cibuildmp 0.7.2__tar.gz → 0.7.3__tar.gz

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/.github/workflows/probe-overlay.yml

@@ -62,7 +62,7 @@ jobs:
           - runner: ubuntu-24.04-arm
             image: quay.io/pypa/manylinux_2_28_aarch64@sha256:45ea412cfbd2cc5e51323cecab614ea8e4e5522b4d4f668946c54056b40152f6
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Docker and kernel facts
         run: |

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.3] - 2026-09-10
+
+### Changed
+
+- **The two toolchain pins [0046]'s weekly checker reported behind are moved**:
+  llvm-mingw `20260616` -> `20260908` (`docker/windows.Dockerfile`) and emsdk
+  `6.0.8`/`9d70dbe8` -> `6.0.9`/`f04ea239` (`docker/webassembly.Dockerfile`).
+  Both sha256s recomputed from the real tarball, and each one's internal layout
+  re-checked with `tar tJf` rather than carried over from the previous version:
+  llvm-mingw still unpacks to a single top-level directory (what
+  `--strip-components=1` assumes) and still ships all four
+  `<arch>-w64-mingw32-` bin/ prefixes `build_windows.py` drives; the emsdk
+  tarball still has the `install/emscripten` + `install/bin` shape the image's
+  own `ENV PATH` points at. `bin/update_toolchains.py --check` now reports
+  every pin current. Nothing about the emsdk bump touches
+  `[usermod.webassembly]`, which deliberately records no emsdk version at all
+  ([0092]) -- MicroPython's own `tools/ci.sh` has never pinned one.
+- **Both bumped `RUN` steps stopped claiming to track a deleted file.** Each
+  said it was "pinned to `resources/usermod.toml`'s own `[llvm-mingw]`/`[emsdk]`
+  table -- keep the URL and sha256 in step with it", directly contradicting the
+  "**This file is the pin of record**" paragraph a few lines above it in the
+  same file: [0092] deleted `resources/usermod.toml`, and `usermod/llvmmingw.py`
+  / `usermod/emsdk.py` went with the bare-host resolvers ([0050]/[0042]). The
+  webassembly one also cited `open-questions.md`'s "nothing checks whether a
+  pinned version is stale" note, which [0046] and `pin-staleness.yml` made false
+  -- that checker is precisely what found both of these.
+
+
 ## [0.7.2] - 2026-09-06
 
 ### Added
@@ -1669,7 +1697,8 @@ ballistics-lab/micropython-native-ci, but both tags exist here too, so every
 link resolves inside this repository -- the version line continues rather
 than restarting (see the 0.3.0a1 entry). -->
 
-[Unreleased]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.2...HEAD
+[Unreleased]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.3...HEAD
+[0.7.3]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.2...v0.7.3
 [0.7.2]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.1...v0.7.2
 [0.7.1]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/ballistics-lab/cibuildmp/compare/v0.6.2...v0.7.0
@@ -1708,3 +1737,7 @@ than restarting (see the 0.3.0a1 entry). -->
 [0053]: docs/records/0053-usermod-ports-without-a-build-driver.md
 [0060]: docs/records/0060-rp2-build-driver.md
 [0100]: docs/records/0100-samd-build-driver-plan.md
+[0046]: docs/records/0046-pin-staleness-checker.md
+[0092]: docs/records/0092-usermod-toml-and-tag-cflags-against-build-platforms.md
+[0050]: docs/records/0050-natmod-is-docker-only.md
+[0042]: docs/records/0042-windows-docker-wiring-and-resolver-removal.md

