Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for Metadata 2.2 #833

Merged
merged 5 commits into from Nov 28, 2021
Merged

Add support for Metadata 2.2 #833

merged 5 commits into from Nov 28, 2021

Conversation

bhrutledge
Copy link
Contributor

Closes #753, though I'm starting this as a draft PR because I'm not sure there's enough here.

Changes so far:

  • Require the latest version of pkginfo, which now has support for 2.2
  • Update PackageFile and related tests to recognize new version and the dynamic field

Questions:

@FFY00
Copy link
Member

FFY00 commented Nov 23, 2021

I have not tried it, but the code seems fine to me.

@bhrutledge
Copy link
Contributor Author

I have not tried it, but the code seems fine to me.

@FFY00 Are you able to install Twine from this branch and test it?

@FFY00
Copy link
Member

FFY00 commented Nov 23, 2021

I am, but I don't have time right now, I will try to see if I can find a moment later today.

@tseaver
Copy link
Contributor

tseaver commented Nov 23, 2021

@bhrutledge

The PyPUG defines some rules for Dynamic, and says Name and Version may not be specified as Dynamic. Looking over the relevant pkginfo changes, I don't see any validation of those rules. Where should that happen? Maybe @pfmoore and @tseaver have thoughts?

The mission of pkginfo is to parse metadata from packages released into the wild -- I don't see it as in scope for it to be trying to enforce such rules. That rule, and the Dynamic field in general, are mostly germane for the tools which build distributions from a given sdist -- those tools care about the semantics, and could emit warnings or errors as appropriate.

@pfmoore
Copy link
Member

pfmoore commented Nov 23, 2021

I tend to think of those rules as more about "tools consuming Metadata 2.2 can assume Name and Version are static", rather than anyone needing to validate them. Tools that claim to produce Metadata 2.2 are in violation of the spec if they declare Name or Version as dynamic, so checking the rule is essentially checking whether the producer lied about what it does.

I guess a consumer could check and flag an error if the fields were dynamic. It's no different than flagging if the file is in the wrong format, or a mandatory field is missing, or any other sanity check that a producer delivered what it said it would. I've no opinion on whether pkginfo should do so, though - as far as I'm concerned, that's a decision for the pkginfo authors.

@bhrutledge
Copy link
Contributor Author

bhrutledge commented Nov 24, 2021 •
edited

Thanks all. I wasn't necessarily suggesting that pkginfo should do validation of dynamic; I was more wondering if Twine should. But it sounds like that might be in the same bucket as enhancements to the check command, which is currently blocked on pypa/packaging#147 (which specifically mentions dynamic).

With that in mind, I'll open this up for review and merge.

@bhrutledge bhrutledge marked this pull request as ready for review November 24, 2021 12:53
@bhrutledge bhrutledge mentioned this pull request Nov 24, 2021
Closed
@bhrutledge
Copy link
Contributor Author

@FFY00 Have you had a chance to try this out?

@FFY00
Copy link
Member

FFY00 commented Nov 26, 2021

Not yet, sorry! But the weekend is just around the corner, so hopefully I will have a couple minutes to spare 😅

@FFY00
Copy link
Member

FFY00 commented Nov 27, 2021

I did a quick test and it seems good, thanks!

@sigmavirus24 sigmavirus24 merged commit 4b11da4 into pypa:main Nov 28, 2021
@bhrutledge bhrutledge deleted the 753-metadata-2.2 branch November 28, 2021 10:55
@hroncok
Copy link

hroncok commented Dec 1, 2021

Just a quick check here: Is a release with this planned soon, or should we backport it in Fedora if we want to update pkginfo?

@tseaver
Copy link
Contributor

tseaver commented Dec 1, 2021

The latest release of pkginfo has the feature already.

@hroncok
Copy link

hroncok commented Dec 1, 2021

I've meant a release of twine.

