Deterministic builds

.gitignore

@@ -100,3 +100,4 @@ env2/
 
 # VSCode project settings
 /.vscode
+env2

LICENSE

@@ -22,3 +22,7 @@ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+Get-pip and Pip (bundled in cibuildwheel/resources) are licensed under the MIT
+license. See https://github.com/pypa/get-pip/blob/master/LICENSE.txt

bin/update_constraints

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+
+import os, subprocess, requests, configparser
+from collections import namedtuple
+
+os.chdir(os.path.dirname(__file__))
+os.chdir('..')
+
+os.environ['CUSTOM_COMPILE_COMMAND'] = "bin/update_constraints"
+subprocess.check_call([
+    'pip-compile',
+    '--allow-unsafe',
+    '--generate-hashes',
+    '--upgrade',
+    'cibuildwheel/resources/constraints.in',
+])
+subprocess.check_call([
+    './env2/bin/pip-compile',
+    '--allow-unsafe',
+    '--generate-hashes',
+    '--upgrade',
+    'cibuildwheel/resources/constraints.in',
+    '--output-file', 'cibuildwheel/resources/constraints-python27.txt'
+])
+
+Image = namedtuple('Image', ['manylinux_version', 'arch'])
+
+images = [
+    Image('manylinux1', 'x86_64'), Image('manylinux1', 'i686'), 
+    Image('manylinux2010', 'x86_64'), Image('manylinux2010', 'i686'), 
+    Image('manylinux2014', 'x86_64'), Image('manylinux2014', 'i686'), 
+]
+
+config = configparser.ConfigParser()
+
+for image in images:
+    repository_name = '{}_{}'.format(image.manylinux_version, image.arch)
+    quay_api_url = 'https://quay.io/api/v1/repository/pypa/{}?includeTags=true'.format(repository_name)
+    repo_info = requests.get(quay_api_url).json()
+    tags_dict = repo_info['tags']
+
+    latest_tag = tags_dict.pop('latest')
+
+    # find the tag whose manifest matches 'latest'
+    tag_name = next(
+        name 
+        for (name, info) in tags_dict.items() 
+        if info['manifest_digest'] == latest_tag['manifest_digest']
+    )
+
+    image_name = 'quay.io/pypa/{}_{}:{}'.format(image.manylinux_version, image.arch, tag_name)
+
+    if not config.has_section(image.manylinux_version):
+        config[image.manylinux_version] = {}
+
+    config[image.manylinux_version][image.arch] = image_name
+
+with open('cibuildwheel/resources/pinned_docker_images.cfg', 'w') as f:
+    config.write(f)

cibuildwheel/__main__.py

@@ -4,7 +4,7 @@
 import cibuildwheel
 import cibuildwheel.linux, cibuildwheel.windows, cibuildwheel.macos
 from cibuildwheel.environment import parse_environment, EnvironmentParseError
-from cibuildwheel.util import BuildSelector, Unbuffered
+from cibuildwheel.util import BuildSelector, DependencyConstraints, Unbuffered
 
 def get_option_from_environment(option_name, platform=None, default=None):
     '''
@@ -103,6 +103,14 @@ def main():
     repair_command = get_option_from_environment('CIBW_REPAIR_WHEEL_COMMAND', platform=platform, default=repair_command_default)
     environment_config = get_option_from_environment('CIBW_ENVIRONMENT', platform=platform, default='')
 
+    dependency_versions = get_option_from_environment('CIBW_DEPENDENCY_VERSIONS', platform=platform, default='pinned')
+    if dependency_versions == 'pinned':
+        dependency_constraints = DependencyConstraints.with_defaults()
+    elif dependency_versions == 'latest':
+        dependency_constraints = None
+    else:
+        dependency_constraints = DependencyConstraints(dependency_versions)
+
     if test_extras:
         test_extras = '[{0}]'.format(test_extras)
 
@@ -144,6 +152,7 @@ def main():
         build_selector=build_selector,
         repair_command=repair_command,
         environment=environment,
+        dependency_constraints=dependency_constraints,
     )
 
     if platform == 'linux':