Hi,
Kontakt ScheuerWerk schrieb am 21.10.26 um 08:47:
Hello lxml maintainers,
We are preparing the redistribution of a Windows desktop application that
includes the official lxml 6.1.2 wheel for CPython 3.13 x64.
Wheel: lxml-6.1.2-cp313-cp313-win_amd64.whl
SHA-256: 6cb0c87421946030b92b558be416852780a912454e3dcba0998e4497c9c588d5
There is a 6.1.3 release by now with a fix that some might consider
security relevant.
For 6.1.2, we are looking at this release:
https://github.com/lxml/lxml/releases/tag/lxml-6.1.2-1
using this library release:
https://github.com/lxml/libxml2-win-binaries/releases/tag/2026.05.17
We would like to establish a reproducible compliance and replacement
procedure for the statically linked GNU libiconv dependency.
Could you please help us identify:
1. The exact native source commits, patches, headers and library
artifacts used to build this wheel.
> 3. The compiler, Windows SDK and linker settings used.
The Windows-x86 wheels were built on a Github Actions windows-2022 instance
using cibuildwheel:
https://github.com/lxml/lxml/actions/runs/32134759999
"""
Building lxml version 6.1.2.
Latest version of libxml2 is 2.11.9
Latest version of libxslt is 1.1.45
Latest version of zlib is 1.3.2
Latest version of iconv is 1.17.1
Using local copy of
"https://github.com/lxml/libxml2-win-binaries/releases/download/2026.05.17/libxml2-2.11.9.win64.zip";
Using local copy of
"https://github.com/lxml/libxml2-win-binaries/releases/download/2026.05.17/libxslt-1.1.45.win64.zip";
Using local copy of
"https://github.com/lxml/libxml2-win-binaries/releases/download/2026.05.17/zlib-1.3.2.win64.zip";
Using local copy of
"https://github.com/lxml/libxml2-win-binaries/releases/download/2026.05.17/iconv-1.17.1.win64.zip";
Unpacking libxml2-2.11.9.win64.zip into libs
Unpacking libxslt-1.1.45.win64.zip into libs
Unpacking zlib-1.3.2.win64.zip into libs
Unpacking iconv-1.17.1.win64.zip into libs
…
"C:\Program Files\Microsoft Visual
Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\bin\HostX86\x64\cl.exe" /c
/nologo /O2 /W3 /GL /DNDEBUG /MD -DLIBXML_STATIC -DLIBXSLT_STATIC
-DLIBEXSLT_STATIC -DCYTHON_CLINE_IN_TRACEBACK=0
-Ilibs\libxml2-2.11.9.win64\include -Ilibs\libxslt-1.1.45.win64\include
-Ilibs\zlib-1.3.2.win64\include -Ilibs\iconv-1.17.1.win64\include -Isrc
-Isrc\lxml\includes
-IC:\Users\runneradmin\AppData\Local\Temp\build-env-821sv0zk\include
-IC:\Users\runneradmin\AppData\Local\pypa\cibuildwheel\Cache\nuget-cpython\python.3.13.14\tools\include
-IC:\Users\runneradmin\AppData\Local\pypa\cibuildwheel\Cache\nuget-cpython\python.3.13.14\tools\Include
"-IC:\Program Files\Microsoft Visual
Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\include" "-IC:\Program
Files\Microsoft Visual
Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\ATLMFC\include"
"-IC:\Program Files\Microsoft Visual
Studio\2022\Enterprise\VC\Auxiliary\VS\include" "-IC:\Program Files
(x86)\Windows Kits\10\include\10.0.26100.0\ucrt" "-IC:\Program Files
(x86)\Windows Kits\10\\include\10.0.26100.0\\um" "-IC:\Program Files
(x86)\Windows Kits\10\\include\10.0.26100.0\\shared" "-IC:\Program Files
(x86)\Windows Kits\10\\include\10.0.26100.0\\winrt" "-IC:\Program Files