{cibuildmp-0.7.2/src/cibuildmp.egg-info → cibuildmp-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cibuildmp
-Version: 0.7.2
+Version: 0.7.3
 Summary: Build MicroPython native C extensions for every target, from one config — cibuildwheel for MicroPython
 Author-email: o-murphy <thehelixpg@gmail.com>
 License-Expression: MIT
@@ -157,7 +157,7 @@ On CI, use the action instead of installing the CLI yourself — it already
 runs on a bare runner with the runner's own Docker daemon reachable:
 
 ```yaml
-- uses: ballistics-lab/cibuildmp@v0.7.2
+- uses: ballistics-lab/cibuildmp@v0.7.3
   with:
     build: "mpy6.3-* v1.29.0-manylinux_2_28_x86_64"
 ```
@@ -176,7 +176,7 @@ newest:
     path: ~/.cache/cibuildmp
     key: cibuildmp-${{ runner.os }}
     restore-keys: cibuildmp-${{ runner.os }}
-- uses: ballistics-lab/cibuildmp@v0.7.2
+- uses: ballistics-lab/cibuildmp@v0.7.3
   with:
     build: "mpy6.3-* v1.29.0-manylinux_2_28_x86_64"
 ```
@@ -235,7 +235,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ballistics-lab/cibuildmp@v0.7.2
+      - uses: ballistics-lab/cibuildmp@v0.7.3
         with:
           build: "mpy6.3-v1.29.0-*"
       - uses: actions/upload-artifact@v4
@@ -489,16 +489,16 @@ platform.**
 Identifier shapes, one per platform:
 
 <!-- generated: identifier-shapes -- bin/refresh_docs.py, do not edit by hand -->
-| Platform | Shape | Example |
-| --- | --- | --- |
-| natmod | `mpy{abi}-{tag}-{arch}` | `mpy6.3-v1.29.0-armv6m` |
-| usermod `esp32` | `{tag}-esp32-{board}` | `v1.29.0-esp32-ARDUINO_NANO_ESP32` |
-| usermod `qemu` | `{tag}-qemu-{board}` | `v1.29.0-qemu-MICROBIT` |
-| usermod `rp2` | `{tag}-rp2-{board}` | `v1.29.0-rp2-ADAFRUIT_FEATHER_RP2040` |
-| usermod `samd` | `{tag}-samd-{board}` | `v1.29.0-samd-ADAFRUIT_FEATHER_M0_EXPRESS` |
-| usermod `unix` | `{tag}-{arch}` | `v1.29.0-manylinux_2_28_aarch64` |
-| usermod `webassembly` | `{tag}-{arch}` | `v1.29.0-wasm32` |
-| usermod `windows` | `{tag}-{arch}` | `v1.29.0-win32` |
+| Platform              | Shape                   | Example                                    |
+| --------------------- | ----------------------- | ------------------------------------------ |
+| natmod                | `mpy{abi}-{tag}-{arch}` | `mpy6.3-v1.29.0-armv6m`                    |
+| usermod `esp32`       | `{tag}-esp32-{board}`   | `v1.29.0-esp32-ARDUINO_NANO_ESP32`         |
+| usermod `qemu`        | `{tag}-qemu-{board}`    | `v1.29.0-qemu-MICROBIT`                    |
+| usermod `rp2`         | `{tag}-rp2-{board}`     | `v1.29.0-rp2-ADAFRUIT_FEATHER_RP2040`      |
+| usermod `samd`        | `{tag}-samd-{board}`    | `v1.29.0-samd-ADAFRUIT_FEATHER_M0_EXPRESS` |
+| usermod `unix`        | `{tag}-{arch}`          | `v1.29.0-manylinux_2_28_aarch64`           |
+| usermod `webassembly` | `{tag}-{arch}`          | `v1.29.0-wasm32`                           |
+| usermod `windows`     | `{tag}-{arch}`          | `v1.29.0-win32`                            |
 <!-- /generated: identifier-shapes -->
 
 The shape genuinely differs per usermod port — `unix`/`windows`/
@@ -786,16 +786,16 @@ the port**, because it is that port's own build axis:
 | `esp32`, `rp2`, `webassembly` | *none*           | `CIBMP_WEBASSEMBLY_DOCKER_IMAGE`                |
 
 
-| Variable                                | Effect                                                                                                                                                                                                                            |
-| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Variable                                | Effect                                                                                                                                                                                                                           |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `CIBMP_CACHE_PATH`                      | Where fetched MicroPython checkouts and ESP-IDF are cached. Defaults to `$XDG_CACHE_HOME/cibuildmp`, or `~/.cache/cibuildmp`. Pin it in CI when a later step needs the checkout by path — `<CIBMP_CACHE_PATH>/micropython/<tag>` |
-| `CIBMP_REPORT_PATH`                     | Where the JSON build report is written                                                                                                                                                                                            |
-| `CIBMP_TIMEOUT`                         | Seconds before a build container is killed (`docker kill`, not just the CLI). No limit by default. **usermod only** -- natmod's own container call does not consult it                                                            |
-| `CIBMP_<PORT>_<TARGET>_TIMEOUT`         | The same, for one container — `CIBMP_UNIX_MANYLINUX_2_28_X86_64_TIMEOUT`                                                                                                                                                          |
-| `CIBMP_<PORT>_<TARGET>_DOCKER_IMAGE`    | Run this (port, target) in a different image — a locally built one, or a fork's. Wins over the pinned default. Omit the `<TARGET>` segment for a port with no per-build image axis (`CIBMP_WEBASSEMBLY_DOCKER_IMAGE`)             |
-| `CIBMP_<PORT>_<TARGET>_DOCKER_PLATFORM` | Same shape, for the container's `--platform`                                                                                                                                                                                      |
-| `CIBMP_DEBUG_TRACEBACK`                 | Print a full traceback instead of a one-line error (same as `--debug-traceback`)                                                                                                                                                  |
-| `CIBMP_DISABLE_GITHUB_STEP_SUMMARY`     | Suppress the step-summary table on GitHub Actions                                                                                                                                                                                 |
+| `CIBMP_REPORT_PATH`                     | Where the JSON build report is written                                                                                                                                                                                           |
+| `CIBMP_TIMEOUT`                         | Seconds before a build container is killed (`docker kill`, not just the CLI). No limit by default. **usermod only** -- natmod's own container call does not consult it                                                           |
+| `CIBMP_<PORT>_<TARGET>_TIMEOUT`         | The same, for one container — `CIBMP_UNIX_MANYLINUX_2_28_X86_64_TIMEOUT`                                                                                                                                                         |
+| `CIBMP_<PORT>_<TARGET>_DOCKER_IMAGE`    | Run this (port, target) in a different image — a locally built one, or a fork's. Wins over the pinned default. Omit the `<TARGET>` segment for a port with no per-build image axis (`CIBMP_WEBASSEMBLY_DOCKER_IMAGE`)            |
+| `CIBMP_<PORT>_<TARGET>_DOCKER_PLATFORM` | Same shape, for the container's `--platform`                                                                                                                                                                                     |
+| `CIBMP_DEBUG_TRACEBACK`                 | Print a full traceback instead of a one-line error (same as `--debug-traceback`)                                                                                                                                                 |
+| `CIBMP_DISABLE_GITHUB_STEP_SUMMARY`     | Suppress the step-summary table on GitHub Actions                                                                                                                                                                                |
 
 ### Precedence
 
@@ -1268,7 +1268,7 @@ scheduled `test-all-platforms.yml` run since.
 <tr>
   <td><code>esp32</code></td>
   <td>
-    every board across <code>v1.28.0</code>/<code>v1.29.0</code>[^esp32ci]
+    every board across <code>v1.29.0</code>/<code>v1.29.0</code>[^esp32ci]
   </td>
   <td><code>esp_idf_base</code> (Docker) -- ESP-IDF cloned on the host, installed in-container, per-board <code>idf_target</code>/<code>idf_version</code></td>
   <td>✅</td>
@@ -1407,7 +1407,7 @@ quietly mislabelled `.mpy` when they do not.
 
 **No `dynruntime.mk` default covers either axis fully**, which this
 paragraph did not used to say: `BUILD` defaulted to an unscoped `build` up
-to v1.28.0 and to `build-$(ARCH)` from v1.29.0 — arch-scoped from that tag
+to v1.29.0 and to `build-$(ARCH)` from v1.29.0 — arch-scoped from that tag
 on, tag-scoped in no release at all, since `MPY_DIR` is the only thing that
 knows which release is being built. So on v1.29.0 and later the arch
 collision cannot happen by default; the tag one still can, and only your

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/README.md

@@ -125,7 +125,7 @@ On CI, use the action instead of installing the CLI yourself — it already
 runs on a bare runner with the runner's own Docker daemon reachable:
 
