
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
hugo
Advanced tools
Binaries for the 'extended + withdeploy' edition of the Hugo static site generator, installable with pip
Binaries for the extended + withdeploy edition of the Hugo static site generator, installable via pip
This project provides wheels for Hugo so that it can be used with pip on macOS, Linux, and Windows; for Python 3.10 and later.
[!NOTE] Only the latest, stable, and to-be EOL Python versions are tested regularly. If you encounter any issues with the package on a specific Python version, please feel free to open an issue.
Hugo is a static site generator written in Go. It is designed to be fast and flexible, and it is used by many people and organizations for their websites, documentation, and personal blogs.
[!NOTE] This distribution of
Hugois currently not affiliated with the officialHugoproject. Please refer to the Hugo documentation for more information on Hugo.
hugo do I install?This project, hugo is versioned alongside the Hugo releases and is aligned with the versioning of Hugo itself, which uses SemVer – but is likely versioned according to 0ver software standards based on their versioning history.
Binaries for hugo through these wheels are available for Hugo versions 0.121.2 and above, through PyPI or through releases on GitHub. If you need an older version of hugo that is not available through this package, please consider using the official Hugo binaries.
Please refer to the section on Supported platforms for a list of wheels available for supported platforms and architectures. If it does, jump to the Quickstart section to get started.
[!WARNING] Owing to the limitations of overall sizing available on PyPI for
hugo, only the most recent versions of Hugo are available for download throughpip, and older versions of these wheels will be deleted to make space for newer releases. If you need an older version of Hugo, please consider using the wheels that have been uploaded to the GitHub releases page or the official Hugo binaries. The former can be done viapipby downloading the.whlfile, or throughpipxusing the URL directly (recommended). For example, if you need Hugo 0.122.0, you can runpipx install "https://github.com/agriyakhetarpal/hugo-python-distributions/releases/download/v0.122.0/hugo-0.122.0-cp311-cp311-win_amd64.whl"to download and install the wheel for Hugo 0.122.0 on Windows for Python 3.11.
Create a virtual environment and install the package (or install it globally on your system):
python -m virtualenv venv # (or your preferred method of creating virtual environments)
pip install hugo
This places a hugo installation with an executable in your virtual environment and adds an entry point to it in your virtual environment's bin directory. You can use the hugo command as you would normally:
hugo version
hugo env --logLevel info
Alternatively, you can install the package globally on your system:
python3.X -m pip install hugo # Unix
py -m pip install hugo # Windows
[!TIP] It is a great idea to use
pipxoruvxto install or use Hugo in an isolated location without having to create a virtual environment, which will allow you to run Hugo as a command-line tool without having to install it globally on your system. i.e.,
pipx install hugo # install Hugo through pipx
pipx run hugo # run Hugo through pipx
or
uv tool install hugo # install Hugo through uvx
uvx hugo # run Hugo through uvx
or
pipx run hugo==0.121.2 # run a specific version of Hugo through pipx, even if a different version is installed in whatever environment you are in
Please refer to the pipx documentation and documentation on uv's tools interface for more information.
Then, you can use the hugo commands as you would normally:
hugo version
hugo env --logLevel info
and
hugo new site mysite
hugo --printI18nWarnings server
# and so on
...
Standard virtual environments can allow multiple versions of Hugo to be installed and used side-by-side. To use a specific version of Hugo, you can specify the version when installing the package (please refer to the section What version of hugo do I install? for more information):
pip install "hugo==0.X.Y"
For more information on using Hugo and its command-line interface, please refer to the Hugo documentation and Hugo CLI documentation.
