add bzip2 package (#28 )

Static build of bzip2 1.0.8 (libbz2.a + bzlib.h) for use as a vendored dependency in openpilot replay/cabana tools. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
update readme
2026-02-27 12:01:40 -08:00 · 2026-02-27 11:57:01 -08:00 · 2026-02-25 20:17:13 -08:00 · 2026-02-24 18:57:54 -08:00 · 2026-02-24 18:34:16 -08:00 · 2026-02-24 18:05:42 -08:00
51 changed files with 1677 additions and 403 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,103 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+jobs:
+  build:
+    name: build (${{ matrix.platform }})
+    runs-on: ${{ matrix.runs-on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux-x86_64
+            runs-on: ubuntu-latest
+          - platform: linux-arm64
+            runs-on: ubuntu-24.04-arm
+          - platform: macos
+            runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/cache@v4
+        with:
+          key: build-cache-v1-${{ matrix.platform }}-${{ hashFiles('build.sh', 'setup.sh', '*/pyproject.toml', '*/setup.py', '*/build.sh') }}
+          restore-keys: build-cache-v1-${{ matrix.platform }}-
+          path: |
+            .uv-cache
+            */*/install
+            */*/toolchain
+            */*/bin
+      - name: Build wheels
+        env:
+          MANYLINUX: ${{ runner.os == 'Linux' && '1' || '0' }}
+          UV_CACHE_DIR: ${{ github.workspace }}/.uv-cache
+          BUILD_SH_REUSE_MANYLINUX_ARTIFACTS: "1"
+        run: ./build.sh
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.platform }}
+          path: dist/*.whl
+
+  test:
+    name: test distro (${{ matrix.image }})
+    needs: build
+    runs-on: ${{ matrix.runs-on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: debian:bookworm-slim
+            runs-on: ubuntu-latest
+          - image: ubuntu:24.04
+            runs-on: ubuntu-latest
+          - image: ubuntu:20.04
+            runs-on: ubuntu-latest
+          - image: fedora:41
+            runs-on: ubuntu-latest
+          - image: archlinux:latest
+            runs-on: ubuntu-latest
+          - image: opensuse/tumbleweed:latest
+            runs-on: ubuntu-latest
+          - image: ghcr.io/void-linux/void-glibc:latest
+            runs-on: ubuntu-latest
+          - image: debian:bookworm-slim
+            runs-on: ubuntu-24.04-arm
+          # TODO: add musl test
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v4
+        with:
+          name: ${{ contains(matrix.runs-on, 'arm') && 'wheels-linux-arm64' || 'wheels-linux-x86_64' }}
+          path: dist/
+      - run: ./test_wheels_in_image.sh "${{ matrix.image }}"
+
+  publish:
+    name: publish wheels
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    needs: [build, test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: dist
+      - uses: actions/cache/restore@v4
+        with:
+          key: build-cache-v1-${{ matrix.platform }}-${{ hashFiles('build.sh', 'setup.sh', '*/pyproject.toml', '*/setup.py', '*/build.sh') }}
+          restore-keys: build-cache-v1-${{ matrix.platform }}-
+          path: |
+            .uv-cache
+            */*/install
+            */*/toolchain
+            */*/bin
+      - name: Publish wheels and shims
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: ./release.sh --publish-only
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,212 +0,0 @@
-name: release wheels
-
-on:
-  push:
-    branches: [master]
-
-jobs:
-  build:
-    name: build - ${{ matrix.runs-on }}
-    runs-on: ${{ matrix.runs-on }}
-    permissions:
-      contents: write
-    strategy:
-      fail-fast: false
-      matrix:
-        runs-on: [ubuntu-latest, ubuntu-24.04-arm, macos-latest]
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-python@v6
-        with:
-          python-version: "3.14"
-
-      - name: Install build dependencies
-        run: ./setup.sh
-
-      - name: build and release wheels
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          pip install build
-
-          for toml in */pyproject.toml; do
-            [ -f "$toml" ] || continue
-            pkg="$(dirname "$toml")"
-            version=$(python3 -c "import tomllib; print(tomllib.load(open('$toml', 'rb'))['project']['version'])")
-            tag="${pkg}/v${version}"
-
-            echo "========================================="
-            echo "Building: $pkg v$version"
-            echo "========================================="
-            python -m build --wheel "$pkg"
-
-            whl=$(ls "$pkg"/dist/*.whl)
-            echo "Uploading: $whl"
-            if gh release view "$tag" --repo "$GITHUB_REPOSITORY" &>/dev/null; then
-              gh release upload "$tag" "$whl" --repo "$GITHUB_REPOSITORY" --clobber
-            else
-              gh release create "$tag" "$whl" \
-                --repo "$GITHUB_REPOSITORY" \
-                --title "$pkg v$version" \
-                --notes "Platform wheels for $pkg $version"
-            fi
-          done
-
-  publish-shims:
-    name: publish releases branch
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: build and push shim packages
-        run: |
-          REPO_URL="https://github.com/${GITHUB_REPOSITORY}"
-
-          # set up a temp dir for the releases branch
-          tmp="$(mktemp -d)"
-          trap 'rm -rf "$tmp"' EXIT
-
-          for toml in */pyproject.toml; do
-            [ -f "$toml" ] || continue
-            pkg="$(dirname "$toml")"
-            version=$(python3 -c "import tomllib; print(tomllib.load(open('$toml', 'rb'))['project']['version'])")
-            tag="${pkg}/v${version}"
-            module="${pkg//-/_}"
-            # detect the package-data directory (e.g. "toolchain" or "install")
-            datadir=$(python3 -c "
-          import tomllib
-          t = tomllib.load(open('$toml', 'rb'))
-          pat = t.get('tool', {}).get('setuptools', {}).get('package-data', {}).get('$module', [''])[0]
-          print(pat.split('/')[0])
-          ")
-            description=$(python3 -c "import tomllib; print(tomllib.load(open('$toml', 'rb'))['project']['description'])")
-
-            echo "========================================="
-            echo "Creating shim: $pkg v$version (datadir=$datadir)"
-            echo "========================================="
-
-            pkg_dir="$tmp/$pkg"
-            mod_dir="$pkg_dir/$module"
-            mkdir -p "$mod_dir"
-
-            # copy __init__.py from source
-            cp "$pkg/$module/__init__.py" "$mod_dir/"
-
-            cat > "$pkg_dir/pyproject.toml" << TOML
-          [build-system]
-          requires = ["setuptools>=64", "wheel"]
-          build-backend = "setuptools.build_meta"
-
-          [project]
-          name = "$pkg"
-          version = "$version"
-          description = "$description (pre-built)"
-          requires-python = ">=3.8"
-
-          [project.scripts]
-          $(grep -A100 '^\[project\.scripts\]' "$pkg/pyproject.toml" | tail -n +2 | sed '/^\[/q' | grep -v '^\[')