 ```yaml
-- uses: ballistics-lab/cibuildmp@v0.7.2
+- uses: ballistics-lab/cibuildmp@v0.7.3
   with:
     build: "mpy6.3-* v1.29.0-manylinux_2_28_x86_64"
 ```
@@ -144,7 +144,7 @@ newest:
     path: ~/.cache/cibuildmp
     key: cibuildmp-${{ runner.os }}
     restore-keys: cibuildmp-${{ runner.os }}
-- uses: ballistics-lab/cibuildmp@v0.7.2
+- uses: ballistics-lab/cibuildmp@v0.7.3
   with:
     build: "mpy6.3-* v1.29.0-manylinux_2_28_x86_64"
 ```
@@ -203,7 +203,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ballistics-lab/cibuildmp@v0.7.2
+      - uses: ballistics-lab/cibuildmp@v0.7.3
         with:
           build: "mpy6.3-v1.29.0-*"
       - uses: actions/upload-artifact@v4
@@ -457,16 +457,16 @@ platform.**
 Identifier shapes, one per platform:
 
 <!-- generated: identifier-shapes -- bin/refresh_docs.py, do not edit by hand -->
-| Platform | Shape | Example |
-| --- | --- | --- |
-| natmod | `mpy{abi}-{tag}-{arch}` | `mpy6.3-v1.29.0-armv6m` |
-| usermod `esp32` | `{tag}-esp32-{board}` | `v1.29.0-esp32-ARDUINO_NANO_ESP32` |
-| usermod `qemu` | `{tag}-qemu-{board}` | `v1.29.0-qemu-MICROBIT` |
-| usermod `rp2` | `{tag}-rp2-{board}` | `v1.29.0-rp2-ADAFRUIT_FEATHER_RP2040` |
-| usermod `samd` | `{tag}-samd-{board}` | `v1.29.0-samd-ADAFRUIT_FEATHER_M0_EXPRESS` |
-| usermod `unix` | `{tag}-{arch}` | `v1.29.0-manylinux_2_28_aarch64` |
-| usermod `webassembly` | `{tag}-{arch}` | `v1.29.0-wasm32` |
-| usermod `windows` | `{tag}-{arch}` | `v1.29.0-win32` |
+| Platform              | Shape                   | Example                                    |
+| --------------------- | ----------------------- | ------------------------------------------ |
+| natmod                | `mpy{abi}-{tag}-{arch}` | `mpy6.3-v1.29.0-armv6m`                    |
+| usermod `esp32`       | `{tag}-esp32-{board}`   | `v1.29.0-esp32-ARDUINO_NANO_ESP32`         |
+| usermod `qemu`        | `{tag}-qemu-{board}`    | `v1.29.0-qemu-MICROBIT`                    |
+| usermod `rp2`         | `{tag}-rp2-{board}`     | `v1.29.0-rp2-ADAFRUIT_FEATHER_RP2040`      |
+| usermod `samd`        | `{tag}-samd-{board}`    | `v1.29.0-samd-ADAFRUIT_FEATHER_M0_EXPRESS` |
+| usermod `unix`        | `{tag}-{arch}`          | `v1.29.0-manylinux_2_28_aarch64`           |
+| usermod `webassembly` | `{tag}-{arch}`          | `v1.29.0-wasm32`                           |
+| usermod `windows`     | `{tag}-{arch}`          | `v1.29.0-win32`                            |
 <!-- /generated: identifier-shapes -->
 
 The shape genuinely differs per usermod port — `unix`/`windows`/
@@ -754,16 +754,16 @@ the port**, because it is that port's own build axis:
 | `esp32`, `rp2`, `webassembly` | *none*           | `CIBMP_WEBASSEMBLY_DOCKER_IMAGE`                |
 
