pypi-publish/requirements/runtime.in

-c runtime-constraints.in  # limits known broken versions

# NOTE: v6 is needed to support metadata v2.4
twine >= 6.0

# NOTE: Used to detect an ambient OIDC credential for OIDC publishing,
# NOTE: as well as PEP 740 attestations.
id ~= 1.0

# NOTE: This is pulled in transitively through `twine`, but we also declare
# NOTE: it explicitly here because `oidc-exchange.py` uses it.
# Ref: https://github.com/di/id
requests

# NOTE: Used to generate attestations.
pypi-attestations ~= 0.0.15
sigstore ~= 3.5.1

# NOTE: Used to detect the PyPI package name from the distribution files
packaging
💅📦 Split transitive dep constraints This is a structural change allowing for better placement of direct dependencies and limiting the transitive ones. 2024-12-06 20:24:42 -05:00			`-c runtime-constraints.in # limits known broken versions`
Document broken `pkginfo==1.9.0` transitive dep Refs: * https://github.com/pypa/gh-action-pypi-publish/issues/107 2022-11-30 04:32:45 -05:00
📦 Only keep lower bounds @ input requirements This concerns both direct (`twine`) and indirect (`pkginfo`) deps, provided there's no broken versions to exclude. 2024-12-09 09:07:39 -05:00			`# NOTE: v6 is needed to support metadata v2.4`
			`twine >= 6.0`
📌📦 Pin `pkginfo` to v1.12 @ runtime deps Signed-off-by: William Woodruff <william@trailofbits.com> 2024-12-05 09:42:44 -05:00
Expose PEP 740 attestations functionality PR #236 This patch adds PEP 740 attestation generation to the workflow: when the Trusted Publishing flow is used, this will generate a publish attestation for each distribution being uploaded. These generated attestations are then fed into `twine`, which newly supports them via `--attestations`. Ref: https://github.com/pypi/warehouse/issues/15871 2024-08-31 20:50:29 -04:00			`# NOTE: Used to detect an ambient OIDC credential for OIDC publishing,`
			`# NOTE: as well as PEP 740 attestations.`
OIDC beta support Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua> 2023-03-06 15:03:34 -05:00			`id ~= 1.0`

			# NOTE: This is pulled in transitively through `twine`, but we also declare
			# NOTE: it explicitly here because `oidc-exchange.py` uses it.
			`# Ref: https://github.com/di/id`
			`requests`
Expose PEP 740 attestations functionality PR #236 This patch adds PEP 740 attestation generation to the workflow: when the Trusted Publishing flow is used, this will generate a publish attestation for each distribution being uploaded. These generated attestations are then fed into `twine`, which newly supports them via `--attestations`. Ref: https://github.com/pypi/warehouse/issues/15871 2024-08-31 20:50:29 -04:00
			`# NOTE: Used to generate attestations.`
requirements: bump pypi-attestations to 0.0.15 Signed-off-by: William Woodruff <william@trailofbits.com> 2024-11-06 17:53:10 -05:00			`pypi-attestations ~= 0.0.15`
bump sigstore==3.5.1 Signed-off-by: William Woodruff <william@trailofbits.com> 2024-10-28 14:29:41 -04:00			`sigstore ~= 3.5.1`
Add nudge message with magic link to create new Trusted Publisher PR #250 Co-authored-by: Sviatoslav Sydorenko <sviat@redhat.com> 2024-09-05 11:25:58 -04:00
			`# NOTE: Used to detect the PyPI package name from the distribution files`
			`packaging`