@ai-ecoverse/wasix-python 3.14.2-10 → 3.14.2-12

package/README.md

@@ -4,19 +4,41 @@ CPython 3.14 for slicc WASIX (`commands` `python` / `python3`).
 
 ## Features
 
-- PIE dynamic-main (`dylink.0`), SOABI `cpython-314-wasm32-wasix`
+- PIE dynamic-main (`dylink.0`) on wasix-sysroot 2025.9.30-18's `sysroot-ehpic` (legacy wasm EH), SOABI `cpython-314-wasm32-wasix`; native side modules (py-numpy, py-scipy, py-pandas, …) load by `dlopen`
+- **File modes** (3.14.2-12, on slicc-kernel ≥ 1.35.1; older kernels keep the no-op modes): `os.umask`, `open()`/`os.mkdir` create modes, `os.chmod`, `tempfile.mkstemp` 600 / `mkdtemp` 700, pip console scripts 755
+- Built in: `ssl`/`hashlib` (OpenSSL 3.5.9, `@ai-ecoverse/wasix-openssl`), `zlib` 1.3.1, `bz2`, `lzma` (xz 5.8.4), `sqlite3` (3.53.4; FTS5, JSON, math, R*Tree; no WAL, no extensions), `readline` 8.3 (ncurses 6.5 terminfo compiled in: xterm, screen, tmux, vt100, linux), `mmap`, `fcntl`, `termios`, `resource`, `pwd`, `grp`, `select`
 - No `fork`/`vfork`; `subprocess` via `os.posix_spawn` (`proc_spawn2`/`3`)
-- `mmap` builtin via `-D_WASI_EMULATED_MMAN` + `-lwasi-emulated-mman` (mmap/munmap/msync; no madvise/mprotect)
-- Bundled `pip` (ensurepip wheel) + `tomllib` / `xmlrpc` for pip’s import graph
-- `zlib` for `gzip` (dateutil zoneinfo, etc.)
-- static `_bz2` / `_lzma`, `sqlite3`, `readline` (+ termcap shim)
-- `pwd`/`grp`/`fcntl`/`termios`/`resource` builtins
-- `getuid`/`geteuid`/`getgid`/`getegid` → 1000 via `--wrap` stubs; passwd-less `pwd`/`grp` → user/1000/`/home/user`
-- Advisory file locks (`flock` / `fcntl` F_SETLK* / `lockf`) are no-ops in the SLICC realm (Emscripten parity).
+- `getuid`/`geteuid`/`getgid`/`getegid` → 1000; passwd-less `pwd`/`grp` → user/1000/`/home/user`
+- Advisory file locks (`flock`, `fcntl` F_SETLK*, `lockf`) are no-ops (Emscripten parity)
 - stdout is line-buffered unless it is a regular file, so output streams and survives crashes
-- 3.14.2-8 is identical to accepted 3.14.2-7 (npm phantom-staged -7 blocked republish; see npm/cli#9889).
-- PRESTAGE: `prestage-check.sh` blocks stage unless SOABI wasix + wrap-getuid=1000
-- wasix-libc `setitimer`/`alarm` patch: calls `proc_raise_interval2` with both `it_value` and `it_interval` (legacy `proc_raise_interval` untouched; see `patches/`)
+- `signal.alarm`/`setitimer` and `time.sleep` resuming after a signal (the sysroot's libc patches, `patches/`)
+- Bundled `pip` 25.3; `.pyc` are unchecked-hash
+- Not built: `ctypes` (no libffi for WASIX), `_uuid`, `curses`, `dbm`, `_zstd`, `tkinter`
+- `TZ` POSIX rules work (`EST5EDT,M3.2.0,M11.1.0`; wasix-sysroot -18, homescoop#193); `zoneinfo` works with the `tzdata` package
+
+Since 3.14.2-12 the package is cross-built from source in CI (`build.sh`); see `THIRD-PARTY-NOTICES.md` for the statically linked libraries.
+
+## Side modules: C++ runtime ABI
+
+Native extensions are `dylink.0` side modules that import the C++ runtime from
+`python.wasm`: `libc++`, `libc++abi` and `libunwind` of upstream wasix-libc
+**v2026-07-03.1** `sysroot-ehpic` (legacy wasm EH, PIC), which 3.14.2-11 used
+too. That ABI has:
+
+- `_Unwind_CallPersonality(void *)` and the personality `__gxx_personality_wasm0`;
+- a plain global `__wasm_lpad_context` (imported through `GOT.mem`);
+- `__cxa_thread_atexit`.
+
+Build C++ side modules against that runtime: wasixcc with
+`WASIXCC_WASM_EXCEPTIONS=legacy`, `WASIXCC_PIC=yes`, and that sysroot's
+`libc++` headers. wasix-sysroot ≥ 2025.9.30-14 rebuilt the runtimes from a
+newer LLVM. There, `__gxx_wasm_personality_v0(void *)` replaces
+`_Unwind_CallPersonality` and `__wasm_lpad_context` is `thread_local`, so a
+module built on them does not load into this `python.wasm`, and the reverse
+corrupts memory on the first C++ exception. `test/side-abi.mjs` checks every
+published py-* side module's imports against `python.wasm` at build. It fails
+if one is missing, or if a `GOT.mem` import resolves to `thread_local` data the
+side modules were not built for.
 
