sigstore-python
sampleproject
sigstore-python | sampleproject | |
---|---|---|
4 | 18 | |
210 | 4,995 | |
0.5% | 0.5% | |
9.3 | 4.9 | |
7 days ago | about 2 months ago | |
Python | Python | |
GNU General Public License v3.0 or later | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
sigstore-python
-
How to improve Python packaging, or why 14 tools are at least 12 too many
You could use `pip-compile` if you want full pinning. That's what we do on another project -- we use GitHub Actions with `pip-compile` to provide a fully frozen copy of the dependency tree for users who'd like that[1].
In the context of `pip-audit`, that makes a little less sense: most of our dependencies are semantically versioned, and we'd rather users receive patches and fixes to our subdependencies automatically, rather than having to wait for us to release a corresponding fix version. Similarly, we expect users to install `pip-audit` into pre-existing virtual environments, meaning that excessive pinning will produce overly conservative dependency conflict errors.
[1]: https://github.com/sigstore/sigstore-python/tree/main/instal...
-
Use `Python -m Pip`
The conflicting advice is a serious problem.
I hope you'll forgive me for adding one additional piece of advice: for many Python packages, the only packaging metadata you need is `pyproject.toml`. You don't even need `setup.py` anymore, so long as you're using a build backend that supports editable installs with `pyproject.toml`.
Here's an example of a Python package that does everything in `pyproject.toml`[1]. You should be able to copy that into any of your projects, edit it to match your metadata, and everything will work exactly as if you have a `setup.cfg` or `setup.py`.
[1]: https://github.com/sigstore/sigstore-python
-
Bundling binary tools in Python wheels
You're right, both the infrastructure and metadata for cryptographic signatures on Python packages (both wheels and sdists) isn't quite there yet.
At the moment, we're working towards the "e2e" scheme you've described by adding support for Sigstore[1] certificates and signatures, which will allow any number of identities (including email addresses and individual GitHub release workflows) to sign for packages. The integrity/availability of those signing artifacts will in turn be enforced through TUF, like you mentioned.
You can follow some of the related Sigstore-in-Python work here[2], and the ongoing Warehouse (PyPI) TUF work here[3]. We're also working on adding OpenID Connect token consumption[4] to Warehouse itself, meaning that you'll be able to bootstrap from a trusted GitHub workflow to a PyPI release token without needing to share any secrets.
[1]: https://www.sigstore.dev/
[2]: https://github.com/sigstore/sigstore-python
[3]: https://github.com/pypa/warehouse/pull/10870
[4]: https://github.com/pypa/warehouse/pull/11272
- Project sigstore (free software signing service) just released a library to sign and verify python packages
sampleproject
-
Releasing my Python Project
from setuptools import setup, find_packages from src.til_page_builder.version import __version__ as version with open("requirements.txt") as f: requirements = f.read().splitlines() setup( name="til_page_builder", version=version, packages=find_packages(), install_requires=requirements, entry_points={ "console_scripts": [ "til_page_builder=til_page_builder.til_builder_main:main", # Adjust 'module_name' and 'main' accordingly ], }, python_requires=">=3.8", classifiers=[ "Programming Language :: Python :: 3", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", ], author="Amnish Singh Arora", author_email="[email protected]", description="A command-line tool for authoring 'Today I Learned' posts in Markdown, which can be converted to HTML for publishing on the web.", long_description=open("README.md").read(), long_description_content_type="text/markdown", url="https://github.com/pypa/sampleproject", project_urls={ "Homepage": "https://github.com/pypa/sampleproject", "Issues": "https://github.com/pypa/sampleproject/issues", }, )
-
Packaging tutorial: my package installs from test.pypi.org, but I can't import
[project.urls] "Homepage" = "https://github.com/pypa/sampleproject" "Bug Tracker" = "https://github.com/pypa/sampleproject/issues" ```
-
Discock and W4SP Stealer: Malicious pypi packages and horizontally-scrolled masspace imports
We first observed a package performing “starjacking” in the project https://github.com/pypa/sampleproject. We flagged the package for further investigation.
-
How to improve Python packaging, or why 14 tools are at least 12 too many
[2]: https://github.com/pypa/sampleproject/blob/main/pyproject.to...
-
pyproject.toml, setup.cfg, setup.py. What's the difference?
Example Python project uses all of them.
-
NPM like init command for pip
The generated project basically is pypa's sample project(https://github.com/pypa/sampleproject)
-
Building a package as per the PyPA Guidelines
PyPA recommends using a sample project for building reusable packages and is available at: https://github.com/pypa/sampleproject.
-
Reading suggestions on how to structure and name my files
This may help: https://github.com/pypa/sampleproject
- Programar em Python
- How to include non python resource files into a simple python package?
What are some alternatives?
publishing-python-packages - Examples and exercises for Publishing Python Packages from Manning Books 🐍 📦 ⬆️
randfacts - Python module used to generate random facts
pigar - :coffee: A tool to generate requirements.txt for Python project, and more than that. (IT IS NOT A PACKAGE MANAGEMENT TOOL)
python-template - A simple template Python repository which describes a workflow and set of tools, to make group projects more manageable
Nuitka - Nuitka is a Python compiler written in Python. It's fully compatible with Python 2.6, 2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, and 3.11. You feed it your Python app, it does a lot of clever things, and spits out an executable or extension module.
whoami - Tiny Go server that prints os information and HTTP request to output
auditwheel - Auditing and relabeling cross-distribution Linux wheels.
flit - Simplified packaging of Python modules
pip-audit - Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
pip - The Python package installer
chainjacking - Find which of your direct GitHub dependencies is susceptible to RepoJacking attacks
hyper-inspector