org/source
+
+PATCHELF_VERSION=0.10
+PATCHELF_HASH=b3cb6bdedcef5607ce34a350cf0b182eb979f8f7bc31eae55a93a70a3f020d13
+
+CURL_ROOT=curl-7.64.1
+CURL_HASH=432d3f466644b9416bc5b649d344116a753aeaa520c8beaf024a90cba9d3d35d
+CURL_DOWNLOAD_URL=https://curl.haxx.se/download
+
+AUTOCONF_ROOT=autoconf-2.69
+AUTOCONF_HASH=954bd69b391edc12d6a4a51a2dd1476543da5c6bbf05a95b59dc0dd6fd4c2969
+AUTOCONF_DOWNLOAD_URL=http://ftp.gnu.org/gnu/autoconf
+AUTOMAKE_ROOT=automake-1.16.1
+AUTOMAKE_HASH=608a97523f97db32f1f5d5615c98ca69326ced2054c9f82e65bade7fc4c9dea8
+AUTOMAKE_DOWNLOAD_URL=http://ftp.gnu.org/gnu/automake
+LIBTOOL_ROOT=libtool-2.4.6
+LIBTOOL_HASH=e3bd4d5d3d025a36c21dd6af7ea818a2afcd4dfc1ea5a17b39d7854bcd0c06e3
+LIBTOOL_DOWNLOAD_URL=http://ftp.gnu.org/gnu/libtool
+
+SQLITE_AUTOCONF_VERSION=sqlite-autoconf-3270200
+SQLITE_AUTOCONF_HASH=50c39e85ea28b5ecfdb3f9e860afe9ba606381e21836b2849efca6a0bfe6ef6e
+SQLITE_AUTOCONF_DOWNLOAD_URL=https://www.sqlite.org/2019
+
+GIT_ROOT=2.21.0
+GIT_HASH=7a601275abcc6ff51cc79a6d402e83c90ae37d743b0b8d073aa009dd4b22d432
+GIT_DOWNLOAD_URL=https://github.com/git/git/archive
+
+GET_PIP_URL=https://bootstrap.pypa.io/get-pip.py
+EPEL_RPM_HASH=e5ed9ecf22d0c4279e92075a64c757ad2b38049bcf5c16c4f2b75d5f6860dc0d
+DEVTOOLS_HASH=a8ebeb4bed624700f727179e6ef771dafe47651131a00a78b342251415646acc