@bhrutledge
Copy link
Contributor Author

I was already planning on releasing this morning. 😉

https://pypi.org/project/twine/3.7.0/

mergify bot pushed a commit to andrewbolster/bolster that referenced this pull request Dec 20, 2021
@dependabot
Bump twine from 3.6.0 to 3.7.1 (#116)
ccba3d2 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [twine](https://github.com/pypa/twine) from 3.6.0 to 3.7.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pypa/twine/releases">twine's releases</a>.</em></p>
<blockquote>
<h2>3.7.1</h2>
<p><a href="https://pypi.org/project/twine/3.7.1/">https://pypi.org/project/twine/3.7.1/</a></p>
<p><a href="https://twine.readthedocs.io/en/stable/changelog.html#twine-3-7-1-2021-12-07">Changelog</a></p>
<h2>3.7.0</h2>
<p><a href="https://pypi.org/project/twine/3.7.0/">https://pypi.org/project/twine/3.7.0/</a></p>
<p><a href="https://twine.readthedocs.io/en/stable/changelog.html#twine-3-7-0-2021-12-01">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pypa/twine/blob/main/docs/changelog.rst">twine's changelog</a>.</em></p>
<blockquote>
<h2>Twine 3.7.1 (2021-12-07)</h2>
<p>Improved Documentation
^^^^^^^^^^^^^^^^^^^^^^</p>
<ul>
<li>Fix broken link to packaging tutorial. (<code>[#844](pypa/twine#844) &lt;https://github.com/pypa/twine/issues/844&gt;</code>_)</li>
</ul>
<h2>Twine 3.7.0 (2021-12-01)</h2>
<p>Features
^^^^^^^^</p>
<ul>
<li>Add support for core metadata version 2.2, defined in PEP 643. (<code>[#833](pypa/twine#833) &lt;https://github.com/pypa/twine/issues/833&gt;</code>_)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pypa/twine/commit/d82cd00d216f6a1768ee835d1b534f16190f35bd"><code>d82cd00</code></a> Update changelog for 3.7.1 (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/845">#845</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/6165fd3f7976690eeeeec5e7411662ff6b704756"><code>6165fd3</code></a> Fix link to packaging tutorial (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/844">#844</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/e2d3f8448fdeadba1388c193be6b66dc93c227ba"><code>e2d3f84</code></a> Update changelog for 3.7.0 (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/842">#842</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/1b9f1cd5662d993afb1603ca32314f63f0472fc5"><code>1b9f1cd</code></a> Tidy up Python versions (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/840">#840</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/4016a6b72f280e7ad29228c5a9eabba8df9f90f9"><code>4016a6b</code></a> Use FORCE_COLOR instead of CLI args (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/839">#839</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/4b11da4f4af88f9d2499dd49a4c4cb230591d4c0"><code>4b11da4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/pypa/twine/issues/833">#833</a> from bhrutledge/753-metadata-2.2</li>
<li><a href="https://github.com/pypa/twine/commit/04f3592b62d2a493b6302cba1ef0c60bc5c1bce7"><code>04f3592</code></a> Upgrade Sphinx to latest bugfix (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/838">#838</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/116a9468159c6c5cdfc23cbc09e65ba83fc5a352"><code>116a946</code></a> Add changelog entry</li>
<li><a href="https://github.com/pypa/twine/commit/c83bb5bcf5d307fc2738cb446c0cf32d49c0e8eb"><code>c83bb5b</code></a> Add color to CI test output (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/834">#834</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/add58705560fc8f7f106a3c9b240def82e6267bc"><code>add5870</code></a> Merge branch 'main' into 753-metadata-2.2</li>
<li>Additional commits viewable in <a href="https://github.com/pypa/twine/compare/3.6.0...3.7.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=twine&package-manager=pip&previous-version=3.6.0&new-version=3.7.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>
mergify bot pushed a commit to aws/jsii that referenced this pull request Feb 3, 2022
@dependabot
chore(deps-dev): Update twine requirement from ~=3.7.1 to ~=3.8.0 in …
b1d0f48 
…/packages/jsii-pacmak/lib/targets/python (#3367)