-
-          [tool.setuptools.packages.find]
-          include = ["${module}*"]
-
-          [tool.setuptools.package-data]
-          $module = ["${datadir}/**/*"]
-          TOML
-
-            # setup.py — downloads pre-built wheel from GH releases and extracts data
-            cat > "$pkg_dir/setup.py" << 'SETUP'
-          import os
-          import platform
-          import zipfile
-          from io import BytesIO
-          from urllib.request import urlopen
-
-          from setuptools.command.build_py import build_py
-
-          REPO_URL = "REPO_URL_PLACEHOLDER"
-          TAG = "TAG_PLACEHOLDER"
-          VERSION = "VERSION_PLACEHOLDER"
-          MODULE = "MODULE_PLACEHOLDER"
-          DATADIR = "DATADIR_PLACEHOLDER"
-
-          PLATFORM_MAP = {
-            ("Linux", "x86_64"): "linux_x86_64",
-            ("Linux", "aarch64"): "linux_aarch64",
-            ("Darwin", "arm64"): "macosx_11_0_arm64",
-          }
-
-
-          class InstallPrebuilt(build_py):
-            """Download pre-built wheel from GitHub Releases and extract binaries."""
-
-            def run(self):
-              pkg_dir = os.path.dirname(os.path.abspath(__file__))
-              data_dir = os.path.join(pkg_dir, MODULE, DATADIR)
-
-              if not os.path.exists(os.path.join(data_dir, "bin")):
-                key = (platform.system(), platform.machine())
-                plat = PLATFORM_MAP.get(key)
-                if plat is None:
-                  raise RuntimeError(f"unsupported platform: {key}")
-
-                whl_name = f"{MODULE}-{VERSION}-py3-none-{plat}.whl"
-                url = f"{REPO_URL}/releases/download/{TAG}/{whl_name}"
-
-                print(f"Downloading {url} ...")
-                data = urlopen(url).read()
-
-                print(f"Extracting {DATADIR} ...")
-                with zipfile.ZipFile(BytesIO(data)) as zf:
-                  prefix = f"{MODULE}/{DATADIR}/"
-                  alt_prefix = f"{MODULE}-{VERSION}.data/purelib/{MODULE}/{DATADIR}/"
-                  for info in zf.infolist():
-                    for p in (prefix, alt_prefix):
-                      if info.filename.startswith(p):
-                        rel = info.filename[len(p):]
-                        if not rel:
-                          continue
-                        dest = os.path.join(data_dir, rel)
-                        if info.is_dir():
-                          os.makedirs(dest, exist_ok=True)
-                        else:
-                          os.makedirs(os.path.dirname(dest), exist_ok=True)
-                          with open(dest, "wb") as f:
-                            f.write(zf.read(info))
-                          if info.external_attr >> 16 & 0o111:
-                            os.chmod(dest, 0o755)
-                        break
-
-              super().run()
-
-
-          def setup():
-            from setuptools import setup as _setup
-            _setup(cmdclass={"build_py": InstallPrebuilt})
-
-
-          if __name__ == "__main__":
-            setup()
-          SETUP
-
-            # template in the actual values
-            sed -i "s|REPO_URL_PLACEHOLDER|${REPO_URL}|" "$pkg_dir/setup.py"
-            sed -i "s|TAG_PLACEHOLDER|${tag}|" "$pkg_dir/setup.py"
-            sed -i "s|VERSION_PLACEHOLDER|${version}|" "$pkg_dir/setup.py"
-            sed -i "s|MODULE_PLACEHOLDER|${module}|" "$pkg_dir/setup.py"
-            sed -i "s|DATADIR_PLACEHOLDER|${datadir}|" "$pkg_dir/setup.py"
-          done
-
-          # push to releases branch
-          cd "$tmp"
-          git init
-          git checkout -b releases
-          git add .
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git commit -m "update shim packages"
-          git remote add origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git"
-          git push -f origin releases
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,92 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-
-jobs:
-  build:
-    name: build (${{ matrix.platform }})
-    runs-on: ${{ matrix.runs-on }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: macos
-            runs-on: macos-latest
-          - platform: linux-x86_64
-            runs-on: ubuntu-latest
-          - platform: linux-arm64
-            runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
-        with:
-          python-version: "3.14"
-      - name: Install build dependencies
-        run: ./setup.sh
-      - name: Build wheels
-        run: |
-          for pkg in */pyproject.toml; do
-            pip wheel "./$(dirname "$pkg")" --no-deps --wheel-dir dist/
-          done
-      - name: Smoketest locally
-        run: bash smoketest.sh dist/
-      - uses: actions/upload-artifact@v4
-        with:
-          name: wheels-${{ matrix.platform }}
-          path: dist/*.whl
-
-  test:
-    name: test (${{ matrix.image }})
-    needs: build
-    runs-on: ${{ matrix.runs-on }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # test on vanilla linux images
-          - image: debian:bookworm-slim
-            runs-on: ubuntu-latest
-          - image: ubuntu:24.04
-            runs-on: ubuntu-latest
-          - image: fedora:41
-            runs-on: ubuntu-latest
-          - image: archlinux:latest
-            runs-on: ubuntu-latest
-          # TODO: make musl work
-          #- image: alpine:3.21
-          #  runs-on: ubuntu-latest
-          - image: opensuse/tumbleweed:latest
-            runs-on: ubuntu-latest
-          - image: ghcr.io/void-linux/void-glibc:latest
-            runs-on: ubuntu-latest
-          - image: debian:bookworm-slim
-            runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
-        with:
-          name: wheels-${{ contains(matrix.runs-on, 'arm') && 'linux-arm64' || 'linux-x86_64' }}
-          path: wheels
-      - name: build docker
-        run: |
-          docker build -t smoketest -f - . <<'DOCKERFILE'
-          FROM ${{ matrix.image }}
-          RUN if command -v apk >/dev/null; then \
-                apk add --no-cache python3 py3-pip bash; \
-              elif command -v apt-get >/dev/null; then \
-                apt-get update && apt-get install -y --no-install-recommends python3 python3-pip python3-venv; \
-              elif command -v dnf >/dev/null; then \
-                dnf install -y python3 python3-pip; \
-              elif command -v pacman >/dev/null; then \
-                pacman -Sy --noconfirm python python-pip; \
-              elif command -v zypper >/dev/null; then \
-                zypper install -y python3 python3-pip; \
-              elif command -v xbps-install >/dev/null; then \
-                xbps-install -Sy python3 python3-pip bash; \
-              fi
-          DOCKERFILE
-      - name: ./smoketest.sh
-        run: docker run --rm -v "$PWD:/work" -w /work smoketest bash smoketest.sh wheels/
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
 .git/
 repo/
+.venv/
+__pycache__/