 
-| Variable                                | Effect                                                                                                                                                                                                                            |
-| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Variable                                | Effect                                                                                                                                                                                                                           |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `CIBMP_CACHE_PATH`                      | Where fetched MicroPython checkouts and ESP-IDF are cached. Defaults to `$XDG_CACHE_HOME/cibuildmp`, or `~/.cache/cibuildmp`. Pin it in CI when a later step needs the checkout by path — `<CIBMP_CACHE_PATH>/micropython/<tag>` |
-| `CIBMP_REPORT_PATH`                     | Where the JSON build report is written                                                                                                                                                                                            |
-| `CIBMP_TIMEOUT`                         | Seconds before a build container is killed (`docker kill`, not just the CLI). No limit by default. **usermod only** -- natmod's own container call does not consult it                                                            |
-| `CIBMP_<PORT>_<TARGET>_TIMEOUT`         | The same, for one container — `CIBMP_UNIX_MANYLINUX_2_28_X86_64_TIMEOUT`                                                                                                                                                          |
-| `CIBMP_<PORT>_<TARGET>_DOCKER_IMAGE`    | Run this (port, target) in a different image — a locally built one, or a fork's. Wins over the pinned default. Omit the `<TARGET>` segment for a port with no per-build image axis (`CIBMP_WEBASSEMBLY_DOCKER_IMAGE`)             |
-| `CIBMP_<PORT>_<TARGET>_DOCKER_PLATFORM` | Same shape, for the container's `--platform`                                                                                                                                                                                      |
-| `CIBMP_DEBUG_TRACEBACK`                 | Print a full traceback instead of a one-line error (same as `--debug-traceback`)                                                                                                                                                  |
-| `CIBMP_DISABLE_GITHUB_STEP_SUMMARY`     | Suppress the step-summary table on GitHub Actions                                                                                                                                                                                 |
+| `CIBMP_REPORT_PATH`                     | Where the JSON build report is written                                                                                                                                                                                           |
+| `CIBMP_TIMEOUT`                         | Seconds before a build container is killed (`docker kill`, not just the CLI). No limit by default. **usermod only** -- natmod's own container call does not consult it                                                           |
+| `CIBMP_<PORT>_<TARGET>_TIMEOUT`         | The same, for one container — `CIBMP_UNIX_MANYLINUX_2_28_X86_64_TIMEOUT`                                                                                                                                                         |
+| `CIBMP_<PORT>_<TARGET>_DOCKER_IMAGE`    | Run this (port, target) in a different image — a locally built one, or a fork's. Wins over the pinned default. Omit the `<TARGET>` segment for a port with no per-build image axis (`CIBMP_WEBASSEMBLY_DOCKER_IMAGE`)            |
+| `CIBMP_<PORT>_<TARGET>_DOCKER_PLATFORM` | Same shape, for the container's `--platform`                                                                                                                                                                                     |
+| `CIBMP_DEBUG_TRACEBACK`                 | Print a full traceback instead of a one-line error (same as `--debug-traceback`)                                                                                                                                                 |
+| `CIBMP_DISABLE_GITHUB_STEP_SUMMARY`     | Suppress the step-summary table on GitHub Actions                                                                                                                                                                                |
 
 ### Precedence
 
@@ -1236,7 +1236,7 @@ scheduled `test-all-platforms.yml` run since.
 <tr>
   <td><code>esp32</code></td>
   <td>
-    every board across <code>v1.28.0</code>/<code>v1.29.0</code>[^esp32ci]
+    every board across <code>v1.29.0</code>/<code>v1.29.0</code>[^esp32ci]
   </td>
   <td><code>esp_idf_base</code> (Docker) -- ESP-IDF cloned on the host, installed in-container, per-board <code>idf_target</code>/<code>idf_version</code></td>
   <td>✅</td>
@@ -1375,7 +1375,7 @@ quietly mislabelled `.mpy` when they do not.
 
 **No `dynruntime.mk` default covers either axis fully**, which this
 paragraph did not used to say: `BUILD` defaulted to an unscoped `build` up
-to v1.28.0 and to `build-$(ARCH)` from v1.29.0 — arch-scoped from that tag
+to v1.29.0 and to `build-$(ARCH)` from v1.29.0 — arch-scoped from that tag
 on, tag-scoped in no release at all, since `MPY_DIR` is the only thing that
 knows which release is being built. So on v1.29.0 and later the arch
 collision cannot happen by default; the tag one still can, and only your

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/bin/update_toolchains.py

@@ -17,10 +17,15 @@ in the same scheduled job.
 Three upstream shapes, which is why [0046] asked for one script per shape
 rather than one generic checker:
 
-- **GitHub releases** (`arm-none-eabi`, `riscv-none-elf` -- both now
-  `embedded_base`, record 0096 --, `xtensa_esp`, `windows`) -- the pinned
-  tag is in the URL; compare against the repo's
-  own latest release.
+- **GitHub releases.** For `xtensa_esp`/`windows` the pinned tag is in the
+  Dockerfile's own URL; compare against the repo's own latest release.
+  `arm-none-eabi`/`riscv-none-elf` (both `embedded_base` since record 0096)
+  are the same upstream shape but no longer a Dockerfile fact at all --
+  [0087]/[0089] moved their real pins into `resources/pinned_toolchains.toml`'s
+  own `[cross]` tables, keyed by `(cross, version)` because more than one
+  verified version is pinned at once (per-row floor/ceiling windows, e.g.
+  `mimxrt`'s below-13 ceiling). This checker reads every version pinned for
+  that cross and reports whether the newest has fallen behind upstream.
 - **emsdk** (`webassembly`) -- pinned by *build hash*, which looks
   uncomparable and is not: `emscripten-core/emsdk` publishes
   `emscripten-releases-tags.json` mapping every release to its hash, so
@@ -39,6 +44,7 @@ import hashlib
 import json
 import re
 import sys
+import tomllib
 import urllib.error
 import urllib.request
 from dataclasses import dataclass
@@ -46,6 +52,8 @@ from pathlib import Path
 
