Manylinux2010 wheel (#4910)

* add manylinux2010 wheel builder

* various updates

* empty commit

* need to pass a plat tag

* hacks need hacks

5 files changed, 43 insertions, 18 deletions

diff --git a/.azure-pipelines/wheel-builder.yml b/.azure-pipelines/wheel-builder.yml
index 3d867c7f..edd1dd51 100644
--- a/.azure-pipelines/wheel-builder.yml
+++ b/.azure-pipelines/wheel-builder.yml
@@ -71,18 +71,36 @@ jobs:
                 pathToPublish: wheelhouse/
                 artifactName: cryptography-macos-python$(python.version)
 
-    - job: 'manylinux1'
+    - job: 'manylinux'
       pool:
           vmImage: 'ubuntu-16.04'
-      container: 'pyca/cryptography-manylinux1:x86_64'
+      container: $[variables.containerImage]
       strategy:
           matrix:
-              Python27m:
+              Python27m-manylinux1:
+                  containerImage: 'pyca/cryptography-manylinux1:x86_64'
+                  PYTHON_VERSION: 'cp27-cp27m'
+                  PLATFORM: 'manylinux1_x86_64'
+              Python27mu-manylinux1:
+                  containerImage: 'pyca/cryptography-manylinux1:x86_64'
+                  PYTHON_VERSION: 'cp27-cp27mu'
+                  PLATFORM: 'manylinux1_x86_64'
+              Python3m-manylinux1:
+                  containerImage: 'pyca/cryptography-manylinux1:x86_64'
+                  PYTHON_VERSION: 'cp34-cp34m'
+                  PLATFORM: 'manylinux1_x86_64'
+              Python27m-manylinux2010:
+                  containerImage: 'pyca/cryptography-manylinux2010:x86_64'
                   PYTHON_VERSION: 'cp27-cp27m'
-              Python27mu:
+                  PLATFORM: 'manylinux2010_x86_64'
+              Python27mu-manylinux2010:
+                  containerImage: 'pyca/cryptography-manylinux2010:x86_64'
                   PYTHON_VERSION: 'cp27-cp27mu'
-              Python3m:
+                  PLATFORM: 'manylinux2010_x86_64'
+              Python3m-manylinux2010:
+                  containerImage: 'pyca/cryptography-manylinux2010:x86_64'
                   PYTHON_VERSION: 'cp34-cp34m'
+                  PLATFORM: 'manylinux2010_x86_64'
       steps:
           - script: /opt/python/$PYTHON_VERSION/bin/python -m virtualenv .venv
             displayName: Create virtualenv
@@ -102,7 +120,7 @@ jobs:
                   CFLAGS="-I/opt/pyca/cryptography/openssl/include -Wl,--exclude-libs,ALL" \
                   .venv/bin/pip wheel cryptography==$BUILD_VERSION --no-binary cryptography --no-deps --wheel-dir=tmpwheelhouse $PY_LIMITED_API
             displayName: Build the wheel
-          - script: auditwheel repair tmpwheelhouse/cryptograph*.whl -w wheelhouse/
+          - script: auditwheel repair --plat $PLATFORM tmpwheelhouse/cryptograph*.whl -w wheelhouse/
             displayName: Run auditwheel
           - script: unzip wheelhouse/*.whl -d execstack.check
             displayName: Unzip the wheel
@@ -118,6 +136,8 @@ jobs:
                 exit 0
               fi
             displayName: Run execstack on the wheel
+          - script: .venv/bin/pip install -U pip
+            displayName: Upgrade pip again so we can actually use manylinux2010
           - script: .venv/bin/pip install cryptography==$BUILD_VERSION --no-index -f wheelhouse/
             displayName: Test installing the wheel
           - script: |
@@ -126,7 +146,7 @@ jobs:
           - task: PublishBuildArtifacts@1
             inputs:
                 pathToPublish: wheelhouse/
-                artifactName: cryptography-manylinux1-$(PYTHON_VERSION)
+                artifactName: cryptography-$(PLATFORM)-$(PYTHON_VERSION)
 