 # agents
 .claude/
@@ -9,16 +11,18 @@ TASK.md
 # build artifacts (applies to all packages)
 build/
 dist/
+install/
 *.egg-info/
+*-src/
+*.tar.gz
+*.tar.xz
+*.tgz
+Python-*/
+ncurses-*/
+arm-gnu-toolchain-*/

 # downloaded toolchain binaries
 gcc-arm-none-eabi/gcc_arm_none_eabi/toolchain/

-# built capnproto
-capnproto/capnproto/install/
-
-# built ffmpeg
-ffmpeg/ffmpeg/install/
-
 # downloaded git-lfs
 git-lfs/git_lfs/bin/
--- a/README.md
+++ b/README.md
@@ -1,14 +1,23 @@
 # dependencies

-a central repo for managing and vendoring third party dependencies for all comma projects.
+a central repo for [vendoring](https://htmx.org/essays/vendoring/) all third party dependencies for comma projects.

-all of our projects are python projects, so each of these gets packaged as a pip project.
+since all our projects are Python, we wrap each vendored dependency as a pip package. `git clone` and `uv sync` is all you need.

-this vendoring serves a few goals:
- all dependencies are centrally managed here
- we can slim them down to only what we need
- all platforms get the same versions installed
- tighter control of distribution for fast installs (e.g. Ubuntu's `apt-get` is slow)
+motivations for this approach
+- `apt-get` is slow
+- `apt-get` updates its packages on a schedule we don't control
+- `apt-get` package versions don't match `brew` versions
+- `apt-get` doesn't come with Arch Linux
+- `apt-get` packages come with more than we need, bloating our project footprint 
+
+<!--
+this critically adds friction to adding dependencies to our project
+- `apt-get` installing a package is easy. is it 1MB, 10MB, or 100MB? no idea.
+- `apt-get` installing a package is much easier than adding it here. how much do you want it?
+-->
+
+`uv`, as opposed to `apt-get`, `brew`, and friends, is fast and already used in our projects.

 we target the following platforms:
 - Linux x86_64
@@ -16,3 +25,37 @@ we target the following platforms:
 - Darwin aarch64 (Apple Silicon)

 contributions welcome for other platforms!
+
+<!--
+## packages
+
+| package           | description                                                              |
+|-------------------|--------------------------------------------------------------------------|
+| gcc-arm-none-eabi | builds [panda](https://github.com/commaai/panda) firmware for STM32 MCUs |
+| capnproto         | message serialization for openpilot                                      |
+| ffmpeg            | video encode and decode for openpilot                                    |
+| git-lfs           | for tracking large files in openpilot                                    |
+| zeromq            | bridging the openpilot IPC between different hosts                       |
+-->
+
+## usage
+
+```python
+dependencies = [
+  # use the releases branch for pre-built wheels
+  "capnproto @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=capnproto",
+  "ffmpeg @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=ffmpeg",
+
+  # use the master branch to build the package on pip install
+  "capnproto @ git+https://github.com/commaai/dependencies.git@master#subdirectory=capnproto",
+  "ffmpeg @ git+https://github.com/commaai/dependencies.git@master#subdirectory=ffmpeg",
+]
+```
+
+## workflow
+
+to add a new package:
+* start a new top-level directory as a new package
+* `./test.sh` tests the building of all packages
+*  on pushes to `master`, wheels are built for our target platforms and pushed to a GitHub release
+*  the `releases` branch contains shim packages that allow pointing to a git branch and always getting the appropriate wheel for your platform
--- a/_shim_setup.py
+++ b/_shim_setup.py
@@ -0,0 +1,73 @@
+"""Shim setup.py: downloads pre-built wheels from GitHub Releases at install time."""
+import os
+import platform
+import zipfile
+from io import BytesIO
+from urllib.request import urlopen
+
+try:
+  import tomllib
+except ImportError:
+  import tomli as tomllib
+
+from setuptools import setup
+from setuptools.command.build_py import build_py
+
+_HERE = os.path.dirname(os.path.abspath(__file__))
+with open(os.path.join(_HERE, "pyproject.toml"), "rb") as _f:
+  _cfg = tomllib.load(_f)
+
+REPO_URL = _cfg["tool"]["shim"]["repo_url"]
+TAG = _cfg["tool"]["shim"]["tag"]
+DATADIR = _cfg["tool"]["shim"]["datadir"]
+VERSION = _cfg["project"]["version"]
+MODULE = _cfg["project"]["name"].replace("-", "_")
+
+PLATFORM_MAP = {
+  ("Linux", "x86_64"): "linux_x86_64",
+  ("Linux", "aarch64"): "linux_aarch64",
+  ("Darwin", "arm64"): "macosx_11_0_arm64",
+}
+
+
+class InstallPrebuilt(build_py):
+  def run(self):
+    data_dir = os.path.join(_HERE, MODULE, DATADIR)
+
+    if not os.path.exists(os.path.join(data_dir, "bin")):
+      key = (platform.system(), platform.machine())
+      plat = PLATFORM_MAP.get(key)
+      if plat is None:
+        raise RuntimeError(f"unsupported platform: {key}")
+
+      whl_name = f"{MODULE}-{VERSION}-py3-none-{plat}.whl"
+      url = f"{REPO_URL}/releases/download/{TAG}/{whl_name}"
+
+      print(f"Downloading {url} ...")
+      raw = urlopen(url).read()
+
+      print(f"Extracting {DATADIR} ...")
+      with zipfile.ZipFile(BytesIO(raw)) as zf:
+        prefix = f"{MODULE}/{DATADIR}/"
+        alt_prefix = f"{MODULE}-{VERSION}.data/purelib/{MODULE}/{DATADIR}/"
+        for info in zf.infolist():
+          for p in (prefix, alt_prefix):
+            if info.filename.startswith(p):
+              rel = info.filename[len(p):]
+              if not rel:
+                continue
+              dest = os.path.join(data_dir, rel)
+              if info.is_dir():
+                os.makedirs(dest, exist_ok=True)
+              else:
+                os.makedirs(os.path.dirname(dest), exist_ok=True)
+                with open(dest, "wb") as f:
+                  f.write(zf.read(info))
+                if info.external_attr >> 16 & 0o111:
+                  os.chmod(dest, 0o755)
+              break
+
+    super().run()
+
+
+setup(cmdclass={"build_py": InstallPrebuilt})
--- a/build.sh
+++ b/build.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$ROOT_DIR"
+
+if [[ $# -gt 0 ]]; then
+  echo "usage: MANYLINUX=1 ./build.sh" >&2
+  exit 2
+fi
+
+USE_MANYLINUX="${MANYLINUX:-0}"
+
+if [[ -z "${BUILD_SH_IN_MANYLINUX:-}" ]] && ! command -v uv >/dev/null 2>&1; then
+  ./setup.sh
+fi
+
+if [[ "$USE_MANYLINUX" == "1" && -z "${BUILD_SH_IN_MANYLINUX:-}" ]]; then
+  UV_BIN="$(command -v uv)"
+  docker run --rm \
+    -e BUILD_SH_IN_MANYLINUX=1 \
+    -e BUILD_SH_REUSE_MANYLINUX_ARTIFACTS="${BUILD_SH_REUSE_MANYLINUX_ARTIFACTS:-}" \
+    -e HOME=/tmp \
+    -e UV_CACHE_DIR=/work/.uv-cache \
+    -e UV_PYTHON=/opt/python/cp312-cp312/bin/python3 \
+    -v "$ROOT_DIR:/work" \
+    -v "$UV_BIN:/usr/local/bin/uv:ro" \
+    -w /work \
+    "quay.io/pypa/manylinux_2_28_$(uname -m)" \
+    bash build.sh
+  exit 0
+fi
+
+if [[ -n "${BUILD_SH_IN_MANYLINUX:-}" ]]; then
+  export PATH="/opt/python/cp312-cp312/bin:$PATH"
+
+  ./setup.sh
+
+  if [[ -z "${BUILD_SH_REUSE_MANYLINUX_ARTIFACTS:-}" ]]; then
+    for toml in */pyproject.toml; do
+      pkg="${toml%/pyproject.toml}"
+      module="${pkg//-/_}"
+      rm -rf "$pkg/$module/install" "$pkg/$module/toolchain" "$pkg/$module/bin"
+    done
+  fi
+fi
+
+echo "Building workspace packages into dist"
+START_SECS=$SECONDS
+
+uv build --all-packages --wheel --out-dir dist --no-create-gitignore --no-build-logs
+
+if [[ -n "${BUILD_SH_IN_MANYLINUX:-}" ]]; then
+  VENV_DIR="$ROOT_DIR/.venv-manylinux"
+else
+  VENV_DIR="$ROOT_DIR/.venv"
+fi
+
+echo
+echo "Running smoketests"
+
+uv venv --allow-existing --quiet "$VENV_DIR"
+uv pip install --python "$VENV_DIR/bin/python" --reinstall --no-deps --quiet dist/*.whl >/dev/null
+
+for toml in */pyproject.toml; do
+  module="$(basename "$(dirname "$toml")" | tr '-' '_')"
+  "$VENV_DIR/bin/python" -c "import $module; $module.smoketest()" >/dev/null
+done
+
+du -hs dist/* | sort -hr
+
+echo
+echo "Done in $((SECONDS - START_SECS))s"
--- a/bzip2/build.sh
+++ b/bzip2/build.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="1.0.8"
+INSTALL_DIR="$DIR/bzip2/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libbz2.a" ]; then
+  echo "bzip2 already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Download
+if [ ! -d "bzip2-src" ]; then
+  curl -L "https://sourceware.org/pub/bzip2/bzip2-${VERSION}.tar.gz" -o bzip2.tar.gz
+  mkdir -p bzip2-src
+  tar xzf bzip2.tar.gz -C bzip2-src --strip-components=1
+  rm bzip2.tar.gz
+fi
+
+# Build static library with -fPIC
+cd bzip2-src
+make -j"$NJOBS" libbz2.a CC="${CC:-cc}" CFLAGS="-Wall -Winline -O2 -fPIC -D_FILE_OFFSET_BITS=64"
+cd "$DIR"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Library
+cp bzip2-src/libbz2.a "$INSTALL_DIR/lib/"
+
+# Headers
+cp bzip2-src/bzlib.h "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf bzip2-src
+
+echo "Installed bzip2 to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
--- a/bzip2/bzip2/init.py
+++ b/bzip2/bzip2/init.py
@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libbz2.a")), "libbz2.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "bzlib.h")), "bzlib.h not found"
--- a/bzip2/pyproject.toml
+++ b/bzip2/pyproject.toml
@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "bzip2"
+version = "1.0.8"
+description = "bzip2 compression library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["bzip2*"]
+
+[tool.setuptools.package-data]
+bzip2 = ["install/**/*"]
--- a/bzip2/setup.py
+++ b/bzip2/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildBzip2(build_py):
+  """Run build.sh to compile bzip2 before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "bzip2", "install", "lib", "libbz2.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildBzip2}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()
--- a/capnproto/build.sh
+++ b/capnproto/build.sh
@@ -30,6 +30,8 @@ cmake -S capnproto-src -B "$DIR/build" \
  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
  -DCMAKE_INSTALL_LIBDIR=lib \
  -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DCMAKE_CXX_FLAGS="-fPIC" \
  -DWITH_OPENSSL=OFF \
  -DBUILD_TESTING=OFF \
  -DBUILD_SHARED_LIBS=OFF
--- a/capnproto/capnproto/init.py
+++ b/capnproto/capnproto/init.py
@@ -29,3 +29,16 @@ def _run_capnpc():