 REPO = Path(__file__).resolve().parent.parent
 DOCKER = REPO / "docker"
+RESOURCES = REPO / "src" / "cibuildmp" / "resources"
+PINNED_TOOLCHAINS = RESOURCES / "pinned_toolchains.toml"
 
 GITHUB_LATEST = "https://api.github.com/repos/{repo}/releases/latest"
 EMSDK_TAGS = (
@@ -60,37 +68,41 @@ class Pin:
     dockerfile: str
     # How to find the pinned value in that file, group(1) being the value.
     pattern: str
-    kind: str  # "github" | "emsdk" | "unversioned"
-    upstream: str = ""  # owner/repo for "github"
-
-
-# `arm-none-eabi`/`riscv-none-elf` below point at `embedded_base.Dockerfile`
-# (record 0096 merged what used to be `arm_embedded.Dockerfile`/
-# `riscv_embedded.Dockerfile`) purely so `_pinned()` reads a file that
-# exists -- **neither actually matches any more.** [0087]/[0089] already
-# deleted the `ARG TOOLCHAIN_URL=` line this regex needs from both former
-# files (the tarball is fetched at container run time now, per-row, not
-# baked at image-build time), so `_pinned()` has raised
-# `SystemExit(f"{pin.name}: no pin found...")` for both entries since
-# [0087] landed -- a real, pre-existing gap this record does not close,
-# only avoids widening into a harder `FileNotFoundError` by keeping the
-# filename real. The actual fix (reading `resources/pinned_toolchains.toml`'s
-# own per-cross pin instead of grepping a Dockerfile `ARG`) is [0090]'s own
-# scope, not this Dockerfile-merge's.
+    kind: str  # "github" | "cross-toml" | "emsdk" | "unversioned"
+    upstream: str = ""  # owner/repo for "github"/"cross-toml"
+    cross: str = ""  # `pinned_toolchains.toml` table key, for "cross-toml"
+
+
+# `arm-none-eabi`/`riscv-none-elf` used to be grepped straight out of
+# `embedded_base.Dockerfile`'s own `ARG TOOLCHAIN_URL=`. [0087]/[0089]
+# deleted that line (the tarball is fetched at container run time now, per
+# row, not baked at image-build time) and moved the real pins into
+# `resources/pinned_toolchains.toml`'s own `[cross]` tables -- and unlike
+# the Dockerfile's single shared `ARG`, that table genuinely holds more
+# than one verified version per cross at once (e.g. `mimxrt`'s own
+# below-13 ceiling, record 0088), because different `(tag, scope)` windows
+# resolve to different versions. There is no longer one "the" pin to
+# compare against upstream; `kind="cross-toml"` instead reads every
+# version pinned for that cross and reports whether the *newest* of them
+# has fallen behind upstream's own latest release -- the question this
+# checker can still answer ("is it time to add a newer entry"), without
+# claiming the older, intentionally-kept versions are drift.
 PINS = (
     Pin(
         "arm-none-eabi",
-        "embedded_base.Dockerfile",
-        r"xpack-dev-tools/arm-none-eabi-gcc-xpack/releases/download/v([^/]+)/",
-        "github",
+        "",
+        "",
+        "cross-toml",
         "xpack-dev-tools/arm-none-eabi-gcc-xpack",
+        "arm-none-eabi-",
     ),
     Pin(
         "riscv-none-elf",
-        "embedded_base.Dockerfile",
-        r"xpack-dev-tools/riscv-none-elf-gcc-xpack/releases/download/v([^/]+)/",
-        "github",
+        "",
+        "",
+        "cross-toml",
         "xpack-dev-tools/riscv-none-elf-gcc-xpack",
+        "riscv64-unknown-elf-",
     ),
     Pin(
         "xtensa-esp",
@@ -135,6 +147,24 @@ def _pinned(pin: Pin) -> str:
     return match.group(1)
 
 
+def _version_key(version: str) -> tuple[int, ...]:
+    return tuple(int(part) for part in re.findall(r"\d+", version))
+
+
+def _newest_cross_pin(pin: Pin) -> tuple[str, int]:
+    """(newest version string, how many versions are pinned) for `pin.cross`
+    in `pinned_toolchains.toml`."""
+    with PINNED_TOOLCHAINS.open("rb") as handle:
+        data = tomllib.load(handle)
+    versions = list(data.get(pin.cross, {}))
+    if not versions:
+        raise SystemExit(
+            f"{pin.name}: no versions pinned for {pin.cross!r} in "
+            f"{PINNED_TOOLCHAINS.relative_to(REPO)}"
+        )
+    return max(versions, key=_version_key), len(versions)
+
+
 def _latest_github(repo: str) -> str:
     data = json.loads(_get(GITHUB_LATEST.format(repo=repo)))
     return str(data["tag_name"]).lstrip("v")
@@ -166,12 +196,16 @@ def _tarball_url(pin: Pin) -> str:
 
