wheelmonger

Vendor shared libraries into Python wheels using a custom TOML policy, producing linux_<arch> platform wheels.

wheelmonger wraps auditwheel and gives you explicit control over which shared libraries are vendored into the wheel, which are assumed to be system-provided, and which are cross-wheel dependencies that should be left untouched.

Installation

pip install wheelmonger

Requires Python 3.12+ and a glibc-based Linux system.

Quick start

1. Write a policy file

Create a policy.toml that classifies your wheel's shared library dependencies into three lists:

[policy]
vendor = [
    "libzmq.so.*",
    "libqhull_r.so.*",
]

skip = [
    "libtorch.so",
    "libtorch_cpu.so",
]

system = [
    "libcrypto.so.*",
    "libssl.so.*",
    "libcurl.so.*",
]

• vendor -- libraries to copy into the wheel and rewrite ELF references.
• skip -- cross-wheel dependencies to leave untouched (e.g. PyTorch).
• system -- libraries assumed present on the target system.

Patterns use fnmatch-style globbing. Libraries on the manylinux allow list (e.g. libc.so.6, libm.so.6) are always treated as system-provided automatically.

2. Inspect dependencies

wheelmonger show my_package-1.0-cp314-cp314-linux_x86_64.whl -p policy.toml

3. Repair the wheel

wheelmonger repair my_package-1.0-cp314-cp314-linux_x86_64.whl -p policy.toml

The repaired wheel is written to wheelhouse/ by default. A CycloneDX SBOM (wheelmonger.cdx.json) is generated automatically for vendored libraries and stored in the wheel's .dist-info/sboms/ directory.

Usage

wheelmonger repair WHEEL -p POLICY [-w WHEEL_DIR] [-L LIB_SDIR] [--strip] [-v]
wheelmonger show WHEEL -p POLICY [-v]

repair

show

Displays all shared library dependencies grouped by classification (vendor, manylinux, system, skip, unknown) without modifying the wheel.

Environment variables

License

MIT