 def _run_capnpc_cpp():
  _run("capnpc-c++")
+
+
+def smoketest():
+  import subprocess
+
+  capnp = os.path.join(BIN_DIR, "capnp")
+  capnpc = os.path.join(BIN_DIR, "capnpc")
+  capnpc_cpp = os.path.join(BIN_DIR, "capnpc-c++")
+  env = os.environ.copy()
+  env["PATH"] = BIN_DIR + ":" + env.get("PATH", "")
+  subprocess.run([capnp, "--version"], check=True, env=env)
+  subprocess.run([capnpc, "--version"], check=True, env=env)
+  subprocess.run([capnpc_cpp, "--version"], check=True, env=env)
--- a/cppcheck/build.sh
+++ b/cppcheck/build.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="2.16.0"
+INSTALL_DIR="$DIR/cppcheck/install"
+
+# Idempotent: skip if already built
+if [ -x "$INSTALL_DIR/cppcheck" ]; then
+  echo "cppcheck already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Clone
+if [ ! -d "cppcheck-src" ]; then
+  git clone --depth 1 --branch "$VERSION" https://github.com/danmar/cppcheck.git cppcheck-src
+fi
+
+# Build
+cd cppcheck-src
+make MATCHCOMPILER=yes CXXFLAGS="-O2" -j"$NJOBS"
+cd "$DIR"
+
+# Install
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"
+
+cp cppcheck-src/cppcheck "$INSTALL_DIR/"
+cp -r cppcheck-src/addons "$INSTALL_DIR/"
+cp -r cppcheck-src/cfg "$INSTALL_DIR/"
+cp -r cppcheck-src/platforms "$INSTALL_DIR/"
+strip "$INSTALL_DIR/cppcheck" 2>/dev/null || true
+
+# Clean up
+rm -rf cppcheck-src
+
+echo "Installed cppcheck to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
--- a/cppcheck/cppcheck/init.py
+++ b/cppcheck/cppcheck/init.py
@@ -0,0 +1,16 @@
+import os
+import sys
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+
+
+def _run():
+  binary = os.path.join(DIR, "cppcheck")
+  os.execvp(binary, ["cppcheck"] + sys.argv[1:])
+
+
+def smoketest():
+  import subprocess
+  binary = os.path.join(DIR, "cppcheck")
+  result = subprocess.run([binary, "--version"], capture_output=True, text=True, check=True)
+  print(result.stdout.strip())
--- a/cppcheck/pyproject.toml
+++ b/cppcheck/pyproject.toml
@@ -0,0 +1,18 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "cppcheck"
+version = "2.16.0"
+description = "Cppcheck static analysis tool"
+requires-python = ">=3.8"
+
+[project.scripts]
+cppcheck = "cppcheck:_run"
+
+[tool.setuptools.packages.find]
+include = ["cppcheck*"]
+
+[tool.setuptools.package-data]
+cppcheck = ["install/**/*"]
--- a/cppcheck/setup.py
+++ b/cppcheck/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildCppcheck(build_py):
+  """Run build.sh to compile cppcheck before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "cppcheck", "install", "cppcheck")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildCppcheck}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()
--- a/eigen/build.sh
+++ b/eigen/build.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.4.0"
+INSTALL_DIR="$DIR/eigen/install"
+
+# Idempotent: skip if already present
+if [ -d "$INSTALL_DIR/eigen3/Eigen" ]; then
+  echo "eigen already present, skipping download."
+  exit 0
+fi
+
+TARBALL="eigen-${VERSION}.tar.gz"
+URL="https://gitlab.com/libeigen/eigen/-/archive/${VERSION}/${TARBALL}"
+
+echo "Downloading Eigen ${VERSION} ..."
+curl -fSL -o "$TARBALL" "$URL"
+
+echo "Extracting headers ..."
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR/eigen3"
+
+# Extract only the Eigen/ and unsupported/Eigen/ header directories
+tar --strip-components=1 -xzf "$TARBALL" -C "$INSTALL_DIR/eigen3" \
+  "eigen-${VERSION}/Eigen" \
+  "eigen-${VERSION}/unsupported"
+
+rm -f "$TARBALL"
+
+echo "Installed eigen to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
--- a/eigen/eigen/init.py
+++ b/eigen/eigen/init.py
@@ -0,0 +1,9 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+INCLUDE_DIR = DIR
+LIB_DIR = DIR  # header-only; no libraries
+
+
+def smoketest():
+  assert os.path.isdir(os.path.join(DIR, "eigen3", "Eigen")), "Eigen headers not found"
--- a/eigen/pyproject.toml
+++ b/eigen/pyproject.toml
@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "eigen"
+version = "3.4.0"
+description = "Eigen C++ linear algebra headers"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["eigen*"]
+
+[tool.setuptools.package-data]
+eigen = ["install/**/*"]
--- a/eigen/setup.py
+++ b/eigen/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildEigen(build_py):
+  """Run build.sh to download Eigen headers before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "eigen", "install", "eigen3", "Eigen")
+
+    if not os.path.isdir(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildEigen}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()
--- a/ffmpeg/build.sh
+++ b/ffmpeg/build.sh
@@ -17,13 +17,25 @@ NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
 PREFIX="$DIR/build/prefix"
 mkdir -p "$DIR/build"