A subset of the platforms supported by Hugo itself are supported by these wheels for hugo via hugo-python-distributions. The plan is to support as many platforms as possible with Python wheels and platform tags. Please refer to the following table for a list of supported platforms and architectures:
| Platform | Architecture | Support |
|---|---|---|
| macOS | x86_64 (Intel) | ✅ macOS 10.13 (High Sierra) and later |
| macOS | arm64 (Silicon) | ✅ macOS 11.0 (Big Sur) and later |
| Linux | amd64 | ✅ glibc 2.17 and later |
| Linux | arm64 | ✅ glibc 2.17 and later |
| Linux | s390x | ✅ glibc 2.17 and later |
| Linux | ppc64le | ✅ glibc 2.17 and later |
| Windows | x86_64 | ✅ |
| Windows | arm64 | ✅💡 Experimental support 1 |
| Windows | x86 | ✅💡 Experimental support 1 |
| DragonFlyBSD | amd64 | ❌ Will not receive support2 |
| FreeBSD | amd64 | ❌ Will not receive support2 |
| OpenBSD | amd64 | ❌ Will not receive support2 |
| NetBSD | amd64 | ❌ Will not receive support2 |
| Solaris | amd64 | ❌ Will not receive support2 |
Building the extended + withdeploy edition of Hugo from source requires the following dependencies:
Windows users can use the Chocolatey package manager in order to use the MinGW compiler. After installing Chocolatey, run the following command in an elevated terminal prompt:
choco install mingw
Then, clone the repository and run the build script:
git clone https://github.com/agriyakhetarpal/hugo-python-distributions@main
python -m venv venv
source venv/bin/activate # on Unix-based systems
venv\Scripts\activate.bat # on Windows
pip install -e . # editable installation
pip install . # regular installation
[!NOTE] Cross-compilation is experimental and may not be stable or reliable for all use cases. If you encounter any issues with cross-compilation, please feel free to open an issue.
This project is capable of cross-compiling Hugo binaries for various platforms and architectures and it can be used as follows. Cross-compilation is provided for the following platforms:
arm64 and amd64 architectures via the Xcode toolchain,arm64, amd64, s390x, and ppc64le architectures via the Zig toolchain, andamd64, arm64, and x86 architectures via the Zig toolchain.Please refer to the examples below for more information on how to cross-compile Hugo for different architectures:
Say, on an Intel-based (x86_64) macOS machine:
export GOARCH="arm64"
pip install . # or pip install -e .
This will build a macOS arm64 binary distribution of Hugo that can be used on Apple Silicon-based (arm64) macOS machines. To build a binary distribution for the target Intel-based (x86_64) macOS platform on the host Apple Silicon-based (arm64) macOS machine, you can use the following command:
export GOARCH="amd64"
pip install . # or pip install -e .
Set the USE_ZIG, GOOS, and GOARCH environment variable prior to installing the package:
Say, on an amd64 Linux machine:
export USE_ZIG="1"
export GOOS="linux"
export GOARCH="arm64"
pip install . # or pip install -e .
will cross-compile a Linux arm64 binary distribution of Hugo that can be used on the targeted arm64 Linux machines. To build a binary distribution for the target amd64 Linux platform on the host arm64 Linux machine, set the targets differently:
export USE_ZIG="1"
export GOOS="linux"
export GOARCH="amd64"
pip install . # or pip install -e .
This creates dynamic linkage for the built Hugo binary with a system-provided GLIBC. If you wish to statically link the binary with MUSL, change the CC and CXX environment variables as follows:
export CC="zig cc -target x86_64-linux-musl"
export CXX="zig c++ -target x86_64-linux-musl"
Linkage against MUSL is not tested in CI at this time, but it should work in theory. The official Hugo binaries do not link against MUSL for a variety of reasons including but not limited to the size of the binary and the popularity of the GLIBC C standard library and its conventions.
Set these environment variables prior to installing the package:
Say, on an amd64 Windows machine:
set USE_ZIG="1"
set GOOS="windows"
set GOARCH="arm64"
pip install . # or pip install -e .
will cross-compile a Windows arm64 binary distribution of Hugo that can be used on the targeted arm64 Windows machines (note the use of set instead of export on Windows), and so on for the x86 architecture:
set USE_ZIG="1"
set GOOS="windows"
set GOARCH="386"
pip install . # or pip install -e .
For a list of supported distributions for Go, please run the go tool dist list command on your system. For a list of supported targets for Zig, please refer to the Zig documentation for more information or run the zig targets command on your system.
[!TIP] Cross-compilation for a target platform and architecture from a different host platform and architecture is also possible, but it remains largely untested at this time. Currently, the Zig compiler toolchain is known to work for cross-platform, cross-architecture compilation.
Binaries for the Hugo static site generator are available for download from the Hugo releases page. These binaries have to be downloaded and placed in an appropriate location on the system manually and the PATH environment variable has to be updated to include said location.