 ## Acceptance (Wasmer / SLICC)
 
@@ -28,27 +50,33 @@ PYTHONPATH=<dir>/lib/python3.14/site-packages python -c "import six"
 
 On plain Wasmer without `_ssl`, use a local wheel (`--no-index --find-links`) until openssl/`_ssl` is enabled.
 
-## Virtual environments (3.14.2-10)
+## Virtual environments (slicc-kernel ≥ 1.29.0)
 
 ```text
 python -m venv v && v/bin/pip install requests && v/bin/python -c "import requests"
 ```
 
-`lib/python3.14/sitecustomize.py` sets `sys.executable` from PATH (WASI
-`stat()` has no permission bits, so CPython cannot find itself), so
-`python -m venv` works. A `sitecustomize` of your own still runs.
+**Venvs need slicc-kernel ≥ 1.29.0** (`engines` says so). On older kernels a
+venv's `bin/python` and `bin/pip` run as the base interpreter: `v/bin/pip
+install` then installs into the **base** package directory, not the venv.
+
+CPython cannot find its own executable here (WASI `stat()` has no permission
+bits, so its PATH search never matches), so `_slicc_site.py` sets
+`sys.executable` from PATH. Two hooks run it:
+`site-packages/slicc-executable.pth` for the base interpreter (a
+`sitecustomize` of yours on `PYTHONPATH` cannot switch it off) and the stdlib
+`sitecustomize.py` for venvs without system site-packages. A `sitecustomize`
+of your own still runs after ours, and `import sitecustomize` returns yours.
 
-Whether a venv's own python sees the venv depends on the kernel:
+`python` and `python3` set `"argv0Path": true`, so slicc-kernel ≥ 1.29.0
+(#168) passes a venv's `bin/python` path as `argv[0]`; that is how CPython
+finds the venv's `pyvenv.cfg`:
 
-| | slicc-kernel < 1.29.0 | slicc-kernel ≥ 1.29.0 (#168) |
+| | slicc-kernel < 1.29.0 | slicc-kernel ≥ 1.29.0 |
 | --- | --- | --- |
-| `v/bin/python`, `v/bin/pip`, venv console scripts | run as the **base** interpreter (they install into, and import from, the base) | run **in the venv** |
-| `source v/bin/activate; python …` | base interpreter (`python` on PATH is a link to the command) | in the venv |
+| `v/bin/python`, `v/bin/pip`, venv console scripts | run as the **base** interpreter (install into, and import from, the base) | run **in the venv** |
+| `source v/bin/activate; python …` | base interpreter | in the venv |
 | `uv run …` ([`@ai-ecoverse/wasix-uv-shim`](https://www.npmjs.com/package/@ai-ecoverse/wasix-uv-shim)) | in the venv | in the venv |
 
-`python` and `python3` set `"argv0Path": true`, so a kernel with
-slicc-kernel#168 passes a venv's `bin/python` path as `argv[0]`; that is
-how CPython finds the venv's `pyvenv.cfg`. Until then,
-use `uv run` or set `PYTHONEXECUTABLE=$PWD/v/bin/python`.
-
-3.14.2-10 is 3.14.2-9's files plus `sitecustomize.py`.
+`sitecustomize.py`, `_slicc_site.py` and `site-packages/slicc-executable.pth`
+are the slicc additions (`stdlib/` in the recipe).