(x86)\Windows Kits\10\\include\10.0.26100.0\\cppwinrt" "-IC:\Program Files
(x86)\Windows Kits\NETFXSDK\4.8\include\um" /Tcsrc\lxml\etree.c
/Fobuild\temp.win-amd64-cpython-313\Release\src\lxml\etree.obj -w
"C:\Program Files\Microsoft Visual
Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\bin\HostX86\x64\link.exe"
/nologo /INCREMENTAL:NO /LTCG /DLL /MANIFEST:EMBED,ID=2 /MANIFESTUAC:NO
/LIBPATH:libs\libxml2-2.11.9.win64\lib
/LIBPATH:libs\libxslt-1.1.45.win64\lib /LIBPATH:libs\zlib-1.3.2.win64\lib
/LIBPATH:libs\iconv-1.17.1.win64\lib
/LIBPATH:C:\Users\runneradmin\AppData\Local\Temp\build-env-821sv0zk\libs
/LIBPATH:C:\Users\runneradmin\AppData\Local\pypa\cibuildwheel\Cache\nuget-cpython\python.3.13.14\tools\libs
/LIBPATH:C:\Users\runneradmin\AppData\Local\pypa\cibuildwheel\Cache\nuget-cpython\python.3.13.14\tools
/LIBPATH:C:\Users\runneradmin\AppData\Local\Temp\build-env-821sv0zk\PCbuild\amd64
"/LIBPATH:C:\Program Files\Microsoft Visual
Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\ATLMFC\lib\x64"
"/LIBPATH:C:\Program Files\Microsoft Visual
Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\lib\x64"
"/LIBPATH:C:\Program Files (x86)\Windows Kits\NETFXSDK\4.8\lib\um\x64"
"/LIBPATH:C:\Program Files (x86)\Windows Kits\10\lib\10.0.26100.0\ucrt\x64"
"/LIBPATH:C:\Program Files (x86)\Windows Kits\10\\lib\10.0.26100.0\\um\x64"
libxslt_a.lib libexslt_a.lib libxml2_a.lib iconv_a.lib zlib.lib WS2_32.lib
/EXPORT:PyInit_etree
build\temp.win-amd64-cpython-313\Release\src\lxml\etree.obj
/OUT:build\lib.win-amd64-cpython-313\lxml\etree.cp313-win_amd64.pyd
/IMPLIB:build\temp.win-amd64-cpython-313\Release\src\lxml\etree.cp313-win_amd64.lib
Creating library
build\temp.win-amd64-cpython-313\Release\src\lxml\etree.cp313-win_amd64.lib
and object
build\temp.win-amd64-cpython-313\Release\src\lxml\etree.cp313-win_amd64.exp
"""
2. Whether the artifacts from lxml/libxml2-win-binaries, release
2026.05.17, were used unchanged.
They are downloaded and used unchanged by the Windows wheel builds.
The archive is unpacked and the list of static libraries configured here
(for the lxml-6.1 branch):
https://github.com/lxml/lxml/blob/62b002e08148049589494da1d58094a074a0201d/buildlibxml.py#L151-L160
4. Any existing reproducible build or relinking instructions for
rebuilding the native extensions with a modified LGPL library.
Reproducible Windows builds are a bit tricky for 6.1.x. The lxml-6.1 branch
looks up the latest library release on github and downloads the libraries
with that version.
https://github.com/lxml/lxml/blob/62b002e08148049589494da1d58094a074a0201d/buildlibxml.py#L92-L111
I fixed that for lxml 7.0 to obey the "*_VERSION" environment variables
(and set them specifically for the versions used on Windows), but there's a
newer library release now than what was (and will be) used for the 6.1.x
releases, so I may have to work on that in case of a new 6.1.x release.
lxml 7.0 will use the latest library versions.
Stefan
_______________________________________________
lxml - The Python XML Toolkit mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/lxml.python.org
Member address: [email protected]