This project provides wheels for Hugo to be used with pip on macOS, Linux, and Windows. This allows Hugo to be installed and used in a virtual environment, which allows multiple versions of Hugo to be installed and used side-by-side in different virtual environments, where Hugo can be used as a command-line tool (a Python API is not provided at this time given the lack of such a demand for it).
This project is designed to be used in the following scenarios:
pip install --upgrade hugo command, and automatic updates possible too if you use a package manager such as Poetry or PDM to manage your Python dependencies or a tool such as pipx to manage your command-line toolsThis project is licensed under the terms of the Apache 2.0 license. Hugo is available under Apache 2.0 (see the Hugo license) as well.
Please refer to the Security policy for this project for more information.
This repository aims to follow the Hugo project in striving to provide a welcoming and inclusive environment for all contributors, regardless of their background and identity. Please refer to the Code of Conduct for more information that applies to all interactions in this repository and its associated spaces. It is reliant on the Contributor Covenant for its guidelines and conforms to version 2.1.
For requesting help, reporting bugs, or requesting features that are specific to Hugo's functionalities, please refer to the Hugo Discourse forum. For requesting help for hugo-python-distributions, please feel free to open an issue in this repository.
cmake-python-distributions project by the scikit-build team provides a similar infrastructure for building and distributing CMake as a Python package to be used as a PEP 517 build-time dependency for building packages with extension modules. I used their repository's name as an inspiration for the name of this repository.uhugo is a Hugo binary helper that installs and updates Hugo binaries from Hugo official releases. It can be used to update the version of Hugo within Cloud providers. The difference between uHugo is that this project enables building Hugo from source and embeds the application binary into a wheel, while uHugo is a CLI to update an existing Hugo binary already present on PATH. It provides similar visions for installing Hugo via a command-line interface, even though the idea and the packaging code is fundamentally different.hvm (Hugo version manager) is a project by one of the core developers of Hugo that allows downloading multiple Hugo versions and setting different default versions by adding them to PATH, thereby allowing the usage of multiple versions at once, but without the extra Python scaffolding provided here (and without pipx's run-without-install functionality of course).hugo-installer is a small Node.js script which you can use to fetch the correct Hugo binary for your system and install it with npm's post-installation hook. It is similar to this project in that it provides a way to install Hugo binaries.conda-forge's hugo feedstock provides a way to install Hugo binaries via the conda package format and associated package managers.zig-pypi is a project that provides a way to distribute the Zig compiler as a Python package, which can be installed via pip. It provides a similar infrastructure for building and distributing binaries as this project does for Hugo, but it fetches the Zig compiler binaries from the official Zig releases and embeds them into a Python package in a reproducible manner.nodejs-wheel is a project that provides a way to unofficially distribute Node.js binaries as Python packages, which can be installed via pip, in order to use Node.js and npm in an isolated Python environment.pip-binary-factory repository provides binaries and their CLIs for various Go-based tools as Python packages.There are several other projects in this area, but are not listed here for brevity.
Hugo package on PyPI (@nariman) for their kind gesture of granting access to take over the package name with the underlying provisions of PEP 541. This way, it allows users to install the package using the same name as the official Hugo project, which undoubtedly provides for a better user experience and convenience to users of this package when compared to the previous package name, python-hugo.Support for 32-bit (i686) and arm64 architectures on Windows is made possible through the use of the Zig compiler toolchain that uses the LLVM ecosystem. These wheels are experimental owing to the use of cross-compilation and may not be stable or reliable for all use cases, and are not officially supported by the Hugo project at this time. Hence, while these are published to PyPI for general availability, they are considered experimental. Please refer to the Building from source section for more information on how to build Hugo for these platforms and architectures locally. If you need official support for these platforms or face any bugs, please consider contacting the Hugo authors by [https://github.com/gohugoio/hugo/issues/new](opening an issue). ↩ ↩2
Support for these platforms is not possible to include because of i. the lack of resources to test and build for them and ii. the lack of support for these platform specifications in Python packaging standards and tooling. If you need support for these platforms, please consider downloading the official Hugo binaries for their non-extended editions. ↩ ↩2 ↩3 ↩4 ↩5
FAQs
Binaries for the 'extended + withdeploy' edition of the Hugo static site generator, installable with pip
We found that hugo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.