+# --- Build zlib (static) ---
+if [ ! -d "zlib-src" ]; then
+  git clone https://github.com/madler/zlib.git zlib-src
+  git -C zlib-src checkout da607da739fa6047df13e66a2af6b8bec7c2a498  # pin to v1.3.2
+fi
+
+cd zlib-src
+./configure --prefix="$PREFIX" --static
+make -j"$NJOBS"
+make install
+cd "$DIR"
+
 # --- Build x264 (static) ---
 if [ ! -d "x264-src" ]; then
  git clone --depth 1 --branch stable https://code.videolan.org/videolan/x264.git x264-src
 fi

 cd x264-src
-./configure \
+CFLAGS="-fno-finite-math-only" ./configure \
  --prefix="$PREFIX" \
  --enable-static \
  --disable-shared \
@@ -46,15 +58,16 @@ PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}" \
  --enable-gpl \
  --enable-static \
  --disable-shared \
+  --enable-zlib \
  --enable-libx264 \
  --enable-pic \
  --disable-doc \
  --disable-ffplay \
  --disable-autodetect \
  --disable-everything \
-  --enable-encoder=libx264,aac,ffvhuff,rawvideo,png \
+  --enable-encoder=libx264,aac,ffvhuff,rawvideo,png,mjpeg \
  --enable-decoder=h264,hevc,ffvhuff,aac,rawvideo,png,mjpeg,mp3,pcm_s16le \
-  --enable-muxer=mpegts,matroska,mp4,hevc,rawvideo,image2,null,mov \
+  --enable-muxer=mpegts,matroska,mp4,hevc,rawvideo,image2,null,mov,framehash \
  --enable-demuxer=hevc,matroska,mpegts,mov,rawvideo,image2,aac,concat \
  --enable-parser=h264,hevc,aac,mpegaudio \
  --enable-protocol=file,pipe \
@@ -75,7 +88,7 @@ cp "$PREFIX/bin/ffmpeg" "$INSTALL_DIR/bin/"
 cp "$PREFIX/bin/ffprobe" "$INSTALL_DIR/bin/"

 # Libraries
-for lib in libavformat.a libavcodec.a libavutil.a libswresample.a libx264.a; do
+for lib in libavformat.a libavcodec.a libavutil.a libswresample.a libx264.a libz.a; do
  cp "$PREFIX/lib/$lib" "$INSTALL_DIR/lib/"
 done

@@ -88,7 +101,7 @@ done
 strip "$INSTALL_DIR/bin/ffmpeg" "$INSTALL_DIR/bin/ffprobe" 2>/dev/null || true

 # Clean up
-rm -rf x264-src ffmpeg-src "$DIR/build"
+rm -rf zlib-src x264-src ffmpeg-src "$DIR/build"

 echo "Installed ffmpeg to $INSTALL_DIR"
 du -sh "$INSTALL_DIR"
--- a/ffmpeg/ffmpeg/init.py
+++ b/ffmpeg/ffmpeg/init.py
@@ -18,3 +18,12 @@ def _run_ffmpeg():

 def _run_ffprobe():
  _run("ffprobe")
+
+
+def smoketest():
+  import subprocess
+
+  ffmpeg = os.path.join(BIN_DIR, "ffmpeg")
+  ffprobe = os.path.join(BIN_DIR, "ffprobe")
+  subprocess.run([ffmpeg, "-version"], check=True)
+  subprocess.run([ffprobe, "-version"], check=True)
--- a/git-lfs/build.sh
+++ b/git-lfs/build.sh
@@ -49,7 +49,6 @@ else
 fi

 chmod +x "$INSTALL_DIR/git-lfs"
-strip "$INSTALL_DIR/git-lfs" 2>/dev/null || true

 rm -f "$FILENAME"