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,17 @@
+# Third-party notices: @ai-ecoverse/wasix-python
+
+bin/python.wasm statically links:
+
+| component | version | license | source |
+| --- | --- | --- | --- |
+| CPython (incl. mpdecimal, expat, HACL*) | 3.14.2 | PSF-2.0 (LICENSE) | python.org |
+| OpenSSL | 3.5.9 | Apache-2.0 | @ai-ecoverse/wasix-openssl |
+| zlib | 1.3.1 | Zlib | @ai-ecoverse/wasix-zlib |
+| bzip2 | 1.0.8 | bzip2-1.0.6 | sourceware.org/bzip2 |
+| xz (liblzma) | 5.8.4 | 0BSD | tukaani.org/xz |
+| SQLite | 3.53.4 | public domain | sqlite.org |
+| GNU Readline | 8.3 | GPL-3.0-or-later | gnu.org/software/readline |
+| ncurses (tinfo) | 6.5 | X11 | invisible-island.net/ncurses |
+| wasix-libc | wasix-sysroot 2025.9.30-17 | Apache-2.0 WITH LLVM-exception, MIT | @ai-ecoverse/wasix-sysroot |
+
+lib/python3.14/site-packages/pip is pip (MIT), from CPython's ensurepip bundle.

package/include/python3.14/pyconfig.h

@@ -397,7 +397,7 @@
 /* #undef HAVE_FFI_PREP_CLOSURE_LOC */
 
 /* Define to 1 if you have the 'flock' function. */
-/* #undef HAVE_FLOCK */
+#define HAVE_FLOCK 1
 
 /* Define to 1 if you have the 'fork' function. */
 /* #undef HAVE_FORK */
@@ -705,7 +705,7 @@
 /* #undef HAVE_LIBSENDFILE */
 
 /* Define to 1 if you have the 'sqlite3' library (-lsqlite3). */
-/* #undef HAVE_LIBSQLITE3 */
+#define HAVE_LIBSQLITE3 1
 
 /* Define to 1 if you have the <libutil.h> header file. */
 /* #undef HAVE_LIBUTIL_H */
@@ -897,6 +897,7 @@
 /* #undef HAVE_NETLINK_NETLINK_H */
 
 /* Define to 1 if you have the <netpacket/packet.h> header file. */
+/* #undef HAVE_NETPACKET_PACKET_H */
 
 /* Define to 1 if you have the <net/ethernet.h> header file. */
 /* #undef HAVE_NET_ETHERNET_H */
@@ -1073,31 +1074,31 @@
 #define HAVE_RENAMEAT 1
 
 /* Define if readline supports append_history */
-/* #undef HAVE_RL_APPEND_HISTORY */
+#define HAVE_RL_APPEND_HISTORY 1
 
 /* Define if you can turn off readline's signal handling. */
-/* #undef HAVE_RL_CATCH_SIGNAL */
+#define HAVE_RL_CATCH_SIGNAL 1
 
 /* Define to 1 if the system has the type 'rl_compdisp_func_t'. */
-/* #undef HAVE_RL_COMPDISP_FUNC_T */
+#define HAVE_RL_COMPDISP_FUNC_T 1
 
 /* Define if you have readline 2.2 */
-/* #undef HAVE_RL_COMPLETION_APPEND_CHARACTER */
+#define HAVE_RL_COMPLETION_APPEND_CHARACTER 1
 
 /* Define if you have readline 4.0 */
-/* #undef HAVE_RL_COMPLETION_DISPLAY_MATCHES_HOOK */
+#define HAVE_RL_COMPLETION_DISPLAY_MATCHES_HOOK 1
 
 /* Define if you have readline 4.2 */
-/* #undef HAVE_RL_COMPLETION_MATCHES */
+#define HAVE_RL_COMPLETION_MATCHES 1
 
 /* Define if you have rl_completion_suppress_append */
-/* #undef HAVE_RL_COMPLETION_SUPPRESS_APPEND */
+#define HAVE_RL_COMPLETION_SUPPRESS_APPEND 1
 
 /* Define if you have readline 4.0 */
-/* #undef HAVE_RL_PRE_INPUT_HOOK */
+#define HAVE_RL_PRE_INPUT_HOOK 1
 
 /* Define if you have readline 4.0 */
-/* #undef HAVE_RL_RESIZE_TERMINAL */
+#define HAVE_RL_RESIZE_TERMINAL 1
 
 /* Define to 1 if you have the 'rtpSpawn' function. */
 /* #undef HAVE_RTPSPAWN */
@@ -1644,7 +1645,7 @@
 /* #undef HAVE_ZDICT_H */
 
 /* Define if the zlib library has inflateCopy */
-/* #undef HAVE_ZLIB_COPY */
+#define HAVE_ZLIB_COPY 1
 