     - job: 'windows'
       pool:
diff --git a/.github/ISSUE_TEMPLATE/openssl-release.md b/.github/ISSUE_TEMPLATE/openssl-release.md
index 074d9fb0..c2fcae3d 100644
--- a/.github/ISSUE_TEMPLATE/openssl-release.md
+++ b/.github/ISSUE_TEMPLATE/openssl-release.md
@@ -3,5 +3,6 @@
 - [ ] macOS
     - [ ] Send a pull request to `homebrew` upgrading the `openssl@1.1` formula
     - [ ] Wait for it to be merged
-- [ ] manylinux1
-    - [ ] Send a pull request to `pyca/infra` updating the [version and hash](https://github.com/pyca/infra/blob/master/cryptography-manylinux1/install_openssl.sh#L5-L6)
+- [ ] manylinux
+    - [ ] Send a pull request to `pyca/infra` updating the [version and hash](https://github.com/pyca/infra/blob/master/cryptography-manylinux1/install_openssl.sh#L5-L6) for `manylinux1`
+    - [ ] Send a pull request to `pyca/infra` updating the [version and hash](https://github.com/pyca/infra/blob/master/cryptography-manylinux2010/install_openssl.sh#L5-L6) for `manylinux2010`
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 5722e7b6..4231d2b6 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -8,6 +8,9 @@ Changelog
 
 .. note:: This version is not yet released and is under active development.
 
+* We now ship ``manylinux2010`` wheels in addition to our ``manylinux1``
+  wheels.
+
 .. _v2-7:
 
 2.7 - 2019-05-30
diff --git a/docs/doing-a-release.rst b/docs/doing-a-release.rst
index 6c309d35..733d67f4 100644
--- a/docs/doing-a-release.rst
+++ b/docs/doing-a-release.rst
@@ -23,7 +23,8 @@ Verifying OpenSSL version
 The release process creates wheels bundling OpenSSL for Windows, macOS, and
 Linux. Check that the Windows and macOS Azure Pipelines builders have the latest
 version of OpenSSL installed and verify that the latest version is present in
-the ``pyca/cryptography-manylinux1`` docker containers. If anything is out
+both the ``pyca/cryptography-manylinux1`` and
+``pyca/cryptography-manylinux2010`` docker containers. If anything is out
 of date follow the instructions for upgrading OpenSSL.
 
 Upgrading OpenSSL
diff --git a/docs/installation.rst b/docs/installation.rst
index e006fc25..7118cb1e 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -75,10 +75,10 @@ local `wheel cache`_.
 Building cryptography on Linux
 ------------------------------
 
-``cryptography`` ships a ``manylinux1`` wheel (as of 2.0) so all dependencies
-are included. For users on pip 8.1 or above running on a ``manylinux1``
-compatible distribution (almost everything except Alpine) all you should
-need to do is:
+``cryptography`` ships ``manylinux`` wheels (as of 2.0) so all dependencies
+are included. For users on pip 8.1 or above running on a ``manylinux1`` or
+``manylinux2010`` compatible distribution (almost everything except Alpine)
+all you should need to do is:
 
 .. code-block:: console
 
@@ -122,8 +122,8 @@ Building
 ~~~~~~~~
 
 You should now be able to build and install cryptography. To avoid getting
-the pre-built wheel on ``manylinux1`` distributions you'll need to use
-``--no-binary``.
+the pre-built wheel on ``manylinux`` compatible distributions you'll need to
+use ``--no-binary``.
 
 .. code-block:: console
 
@@ -163,9 +163,9 @@ Static Wheels
 ~~~~~~~~~~~~~
 
 Cryptography ships statically-linked wheels for macOS, Windows, and Linux (via
-``manylinux1``). This allows compatible environments to use the most recent
+``manylinux``). This allows compatible environments to use the most recent
 OpenSSL, regardless of what is shipped by default on those platforms. Some
-Linux distributions (most notably Alpine) are not ``manylinux1`` compatible so
+Linux distributions (most notably Alpine) are not ``manylinux`` compatible so
 we cannot distribute wheels for them.
 
 However, you can build your own statically-linked wheels that will work on your