 def check(pin: Pin, *, slow: bool) -> int:
     """0 when current, 1 when behind. Prints one line either way."""
-    pinned = _pinned(pin)
+    if pin.kind == "cross-toml":
+        pinned, count = _newest_cross_pin(pin)
+    else:
+        pinned = _pinned(pin)
     try:
-        if pin.kind == "github":
+        if pin.kind in ("github", "cross-toml"):
             latest = _latest_github(pin.upstream)
             stale = pinned.lstrip("v") != latest
-            arrow = f"{pinned} -> {latest}" if stale else pinned
+            suffix = f" (newest of {count} pinned)" if pin.kind == "cross-toml" else ""
+            arrow = f"{pinned} -> {latest}{suffix}" if stale else f"{pinned}{suffix}"
         elif pin.kind == "emsdk":
             version, latest_hash = _latest_emsdk()
             stale = pinned != latest_hash

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/docker/pypa-tracker.Dockerfile

@@ -19,12 +19,12 @@
 # `FROM` lines below are copied verbatim from that file's own cells, kept
 # in the same order.
 
-FROM quay.io/pypa/musllinux_1_2_x86_64@sha256:8900a53ed236d85edd6868387b3e3327c45774156519ad492fe8b1c2a434d1dc AS musllinux_1_2_x86_64
-FROM quay.io/pypa/musllinux_1_2_i686@sha256:e9029eacb01a207fc991eed8abccf55f653900b4b83068e37fb0ea201176a64a AS musllinux_1_2_i686
-FROM quay.io/pypa/musllinux_1_2_aarch64@sha256:ab0391c77648e2b15d37e3e5b8c3d43a0c4a1ca0fb3ab2f60d252be3474d2975 AS musllinux_1_2_aarch64
-FROM quay.io/pypa/musllinux_1_2_ppc64le@sha256:e745f8e8e8c7c8e02e6379502d0b73f7cc4fd95283e011a78063292740f3cf42 AS musllinux_1_2_ppc64le
-FROM quay.io/pypa/musllinux_1_2_s390x@sha256:411d3d433dde4b3a9fce85122f7080110e2ec3543ca6c22578acb4a61c38cc14 AS musllinux_1_2_s390x
-FROM quay.io/pypa/musllinux_1_2_armv7l@sha256:bb213c77861583faa326b24de1c413dab0e7c51af76f8a30f5abcaf749da5265 AS musllinux_1_2_armv7l
-FROM quay.io/pypa/musllinux_1_2_riscv64@sha256:3c2e2c26c10c2788046e54e816d8880011e4af9c4292cb735705a89870248082 AS musllinux_1_2_riscv64
-FROM quay.io/pypa/manylinux_2_31_armv7l@sha256:bb0c6355c62cd0971f17a66969b1bce15222e67e4064667e25030923bb216bfe AS manylinux_2_31_armv7l
-FROM quay.io/pypa/manylinux_2_39_riscv64@sha256:4e74e5408c307666116196383a3bbf741b171fda049c776dac731e5b6087a1d5 AS manylinux_2_39_riscv64
+FROM quay.io/pypa/musllinux_1_2_x86_64@sha256:621f8004ed526a5a6bf6a866fb415ad8da54d59a991e50b3b69167c3a768a616 AS musllinux_1_2_x86_64
+FROM quay.io/pypa/musllinux_1_2_i686@sha256:7ff9262769ecadb9b889d2977f2e1fd47400a161664502ecb0eda9291d9abdfb AS musllinux_1_2_i686
+FROM quay.io/pypa/musllinux_1_2_aarch64@sha256:4dffcd49f0b6fc6928a49915f3cd939f973bbecbdfe96e1e7926b6049bc0bad5 AS musllinux_1_2_aarch64
+FROM quay.io/pypa/musllinux_1_2_ppc64le@sha256:fbc1983eb04e9bf311bd743863472b3ac9840edc3f2ca4e9dd4085d26f24fc84 AS musllinux_1_2_ppc64le
+FROM quay.io/pypa/musllinux_1_2_s390x@sha256:a7254c085d6c28ae74acb229af697133a8827535ac26b542b7be014272ba81d2 AS musllinux_1_2_s390x
+FROM quay.io/pypa/musllinux_1_2_armv7l@sha256:7fa1e5ac26e79b9aa6b64aac4ca2479eadd8d00229f178eb5495edd538e9ff4b AS musllinux_1_2_armv7l
+FROM quay.io/pypa/musllinux_1_2_riscv64@sha256:f8bf1ede4138d95937a98362ce482453d717c62d22207f038619262b180d4ab8 AS musllinux_1_2_riscv64
+FROM quay.io/pypa/manylinux_2_31_armv7l@sha256:3503ad3cef1b2a35ee05048eaebdb93ad1b4a6e9426af7f43dbe7658243ab0db AS manylinux_2_31_armv7l
+FROM quay.io/pypa/manylinux_2_39_riscv64@sha256:000de3e1037325a6cc13615c1218061a56e1ece60ecdbe1a4572933a90654d18 AS manylinux_2_39_riscv64

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/docker/webassembly.Dockerfile

