pypi-publish/requirements/runtime.in

twine

# NOTE: Used to detect an ambient OIDC credential for OIDC publishing,
# NOTE: as well as PEP 740 attestations.
id ~= 1.0

# NOTE: This is pulled in transitively through `twine`, but we also declare
# NOTE: it explicitly here because `oidc-exchange.py` uses it.
# Ref: https://github.com/di/id
requests

# NOTE: Used to generate attestations.
pypi-attestations ~= 0.0.13
sigstore ~= 3.5.1

# NOTE: Used to detect the PyPI package name from the distribution files
packaging
Integrate pip-tools-generated constraint files This patch adds constraint files with the dependency tree generated by `pip-compile` under Python 3.9. They are now integrated into the action container image. Refs: * https://github.com/pypa/gh-action-pypi-publish/issues/101 * https://github.com/pypa/gh-action-pypi-publish/issues/107 2022-11-30 04:17:33 -05:00			`twine`
Document broken `pkginfo==1.9.0` transitive dep Refs: * https://github.com/pypa/gh-action-pypi-publish/issues/107 2022-11-30 04:32:45 -05:00
Expose PEP 740 attestations functionality PR #236 This patch adds PEP 740 attestation generation to the workflow: when the Trusted Publishing flow is used, this will generate a publish attestation for each distribution being uploaded. These generated attestations are then fed into `twine`, which newly supports them via `--attestations`. Ref: https://github.com/pypi/warehouse/issues/15871 2024-08-31 20:50:29 -04:00			`# NOTE: Used to detect an ambient OIDC credential for OIDC publishing,`
			`# NOTE: as well as PEP 740 attestations.`
OIDC beta support Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua> 2023-03-06 15:03:34 -05:00			`id ~= 1.0`

			# NOTE: This is pulled in transitively through `twine`, but we also declare
			# NOTE: it explicitly here because `oidc-exchange.py` uses it.
			`# Ref: https://github.com/di/id`
			`requests`
Expose PEP 740 attestations functionality PR #236 This patch adds PEP 740 attestation generation to the workflow: when the Trusted Publishing flow is used, this will generate a publish attestation for each distribution being uploaded. These generated attestations are then fed into `twine`, which newly supports them via `--attestations`. Ref: https://github.com/pypi/warehouse/issues/15871 2024-08-31 20:50:29 -04:00
			`# NOTE: Used to generate attestations.`
requirements: bump sigstore, pypi-attestations Signed-off-by: William Woodruff <william@trailofbits.com> 2024-10-22 12:40:04 -04:00			`pypi-attestations ~= 0.0.13`
bump sigstore==3.5.1 Signed-off-by: William Woodruff <william@trailofbits.com> 2024-10-28 14:29:41 -04:00			`sigstore ~= 3.5.1`
Add nudge message with magic link to create new Trusted Publisher PR #250 Co-authored-by: Sviatoslav Sydorenko <sviat@redhat.com> 2024-09-05 11:25:58 -04:00
			`# NOTE: Used to detect the PyPI package name from the distribution files`
			`packaging`