--- a/libjpeg/build.sh
+++ b/libjpeg/build.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.1.0"
+INSTALL_DIR="$DIR/libjpeg/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libjpeg.a" ]; then
+  echo "libjpeg already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Clone
+if [ ! -d "libjpeg-turbo-src" ]; then
+  git clone --depth 1 --branch "${VERSION}" https://github.com/libjpeg-turbo/libjpeg-turbo.git libjpeg-turbo-src
+fi
+
+# Build
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+cmake -S libjpeg-turbo-src -B "$DIR/build" \
+  -DCMAKE_BUILD_TYPE=MinSizeRel \
+  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \
+  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
+  -DCMAKE_INSTALL_LIBDIR=lib \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DENABLE_SHARED=OFF \
+  -DENABLE_STATIC=ON \
+  -DWITH_TURBOJPEG=OFF
+
+cmake --build "$DIR/build" -j"$NJOBS"
+cmake --install "$DIR/build"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Library
+cp "$PREFIX/lib/libjpeg.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp "$PREFIX/include/jpeglib.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/jconfig.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/jerror.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/jmorecfg.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf libjpeg-turbo-src "$DIR/build"
+
+echo "Installed libjpeg to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
--- a/libjpeg/libjpeg/init.py
+++ b/libjpeg/libjpeg/init.py
@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libjpeg.a")), "libjpeg.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "jpeglib.h")), "jpeglib.h not found"
--- a/libjpeg/pyproject.toml
+++ b/libjpeg/pyproject.toml
@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "libjpeg"
+version = "3.1.0"
+description = "libjpeg-turbo JPEG library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["libjpeg*"]
+
+[tool.setuptools.package-data]
+libjpeg = ["install/**/*"]
--- a/libjpeg/setup.py
+++ b/libjpeg/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildLibjpeg(build_py):
+  """Run build.sh to compile libjpeg-turbo before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "libjpeg", "install", "lib", "libjpeg.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildLibjpeg}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()
--- a/ncurses/build.sh
+++ b/ncurses/build.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="6.5"
+INSTALL_DIR="$DIR/ncurses/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libncurses.a" ]; then
+  echo "ncurses already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Download
+TARBALL="ncurses-${VERSION}.tar.gz"
+if [ ! -f "$TARBALL" ]; then
+  curl -fsSL "https://ftp.gnu.org/gnu/ncurses/${TARBALL}" -o "$TARBALL"
+fi
+
+# Extract
+if [ ! -d "ncurses-${VERSION}" ]; then
+  tar xf "$TARBALL"
+fi
+
+# Build
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+cd "ncurses-${VERSION}"
+CFLAGS="-fPIC" ./configure \
+  --prefix="$PREFIX" \
+  --without-shared \
+  --with-normal \
+  --without-debug \
+  --without-cxx \
+  --without-cxx-binding \
+  --without-ada \
+  --without-manpages \
+  --without-progs \
+  --without-tests \
+  --without-dlsym \
+  --enable-overwrite
+
+make -j"$NJOBS"
+# Only install libs and headers; skip terminfo database (fails on macOS CI)
+make install.libs install.includes
+cd "$DIR"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Libraries (ncurses 6.x builds wide-char by default; provide as libncurses.a)
+cp "$PREFIX/lib/libncursesw.a" "$INSTALL_DIR/lib/libncurses.a" 2>/dev/null \
+  || cp "$PREFIX/lib/libncurses.a" "$INSTALL_DIR/lib/"
+
+# Headers (--enable-overwrite puts them directly in include/)
+cp "$PREFIX/include/ncurses.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/curses.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/ncurses_dll.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/unctrl.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/term.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/termcap.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf "ncurses-${VERSION}" "$TARBALL" "$DIR/build"
+
+echo "Installed ncurses to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
--- a/ncurses/ncurses/init.py
+++ b/ncurses/ncurses/init.py
@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libncurses.a")), "libncurses.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "ncurses.h")), "ncurses.h not found"
--- a/ncurses/pyproject.toml
+++ b/ncurses/pyproject.toml
@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ncurses"
+version = "6.5"
+description = "ncurses terminal library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["ncurses*"]
+
+[tool.setuptools.package-data]
+ncurses = ["install/**/*"]
--- a/ncurses/setup.py
+++ b/ncurses/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildNcurses(build_py):
+  """Run build.sh to compile ncurses before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "ncurses", "install", "lib", "libncurses.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildNcurses}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()
--- a/openssl3/build.sh
+++ b/openssl3/build.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.4.1"
+INSTALL_DIR="$DIR/openssl3/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libcrypto.a" ]; then
+  echo "openssl already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Download
+TARBALL="openssl-${VERSION}.tar.gz"
+if [ ! -d "openssl-src" ]; then
+  curl -fSL -o "$TARBALL" "https://github.com/openssl/openssl/releases/download/openssl-${VERSION}/${TARBALL}"
+  mkdir -p openssl-src
+  tar -xf "$TARBALL" -C openssl-src --strip-components=1
+  rm -f "$TARBALL"
+fi
+
+# Configure
+PREFIX="$DIR/build/prefix"
+cd openssl-src
+
+if [ "$(uname)" = "Darwin" ]; then
+  TARGET="darwin64-arm64-cc"
+else
+  MACHINE="$(uname -m)"
+  if [ "$MACHINE" = "x86_64" ]; then
+    TARGET="linux-x86_64"
+  elif [ "$MACHINE" = "aarch64" ]; then
+    TARGET="linux-aarch64"
+  else
+    TARGET="linux-${MACHINE}"
+  fi
+fi
+
+./Configure "$TARGET" \
+  --prefix="$PREFIX" \
+  --libdir=lib \
+  no-shared \
+  no-tests \
+  no-docs \
+  no-apps \
+  -fPIC \
+  -Os
+
+# Build
+make -j"$NJOBS"
+make install_sw
+
+cd "$DIR"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Libraries
+cp "$PREFIX/lib/libcrypto.a" "$INSTALL_DIR/lib/"
+cp "$PREFIX/lib/libssl.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp -r "$PREFIX/include/openssl" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf openssl-src "$DIR/build"
+
+echo "Installed openssl to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
--- a/openssl3/openssl3/init.py
+++ b/openssl3/openssl3/init.py
