abi3audit

What it is and what it does

abi3audit is a command-line auditor for Python C extensions that claim to use the stable ABI (abi3). The stable ABI is a CPython feature that allows extensions built once to work across multiple Python minor versions, but there is no enforcement mechanism—a wheel can be incorrectly tagged as abi3 or compiled against the wrong version without detection. abi3audit fills that gap by scanning wheels, individual shared objects, or entire PyPI package histories to find mismatches between the declared abi3 version tag and the actual symbols the extension uses.

The tool works by parsing binary formats (ELF, PE, Mach-O) and examining symbol tables to determine which CPython ABI version each symbol requires, then comparing that to the wheel's tag or a user-specified baseline. It reports version mismatches, non-abi3 symbols, and can output results as human-readable tables or JSON. It is maintained as an active project by Trail of Bits and depends on standard binary analysis libraries (pyelftools, pefile) plus packaging utilities.

Use it for:

• Validate that a locally-built abi3 wheel is correctly compiled and tagged before publishing to PyPI.
• Audit an entire package's release history on PyPI to find past versions with abi3 violations.
• Check a bare shared object file to confirm it uses only stable ABI symbols for a given Python version.
• Generate a JSON report of abi3 compliance across multiple wheels for integration into CI/CD pipelines.
• Investigate crashes or unexpected behavior in abi3 extensions by confirming symbol compatibility.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

abi3audit scans Python extension wheels and shared objects for violations of the stable ABI (abi3) specification, detecting when extensions are incorrectly tagged or compiled against incompatible CPython versions.

Yes, if you build or maintain Python C extensions with abi3 tags. The tool addresses a real gap in the Python packaging ecosystem—there is no built-in enforcement of abi3 compliance, and incorrect tagging can cause runtime crashes or security issues. For extension developers, this is a straightforward audit step. For users of abi3 packages, it is less directly applicable unless you are vetting third-party wheels. No known vulnerabilities and active maintenance.

Install

abi3audit on PyPI

pip install abi3audit

uv add abi3audit

poetry add abi3audit

Installing abi3audit

Before you install

Low friction: pure Python wheel with eight runtime dependencies (abi3info, kaitaistruct, packaging, pefile, pyelftools, requests, requests-cache, rich). Active maintenance with recent commits and no known vulnerabilities.

License in practice

MIT license (permissive): you can use, modify, and distribute abi3audit freely in commercial and private projects with minimal restrictions.

Quickstart

pip install abi3audit

abi3audit procmaps
abi3audit procmaps-0.5.0-cp36-abi3-manylinux2010_x86_64.whl
abi3audit procmaps.abi3.so

Requires Python 3.10 or later.

Verify before relying

• Whether the tool can audit wheels or shared objects from non-Linux platforms (Mach-O, Windows PE formats are mentioned in description but platform coverage is unclear).
• Performance characteristics when scanning large package version histories or many wheels in batch.

Package facts

Evidence: abi3audit-0.0.26-py3-none-any.whl

Tags

More Security packages