@@ -69,12 +69,16 @@
 # away exactly the reproducibility the `download` strategy exists for in
 # a locally-reproducible tool (D2/D3) -- see docs/reference/
 # open-questions.md's own "Toolchain pinning vs. reproducibility"
-# question, and its note that nothing checks whether a pinned version is
-# stale.
+# question. Its "nothing checks whether a pinned version is stale" note,
+# cited here until this bump, is no longer true: [0046] made that its own
+# work item, and `bin/update_toolchains.py --check` -- run weekly by
+# `.github/workflows/pin-staleness.yml` -- reads the build hash out of the
+# URL below and compares it against emsdk's own `latest` alias. That is
+# exactly how this pin was found behind and moved.
 #
-# The pinned version is the emscripten-releases-tags.json alias "6.0.8",
+# The pinned version is the emscripten-releases-tags.json alias "6.0.9",
 # recorded as the value it resolved to when pinned, not the literal
-# string "latest". `9d70dbe8860ccdd3595f6e6065d94bfb543ae955` in the URL
+# string "latest". `f04ea239d533260dd1db760dd2d668d5f9a88d6b` in the URL
 # is the emscripten-releases build hash that alias resolved to; the URL
 # itself follows emsdk's own
 # emscripten_releases_download_url_template
@@ -135,17 +139,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     nodejs \
     && rm -rf /var/lib/apt/lists/*
 
-# Pinned exactly as resources/usermod.toml's own [emsdk] table
-# (version = "6.0.8", [emsdk.platform.linux-x64]) -- verified live
-# before pinning here: downloaded the real tarball, confirmed this
-# exact sha256 with `sha256sum -c`, and inspected its own internal
-# layout with `tar tJf` (a top-level `install/` directory containing
-# `install/emscripten/` and `install/bin/`, exactly what
-# `usermod/emsdk.py`'s own `ResolvedEmsdk.env()` already expects on a
-# bare-host resolve) rather than assumed from the tarball's name alone.
+# emsdk 6.0.9, linux-x64 -- verified live before repinning here, the same
+# way the version before it was: downloaded the real tarball, computed
+# this exact sha256 locally, and inspected its own internal layout with
+# `tar tJf` (a top-level `install/` directory containing
+# `install/emscripten/` -- with `emcc.py` and the `cache/` tree chmod'd
+# below -- and `install/bin/`, which is what the ENV PATH further down
+# actually points at) rather than assumed from the tarball's name alone.
+#
+# This no longer tracks `resources/usermod.toml`'s own [emsdk] table, as
+# it said until this bump: [0092] deleted that file and usermod/emsdk.py's
+# `ResolvedEmsdk.env()` went with the bare-host resolver. The pin of
+# record is here, and nowhere else -- note `[usermod.webassembly]` in
+# build-platforms.toml deliberately records *no* emsdk version, because
+# MicroPython's own tools/ci.sh has never pinned one.
 RUN curl -fsSL -o /tmp/wasm-binaries.tar.xz \
-      https://storage.googleapis.com/webassembly/emscripten-releases-builds/linux/9d70dbe8860ccdd3595f6e6065d94bfb543ae955/wasm-binaries.tar.xz && \
-    echo "9bea769c189d9f52196e74283fb86937318cc24bf14879f2c6bdd19862131901  /tmp/wasm-binaries.tar.xz" | sha256sum -c - && \
+      https://storage.googleapis.com/webassembly/emscripten-releases-builds/linux/f04ea239d533260dd1db760dd2d668d5f9a88d6b/wasm-binaries.tar.xz && \
+    echo "d5c6c2917fbc1cae1a7d1e581f1c0b2817369dd57f94c7a0d05921476f1a7287  /tmp/wasm-binaries.tar.xz" | sha256sum -c - && \
     mkdir -p /opt/emsdk && \
     tar -xJf /tmp/wasm-binaries.tar.xz -C /opt/emsdk && \
     rm /tmp/wasm-binaries.tar.xz && \

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/docker/windows.Dockerfile

@@ -92,15 +92,22 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     g++-mingw-w64-i686 \
     && rm -rf /var/lib/apt/lists/*
 
-# Pinned to resources/usermod.toml's own [llvm-mingw] table (version
-# 20260616, linux-x64) -- keep the URL and sha256 in step with it. The
-# tarball unpacks to a single `llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/`
-# directory (`sole_directory()`'s own assumption in llvmmingw.py);
-# --strip-components=1 flattens that away so the install prefix is a
-# stable /opt/llvm-mingw regardless of the version in the name.
+# llvm-mingw 20260908, linux-x64. **Nothing else to keep this in step
+# with** -- this line used to say "pinned to resources/usermod.toml's own
+# [llvm-mingw] table", which contradicted the "pin of record" paragraph
+# above it: [0092] deleted that file, and usermod/llvmmingw.py with its
+# `sole_directory()` call went with [0050]/[0042]. The version, URL and
+# sha256 right here are the whole pin.
+#
+# The tarball still unpacks to a single
+# `llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64/` directory -- re-checked
+# with `tar tJf` at this version, not carried over from the last one, and
+# so were the four `<arch>-w64-mingw32-` bin/ prefixes build_windows.py
+# drives. --strip-components=1 flattens that away so the install prefix is
+# a stable /opt/llvm-mingw regardless of the version in the name.
 RUN curl -fsSL -o /tmp/llvm-mingw.tar.xz \
-      https://github.com/mstorsjo/llvm-mingw/releases/download/20260616/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64.tar.xz && \
-    echo "534b92e067b22a6b4441f48ae9240a3341b17825d04d577eab0cf85c44b4deda  /tmp/llvm-mingw.tar.xz" | sha256sum -c - && \
+      https://github.com/mstorsjo/llvm-mingw/releases/download/20260908/llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64.tar.xz && \
+    echo "2258c745e3155870c80793f3e8c80b28fbde11b9ff73c4c78783635b3440b092  /tmp/llvm-mingw.tar.xz" | sha256sum -c - && \
     mkdir -p /opt/llvm-mingw && \
     tar -xJf /tmp/llvm-mingw.tar.xz -C /opt/llvm-mingw --strip-components=1 && \
     rm /tmp/llvm-mingw.tar.xz

