Linux wheels

When installing dependencies in a Linux production environment or container, it would help to have a binary wheel so that deployed artifacts don’t require a full build toolchain. We’ve seen several of our build systems break since awscli>=1.11.19 added a pyyaml dependency.

Using the manylinux wheel approach should allow you to build wheels compatible with any modern 64-bit linux system.

[sigmavirus24]

@asottile Not ever user has the same security concerns. Some people just want to get something set-up now that they can test the performance of inside a virtualenv before deploying something more serious to production that is configured a different way.

Yes, vendoring (bundling, whatever you want to call it) static objects of libraries that have had problems can be potentially problematic. That said, it works well enough for other libraries and I’m not terribly concerned about generating new releases for new versions of libyaml if necessary once we have the necessary machinery set up. Please don’t spread FUD about manylinux wheels. I think most people understand the security concerns with manylinux wheels.

[nitzmahone]

IMO, bundled wheels are a necessary reality in 2020. Folks that are worried about that from a security perspective are free to install with --no-binary and sort through the extension builds themselves, but I think binary-bundled wheels are here to stay for the masses…