 /* Define to 1 if you have the <zlib.h> header file. */
 /* #undef HAVE_ZLIB_H */
@@ -1712,7 +1713,7 @@
 /* #undef PY_SQLITE_ENABLE_LOAD_EXTENSION */
 
 /* Define if SQLite was compiled with the serialize API */
-/* #undef PY_SQLITE_HAVE_SERIALIZE */
+#define PY_SQLITE_HAVE_SERIALIZE 1
 
 /* Default cipher suites list for ssl module. 1: Python's preferred selection,
    2: leave OpenSSL defaults untouched, 0: custom string */

package/lib/libpython3.14.a

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/lib/libpython3.14.a
-size: 53691898 bytes
-sha256: ec304dad359bb354d5fc8381955aec71db34671dcf257997382f6a0e9c23ca29
+size: 58006786 bytes
+sha256: 48ecf7dfea703722c3a7bcfc9e31139473708ff88e902ace1ac971238a5f6097

package/lib/pkgconfig/python-3.14-embed.pc

@@ -1,5 +1,5 @@
 # See: man pkg-config
-prefix=/tmp/wasix-python-prefix-ehpic
+prefix=/tmp/homescoop-wasix-python/prefix
 exec_prefix=${prefix}
 libdir=${exec_prefix}/lib
 includedir=${prefix}/include
@@ -8,6 +8,6 @@ Name: Python
 Description: Embed Python into an application
 Requires:
 Version: 3.14
-Libs.private: -ldl -ldl -lwasi-emulated-getpid -lwasi-emulated-process-clocks -lwasi-emulated-mman -lwasi-emulated-getpid -lwasi-emulated-process-clocks -lpthread
+Libs.private: -ldl /tmp/homescoop-wasix-python/stubs/libpython-wasix-stubs.a -Wl,--wrap=getuid -Wl,--wrap=geteuid -Wl,--wrap=getgid -Wl,--wrap=getegid -Wl,--wrap=getpwuid -Wl,--wrap=getpwnam -Wl,--wrap=getpwuid_r -Wl,--wrap=getpwnam_r -Wl,--wrap=getgrgid -Wl,--wrap=getgrnam -Wl,--wrap=getgrgid_r -Wl,--wrap=getgrnam_r -Wl,--wrap=flock -Wl,--wrap=fcntl -Wl,--wrap=lockf -Wl,--export=__wrap_getuid -Wl,--export=__wrap_geteuid -Wl,--export=__wrap_getgid -Wl,--export=__wrap_getegid -Wl,--export=__wrap_flock -Wl,--export=__wrap_fcntl -Wl,--export=__wrap_lockf -lwasi-emulated-getpid -lwasi-emulated-process-clocks -lpthread
 Libs: -L${libdir} -lpython3.14
 Cflags: -I${includedir}/python3.14

package/lib/pkgconfig/python-3.14.pc

@@ -1,5 +1,5 @@
 # See: man pkg-config
-prefix=/tmp/wasix-python-prefix-ehpic
+prefix=/tmp/homescoop-wasix-python/prefix
 exec_prefix=${prefix}
 libdir=${exec_prefix}/lib
 includedir=${prefix}/include
@@ -8,6 +8,6 @@ Name: Python
 Description: Build a C extension for Python
 Requires:
 Version: 3.14
-Libs.private: -ldl -ldl -lwasi-emulated-getpid -lwasi-emulated-process-clocks -lwasi-emulated-mman -lwasi-emulated-getpid -lwasi-emulated-process-clocks -lpthread
+Libs.private: -ldl /tmp/homescoop-wasix-python/stubs/libpython-wasix-stubs.a -Wl,--wrap=getuid -Wl,--wrap=geteuid -Wl,--wrap=getgid -Wl,--wrap=getegid -Wl,--wrap=getpwuid -Wl,--wrap=getpwnam -Wl,--wrap=getpwuid_r -Wl,--wrap=getpwnam_r -Wl,--wrap=getgrgid -Wl,--wrap=getgrnam -Wl,--wrap=getgrgid_r -Wl,--wrap=getgrnam_r -Wl,--wrap=flock -Wl,--wrap=fcntl -Wl,--wrap=lockf -Wl,--export=__wrap_getuid -Wl,--export=__wrap_geteuid -Wl,--export=__wrap_getgid -Wl,--export=__wrap_getegid -Wl,--export=__wrap_flock -Wl,--export=__wrap_fcntl -Wl,--export=__wrap_lockf -lwasi-emulated-getpid -lwasi-emulated-process-clocks -lpthread
 Libs: -L${libdir} 
 Cflags: -I${includedir}/python3.14