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/docs/ACTIONS.md

@@ -37,7 +37,7 @@ for why the Windows actions never call it either).
 
 | Input     | Required | Default | Description                             |
 | --------- | -------- | ------- | --------------------------------------- |
-| `mpy_tag` | yes      | --      | MicroPython release tag, e.g. `v1.28.0` |
+| `mpy_tag` | yes      | --      | MicroPython release tag, e.g. `v1.29.0` |
 
 No outputs; exports `MPY_DIR` to `$GITHUB_ENV` as a side effect.
 
@@ -300,11 +300,11 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: ballistics-lab/cibuildmp/.github/actions/fetch-micropython@v0.7.2
+      - uses: ballistics-lab/cibuildmp/.github/actions/fetch-micropython@v0.7.3
         with:
-          mpy_tag: v1.28.0
+          mpy_tag: v1.29.0
 
-      - uses: ballistics-lab/cibuildmp/.github/actions/build-natmod@v0.7.2
+      - uses: ballistics-lab/cibuildmp/.github/actions/build-natmod@v0.7.3
         with:
           arch: ${{ matrix.arch }}
           # natmod_dir: natmod              # default; a7p passes micropython/natmod

{cibuildmp-0.7.2 → cibuildmp-0.7.3}/docs/records/0046-pin-staleness-checker.md

@@ -195,6 +195,39 @@ Still unbuilt from this record: nothing writes results anywhere but the job log
 ([0029]'s `stepsummary.py` is still unreused here), and the "are consumers' own
 `micropython` pins in scope" question stays open.
 
+## Addendum, 2026-09-07 — `update_toolchains.py`'s own `arm-none-eabi`/`riscv-none-elf`
+## rows fixed; the weekly job had been crashing, not merely reporting drift
+
+[0096]'s own text ("`bin/update_toolchains.py`'s `PINS`... a pre-existing gap... the real
+fix... is [0090]'s own scope") turned out to point at the wrong record: [0090]'s item 1
+fixed `bin/refresh_toolchain_pins.py`'s per-row `gcc` check, a different script for a
+different question (is a row's pinned compiler inside its own floor/ceiling window). It
+never touched `update_toolchains.py`, so the gap [0096] described — `_pinned()` regexing
+an `ARG TOOLCHAIN_URL=` line that [0087]/[0089] had already deleted from
+`embedded_base.Dockerfile` for both crosses — was still live and unclosed. Found live
+while investigating a failing `pin-staleness.yml` run (2026-09-07): the "toolchain
+tarballs" step raised `SystemExit("arm-none-eabi: no pin found...")` and crashed the whole
+checker before it ever reached `riscv-none-elf`/`xtensa-esp`/`llvm-mingw`/`emsdk`/
+`xtensa-lx106` — every scheduled run since [0087] landed had been reporting a hard
+failure, not real staleness, with the other five pins never actually checked.
+
+Fixed by making `PINS` read those two crosses from `resources/pinned_toolchains.toml`'s
+own `[cross]` tables (the same file [0087]/[0089] actually moved the real pins into)
+instead of a Dockerfile `ARG` that no longer exists. That table is a genuinely different
+shape from the rest of `PINS`: it holds more than one verified version per cross at once
+(`arm-none-eabi-` alone carries three, kept for different rows' own floor/ceiling
+windows — [0088]'s `mimxrt` ceiling among them), so there is no single "the" pin left to
+compare against upstream the way a Dockerfile `ARG` was. `check()` now reads every version
+pinned for a cross and reports whether the *newest* has fallen behind upstream's latest
+release, which is the question this checker can still honestly answer without mislabelling
+an intentionally-kept older version as drift. Verified live: the script now runs to
+completion and reports each of the six pins (three came back `UNKNOWN` on an unauthenticated
+GitHub API rate limit in this sandbox, exactly like the two `github`-kind pins that were
+never in question — not a regression this fix introduced), instead of crashing on the first.
+
+Still open: `--slow`'s `xtensa-lx106` path, and everything this record's own "Still unbuilt"
+paragraph above already named.
+
 [0002]: 0002-delegate-compile-own-environment.md
 [0010]: 0010-pinned-data-in-resources.md
 [0013]: 0013-micropython-list-dedup-by-abi.md
@@ -202,3 +235,7 @@ Still unbuilt from this record: nothing writes results anywhere but the job log
 [0033]: 0033-cibuildmp-never-builds-docker-image-itself.md
 [0044]: 0044-unix-native-images-landed.md
 [0068]: 0068-docker-dependabot-grouping-and-mipsel-ubuntu-26-04.md
+[0087]: 0087-arm-riscv-embedded-thin-out-toolchain-version-lands.md
+[0088]: 0088-mimxrt-own-floor.md
+[0090]: 0090-toolchain-pins-checker-and-0058-text-followup.md
+[0096]: 0096-arm-riscv-embedded-collapse-into-embedded-base.md