Building

./scripts/build.sh 3.14.2  # build specific version
./scripts/build.sh --all  # build all versions
./scripts/build.sh 3.14.2 --cosmoext  # with C extension support
./scripts/build.sh 3.14.2 --clean  # clean rebuild
./scripts/build.sh --help  # show all options

Environment Variables

Variable	Default	Description
WORK_DIR	./work	Build working directory (sources, objects)
DIST_DIR	./dist	Output directory for built binaries
COSMO_DIR	/tmp/cosmo	Cosmopolitan toolchain installation path
DEPS_DIR	$WORK_DIR/deps	Compiled dependencies (openssl, libffi, etc.)
SKIP_SIGSTORE	(unset)	Set to 1 to skip Python sigstore verification

Example:

WORK_DIR=/tmp/build DIST_DIR=./output ./scripts/build.sh 3.14.2

Build Process

The build system is organized into phases:

1. Setup (scripts/setup.sh) — Install Cosmopolitan toolchain
2. Dependencies (scripts/build-deps.sh) — Build all libraries (OpenSSL, SQLite, etc.)
3. Python (scripts/python/build.sh) — Download, patch, compile, and package Python

Each dependency has its own build script in scripts/:

• bzip2.sh, gdbm.sh, libffi.sh, ncurses.sh
• openssl.sh, readline.sh, sqlite.sh
• xz.sh, zstd.sh, cacert.sh

Caching

The GitHub Actions workflow caches:

• Dependencies: Keyed by upstream.cdx.json + script hashes
• Python binaries: Keyed per-version by upstream.cdx.json + python script hashes

This means PR builds populate the cache, and release builds get cache hits.

Adding a New Python Version

When a new Python minor version is released (e.g., 3.15):

1. Add version to upstream.cdx.json with SHA256 and sigstore info
2. Create scripts/python/patches/3.15/ directory if patches needed
3. Test build: ./scripts/build.sh 3.15.0
4. Run smoke tests: ./scripts/smoke.sh dist/python-3.15.0-cosmo.com
5. Update python.latest in upstream.cdx.json