@@ -0,0 +1,11 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libcrypto.a")), "libcrypto.a not found"
+  assert os.path.isfile(os.path.join(LIB_DIR, "libssl.a")), "libssl.a not found"
+  assert os.path.isdir(os.path.join(INCLUDE_DIR, "openssl")), "openssl headers not found"
--- a/openssl3/pyproject.toml
+++ b/openssl3/pyproject.toml
@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "openssl3"
+version = "3.4.1"
+description = "OpenSSL cryptography library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["openssl3*"]
+
+[tool.setuptools.package-data]
+openssl3 = ["install/**/*"]
--- a/openssl3/setup.py
+++ b/openssl3/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildOpenssl(build_py):
+  """Run build.sh to compile OpenSSL before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "openssl3", "install", "lib", "libcrypto.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildOpenssl}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -0,0 +1,16 @@
+[tool.uv.workspace]
+members = [
+  "bzip2",
+  "capnproto",
+  "cppcheck",
+  "eigen",
+  "ffmpeg",
+  "gcc-arm-none-eabi",
+  "git-lfs",
+  "libjpeg",
+  "ncurses",
+  "openssl3",
+  "python3-dev",
+  "zeromq",
+  "zstd",
+]
--- a/python3-dev/build.sh
+++ b/python3-dev/build.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.12.8"
+INSTALL_DIR="$DIR/python3_dev/install"
+
+# Idempotent: skip if already present
+if [ -f "$INSTALL_DIR/include/Python.h" ]; then
+  echo "python3-dev headers already present, skipping."
+  exit 0
+fi
+
+TARBALL="Python-${VERSION}.tgz"
+URL="https://www.python.org/ftp/python/${VERSION}/${TARBALL}"
+
+echo "Downloading CPython ${VERSION} source ..."
+curl -fSL -o "$TARBALL" "$URL"
+
+echo "Extracting ..."
+tar xzf "$TARBALL"
+
+cd "Python-${VERSION}"
+
+# Run configure to generate pyconfig.h for this platform
+echo "Running configure to generate pyconfig.h ..."
+./configure --disable-shared --without-ensurepip > /dev/null 2>&1
+
+cd "$DIR"
+
+# Copy headers
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR/include"
+
+cp -r "Python-${VERSION}/Include/"* "$INSTALL_DIR/include/"
+cp "Python-${VERSION}/pyconfig.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf "Python-${VERSION}" "$TARBALL"
+
+echo "Installed python3-dev headers to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
--- a/python3-dev/pyproject.toml
+++ b/python3-dev/pyproject.toml
@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "python3-dev"
+version = "3.12.8"
+description = "CPython development headers"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["python3_dev*"]
+
+[tool.setuptools.package-data]
+python3_dev = ["install/**/*"]
--- a/python3-dev/python3_dev/init.py
+++ b/python3-dev/python3_dev/init.py
@@ -0,0 +1,9 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "Python.h")), "Python.h not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "pyconfig.h")), "pyconfig.h not found"
--- a/python3-dev/setup.py
+++ b/python3-dev/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildPython3Dev(build_py):
+  """Run build.sh to download CPython headers before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "python3_dev", "install", "include", "Python.h")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildPython3Dev}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()
--- a/release.sh
+++ b/release.sh
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$ROOT_DIR"
+
+REPO=commaai/dependencies
+
+echo
+echo "Publishing wheels to GitHub Releases ($REPO)"
+
+shopt -s nullglob
+for toml in */pyproject.toml; do
+  pkg="$(dirname "$toml")"
+  module="${pkg//-/_}"
+  version="$(python3 -c "import tomllib; print(tomllib.load(open('$toml', 'rb'))['project']['version'])")"
+  tag="${pkg}/v${version}"
+
+  wheels=("dist/${module}-${version}-"*.whl)
+  if [[ ${#wheels[@]} -eq 0 ]]; then
+    echo "missing wheel for $pkg ($module-$version) in dist" >&2
+    exit 1
+  fi
+
+  echo "[$pkg] Uploading ${#wheels[@]} wheel(s) to $tag"
+
+  gh release create "$tag" "${wheels[@]}" --repo "$REPO" --title "$pkg v$version" --notes "Platform wheels for $pkg $version" 2>/dev/null ||
+    gh release upload "$tag" "${wheels[@]}" --repo "$REPO" --clobber
+done
+shopt -u nullglob
+
+TOKEN="$(gh auth token 2>/dev/null)" || { echo "set GH_TOKEN to publish shim branch" >&2; exit 1; }
+
+TMP_DIR="$(mktemp -d)"
+python3 - "$TMP_DIR" "$REPO" <<'PY'
+import json
+import pathlib
+import shutil
+import tomllib
+import sys
+
+tmp_dir = pathlib.Path(sys.argv[1])
+repo = sys.argv[2]
+repo_url = f"https://github.com/{repo}"
+shim_setup = pathlib.Path("_shim_setup.py")
+
+for toml in sorted(pathlib.Path(".").glob("*/pyproject.toml")):
+  pkg = toml.parent.name
+  module = pkg.replace("-", "_")
+  data = tomllib.load(toml.open("rb"))
+  version = str(data["project"]["version"])
+  tag = f"{pkg}/v{version}"
+  description = data["project"]["description"]
+  patterns = data.get("tool", {}).get("setuptools", {}).get("package-data", {}).get(module, [""])
+  datadir = patterns[0].split("/", 1)[0] if patterns and patterns[0] else ""
+  scripts = data.get("project", {}).get("scripts", {}) or {}
+
+  pkg_dir = tmp_dir / pkg
+  mod_dir = pkg_dir / module
+  mod_dir.mkdir(parents=True, exist_ok=True)
+  shutil.copy2(pathlib.Path(pkg) / module / "__init__.py", mod_dir / "__init__.py")
+  shutil.copy2(shim_setup, pkg_dir / "setup.py")
+
+  lines = [
+    "[build-system]",
+    'requires = ["setuptools>=64", "wheel", \'tomli; python_version < \"3.11\"\']',
+    'build-backend = "setuptools.build_meta"',
+    "",
+    "[project]",
+    f'name = "{pkg}"',
+    f'version = "{version}"',
+    f"description = {json.dumps(description + ' (pre-built)')}",
+    'requires-python = ">=3.8"',
+  ]
+
+  if scripts:
+    lines += ["", "[project.scripts]"]
+    for name, target in scripts.items():
+      lines.append(f'"{name}" = {json.dumps(target)}')
+
+  lines += [
+    "",
+    "[tool.setuptools.packages.find]",
+    f'include = ["{module}*"]',
+    "",
+    "[tool.setuptools.package-data]",
+    f'{module} = ["{datadir}/**/*"]',
+    "",
+    "[tool.shim]",
+    f'repo_url = "{repo_url}"',
+    f'tag = "{tag}"',
+    f'datadir = "{datadir}"',
+  ]
+
+  (pkg_dir / "pyproject.toml").write_text("\n".join(lines) + "\n")
+PY
+
+(
+  cd "$TMP_DIR"
+  git init
+  git checkout -b releases
+  git add .
+  git -c user.name="github-actions[bot]" -c user.email="github-actions[bot]@users.noreply.github.com" commit -m "update shim packages"
+  git remote add origin "https://x-access-token:${TOKEN}@github.com/${REPO}.git"
+  git push -f origin releases
+)
+
+rm -rf "$TMP_DIR"
--- a/setup.sh
+++ b/setup.sh
@@ -1,8 +1,39 @@
 #!/usr/bin/env bash
 set -euo pipefail

+# sets up build-time dependencies (NOT runtime dependencies)
+
+run_as_root() {
+  if [ "$(id -u)" -eq 0 ]; then
+    "$@"
+  elif command -v sudo &>/dev/null; then
+    sudo "$@"
+  else
+    echo "error: root privileges required for: $*" >&2
+    exit 1
+  fi
+}
+
 if [ "$(uname)" = "Darwin" ]; then
  brew install nasm pkg-config
-else
-  sudo apt-get update && sudo apt-get install -y nasm cmake g++ pkg-config
+elif command -v dnf &>/dev/null; then
+  dnf install -y nasm cmake gcc-c++ pkgconfig git perl-IPC-Cmd
+elif command -v apt-get &>/dev/null; then
+  run_as_root apt-get update
+  run_as_root apt-get install -y nasm cmake g++ pkg-config curl
+fi
+
+if ! command -v uv &>/dev/null; then
+  command -v curl &>/dev/null || {
+    echo "error: curl is required to install uv" >&2
+    exit 1
+  }
+  UV_BIN_DIR="$HOME/.local/bin"
+  mkdir -p "$UV_BIN_DIR"
+  curl -LsSf https://astral.sh/uv/install.sh | env UV_UNMANAGED_INSTALL="$UV_BIN_DIR" sh
+  export PATH="$UV_BIN_DIR:$PATH"
+  command -v uv &>/dev/null || {
+    echo "error: failed to install uv" >&2
+    exit 1
+  }
 fi
--- a/smoketest.sh
+++ b/smoketest.sh
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
-WHEEL_DIR="${1:?Usage: smoketest.sh <wheel-directory>}"
-WHEEL_DIR="$(cd "$WHEEL_DIR" && pwd)"
-
-VENV_DIR="$(mktemp -d)"
-trap 'rm -rf "$VENV_DIR"' EXIT
-python3 -m venv "$VENV_DIR"
-source "$VENV_DIR/bin/activate"
-pip install --upgrade pip >/dev/null
-pip install "$WHEEL_DIR"/*.whl
-
-for toml in "$REPO_DIR"/*/pyproject.toml; do
-  module="$(basename "$(dirname "$toml")" | tr '-' '_')"
-  python3 -c "import $module; $module.smoketest()" && echo "$module: OK"
-done
--- a/test.sh
+++ b/test.sh
@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
-
-# Create a temporary virtualenv
-VENV_DIR="$(mktemp -d)"
-trap 'rm -rf "$VENV_DIR"' EXIT
-python3 -m venv "$VENV_DIR"
-source "$VENV_DIR/bin/activate"
-pip install --upgrade pip >/dev/null
-
-# Auto-discover packages: any subdirectory containing a pyproject.toml
-PACKAGES=()
-for toml in "$REPO_DIR"/*/pyproject.toml; do
-  [ -f "$toml" ] || continue
-  PACKAGES+=("$(dirname "$toml")")
-done
-
-if [ ${#PACKAGES[@]} -eq 0 ]; then
-  echo "No packages found."
-  exit 1
-fi
-
-FAILED=()
-
-for pkg in "${PACKAGES[@]}"; do
-  name="$(basename "$pkg")"
-  echo "========================================="
-  echo "Testing: $name"
-  echo "========================================="
-
-  # Install from git URL with subdirectory (simulates real-world usage)
-  echo "[$name] pip install ..."
-  pip install "$pkg" --verbose
-
-  # Verify import works
-  module="${name//-/_}"
-  echo "[$name] Verifying import of $module ..."
-  python -c "import $module; print(f'{$module.__name__} OK')"
-
-  echo "[$name] PASSED"
-  echo
-done
-
-if [ ${#FAILED[@]} -ne 0 ]; then
-  echo "FAILED packages: ${FAILED[*]}"
-  exit 1
-fi
-
-echo "All ${#PACKAGES[@]} package(s) passed."
-echo
-echo "Installed sizes:"
-for pkg in "${PACKAGES[@]}"; do
-  name="$(basename "$pkg")"
-  module="${name//-/_}"
-  mod_dir="$(python -c "import $module, os; print(os.path.dirname($module.__file__))")"
-  size="$(du -sh "$mod_dir" | cut -f1)"
-  echo "  $name: $size"
-done
--- a/test_wheels_in_image.sh
+++ b/test_wheels_in_image.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# a small script for testing our built wheels in a variety of linux distros
+
+IMAGE="${1:?usage: ./test_wheels_in_image.sh <image>}"
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$ROOT_DIR"
+
+# setup our deps - should only need a python3 build
+docker build -t wheeltest -f - . <<DOCKERFILE
+FROM $IMAGE
+RUN if command -v apk >/dev/null; then \
+      apk add --no-cache python3 py3-pip bash; \
+    elif command -v apt-get >/dev/null; then \
+      apt-get update && apt-get install -y --no-install-recommends python3 python3-pip python3-venv; \
+    elif command -v dnf >/dev/null; then \
+      dnf install -y python3 python3-pip; \
+    elif command -v pacman >/dev/null; then \
+      pacman -Sy --noconfirm python python-pip; \
+    elif command -v zypper >/dev/null; then \
+      zypper install -y python3 python3-pip; \
+    elif command -v xbps-install >/dev/null; then \
+      xbps-install -Sy python3 python3-pip bash; \
+    fi
+DOCKERFILE
+
+# install + smoketest
+docker run --rm -v "$PWD:/work" -w /work wheeltest bash -lc '
+  set -euo pipefail
+  python3 -m venv /tmp/venv
+  source /tmp/venv/bin/activate
+  pip install dist/*.whl
+  for toml in */pyproject.toml; do
+    module="$(basename "$(dirname "$toml")" | tr "-" "_")"
+    python -c "import $module; $module.smoketest()" && echo "$module: OK"
+  done
+'
+
+echo
+echo "All good!"
--- a/zeromq/build.sh
+++ b/zeromq/build.sh
@@ -30,6 +30,8 @@ cmake -S libzmq-src -B "$DIR/build" \
  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
  -DCMAKE_INSTALL_LIBDIR=lib \
  -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DCMAKE_CXX_FLAGS="-fPIC" \
  -DWITH_LIBSODIUM=OFF \
  -DWITH_TLS=OFF \
  -DWITH_DOCS=OFF \
--- a/zstd/build.sh
+++ b/zstd/build.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="1.5.6"
+INSTALL_DIR="$DIR/zstd/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libzstd.a" ]; then
+  echo "zstd already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Clone
+if [ ! -d "zstd-src" ]; then
+  git clone --depth 1 --branch "v${VERSION}" https://github.com/facebook/zstd.git zstd-src
+fi
+
+# Build
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+cmake -S zstd-src/build/cmake -B "$DIR/build" \
+  -DCMAKE_BUILD_TYPE=MinSizeRel \
+  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \
+  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
+  -DCMAKE_INSTALL_LIBDIR=lib \
+  -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DZSTD_BUILD_PROGRAMS=OFF \
+  -DZSTD_BUILD_TESTS=OFF \
+  -DZSTD_BUILD_CONTRIB=OFF \
+  -DZSTD_BUILD_SHARED=OFF \
+  -DZSTD_BUILD_STATIC=ON
+
+cmake --build "$DIR/build" -j"$NJOBS"
+cmake --install "$DIR/build"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Library
+cp "$PREFIX/lib/libzstd.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp "$PREFIX/include/zstd.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/zstd_errors.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/zdict.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf zstd-src "$DIR/build"
+
+echo "Installed zstd to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
--- a/zstd/pyproject.toml
+++ b/zstd/pyproject.toml
@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "zstd"
+version = "1.5.6"
+description = "Zstandard compression library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["zstd*"]
+
+[tool.setuptools.package-data]
+zstd = ["install/**/*"]
--- a/zstd/setup.py
+++ b/zstd/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildZstd(build_py):
+  """Run build.sh to compile zstd before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "zstd", "install", "lib", "libzstd.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildZstd}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()
--- a/zstd/zstd/init.py
+++ b/zstd/zstd/init.py
@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libzstd.a")), "libzstd.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "zstd.h")), "zstd.h not found"
Author	SHA1	Message	Date
Adeeb Shihadeh	db4664139a	add bzip2 package (#28 ) Static build of bzip2 1.0.8 (libbz2.a + bzlib.h) for use as a vendored dependency in openpilot replay/cabana tools. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-27 12:01:40 -08:00
Adeeb Shihadeh	8472bcb091	update readme	2026-02-27 11:57:01 -08:00
Adeeb Shihadeh	357d36a61d	simplify building (#26 )	2026-02-25 20:17:13 -08:00
Adeeb Shihadeh	ae529b6818	set more -fPIC	2026-02-24 18:57:54 -08:00
Adeeb Shihadeh	a3eeb36555	fix x264 finite-math and capnproto -fPIC (#22 )	2026-02-24 18:34:16 -08:00
David	57b632b00a	ffmpeg: build and include zlib to enable PNG support (#21 ) * add zlib to ffmpeg * checkout specific commit	2026-02-24 18:05:42 -08:00
David	e35ea9f690	add mjpeg to encoders (#20 )	2026-02-24 18:02:33 -08:00
David	32c2a425b5	ffpmeg: add framehash muxer (#19 ) * add framehash demuxer * oops, muxer not demuxer	2026-02-24 18:02:26 -08:00
Adeeb Shihadeh	62d18088cc	build linux wheels with manylinux_2_28 for wider glibc compat (#18 ) * build linux wheels inside manylinux_2_28 for glibc 2.28 compat Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * add perl-IPC-Cmd for openssl build in manylinux Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-24 17:44:07 -08:00
Adeeb Shihadeh	ec99b49198	rename openssl package to openssl3 (#17 )	2026-02-24 11:20:46 -08:00
Adeeb Shihadeh	31b96deac5	add openssl package (#16 ) Vendors OpenSSL 3.4.1 as static libraries (libcrypto.a, libssl.a) for openpilot, following the same pattern as other vendored packages. Uses module name openssl3 to avoid case-insensitive filesystem conflict with pyOpenSSL's OpenSSL module on macOS. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-24 10:53:01 -08:00
Adeeb Shihadeh	6fe17e7b31	add libjpeg-turbo package (#15 ) Vendors libjpeg-turbo 3.1.0 as a static library for openpilot, following the same pattern as zstd/ncurses/zeromq. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-24 10:09:19 -08:00
Adeeb Shihadeh	2377af3f1f	fix git-lfs on macOS	2026-02-23 22:59:08 -08:00
Adeeb Shihadeh	b9f89a5a5d	disable LTO for zstd to fix cross-version linking on macOS LTO bitcode is compiler-version-specific. The wheel built with clang 17 produces bitcode that clang 16 (used in openpilot CI) cannot read. Disable IPO to produce standard object files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-23 22:46:55 -08:00
Adeeb Shihadeh	fd4ae72793	add zstd and ncurses packages (#14 )	2026-02-23 22:34:46 -08:00
Adeeb Shihadeh	dfa87aa31a	add python3-dev package (#13 ) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-23 21:46:40 -08:00
Adeeb Shihadeh	71d4d1d3a1	downgrade cppcheck to 2.16.0 (#12 )	2026-02-23 11:47:16 -08:00
Adeeb Shihadeh	f117a0e60d	add cppcheck package (#10 ) Cppcheck 2.19.1 static analysis tool, built from source. Includes the MISRA C addon, cfg files, and platform definitions for opendbc and panda safety analysis. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-23 10:18:33 -08:00
Adeeb Shihadeh	bf379a6268	add eigen package (#9 ) Header-only Eigen 3.4.0 C++ linear algebra library, downloaded from GitLab release. Exposes INCLUDE_DIR for scons integration. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-22 21:39:17 -08:00
Adeeb Shihadeh	fcd4d49232	better README (#5 )	2026-02-22 21:34:30 -08:00
Adeeb Shihadeh	9a30c4f717	update .gitignore	2026-02-22 21:29:04 -08:00