Updates the requirements on [twine](https://github.com/pypa/twine) to permit the latest version.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pypa/twine/releases">twine's releases</a>.</em></p>
<blockquote>
<h2>3.8.0</h2>
<p><a href="https://pypi.org/project/twine/3.8.0/">https://pypi.org/project/twine/3.8.0/</a></p>
<p><a href="https://twine.readthedocs.io/en/stable/changelog.html#twine-3-8-0-2022-02-02">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pypa/twine/blob/main/docs/changelog.rst">twine's changelog</a>.</em></p>
<blockquote>
<h2>Twine 3.8.0 (2022-02-02)</h2>
<p>Features
^^^^^^^^</p>
<ul>
<li>Add <code>--verbose</code> logging for querying keyring credentials. (<code>[#849](pypa/twine#849) &lt;https://github.com/pypa/twine/issues/849&gt;</code>_)</li>
<li>Log all upload responses with <code>--verbose</code>. (<code>[#859](pypa/twine#859) &lt;https://github.com/pypa/twine/issues/859&gt;</code>_)</li>
<li>Show more helpful error message for invalid metadata. (<code>[#861](pypa/twine#861) &lt;https://github.com/pypa/twine/issues/861&gt;</code>_)</li>
</ul>
<p>Bugfixes
^^^^^^^^</p>
<ul>
<li>Require a recent version of urllib3. (<code>[#858](pypa/twine#858) &lt;https://github.com/pypa/twine/issues/858&gt;</code>_)</li>
</ul>
<h2>Twine 3.7.1 (2021-12-07)</h2>
<p>Improved Documentation
^^^^^^^^^^^^^^^^^^^^^^</p>
<ul>
<li>Fix broken link to packaging tutorial. (<code>[#844](pypa/twine#844) &lt;https://github.com/pypa/twine/issues/844&gt;</code>_)</li>
</ul>
<h2>Twine 3.7.0 (2021-12-01)</h2>
<p>Features
^^^^^^^^</p>
<ul>
<li>Add support for core metadata version 2.2, defined in PEP 643. (<code>[#833](pypa/twine#833) &lt;https://github.com/pypa/twine/issues/833&gt;</code>_)</li>
</ul>
<h2>Twine 3.6.0 (2021-11-10)</h2>
<p>Features
^^^^^^^^</p>
<ul>
<li>Add support for Python 3.10. (<code>[#827](pypa/twine#827) &lt;https://github.com/pypa/twine/issues/827&gt;</code>_)</li>
</ul>
<h2>Twine 3.5.0 (2021-11-02)</h2>
<p>Features
^^^^^^^^</p>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pypa/twine/commit/c5769e0fe27064c77cd5b09512d686913d420f95"><code>c5769e0</code></a> Update 3.8.0 release date (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/863">#863</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/a8333644f21c8f2cf2c086375753fa04aa5b4424"><code>a833364</code></a> Update changelog for 3.8.0 (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/862">#862</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/cf9295f6af8c396a88968b3bef55af981fb62457"><code>cf9295f</code></a> Log all upload responses with <code>--verbose</code> (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/859">#859</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/a60c565dd4560f4afd4780f87ceba84973ffb9fa"><code>a60c565</code></a> Display a more helpful error message for invalid metadata (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/861">#861</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/fd8607d2524356f7e5a17ffa051bf4d2335b74bd"><code>fd8607d</code></a> Fix mypy error from <code>urllib.Retry</code> kwargs (<a href="https://github-redirect.dependabot.com/pypa/twine/issues/858">#858</a>)</li>
<li><a href="https://github.com/pypa/twine/commit/ce87465e0917ed1a9154beb911146e3fe5b022f9"><code>ce87465</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/pypa/twine/issues/850">#850</a> from bhrutledge/847-log-keyring</li>
<li><a href="https://github.com/pypa/twine/commit/7d608424a77dfe10d63910a18db17723cb2ff213"><code>7d60842</code></a> Add changelog entry</li>
<li><a href="https://github.com/pypa/twine/commit/5f1a5a478ca1f61f2ff99a951e021aed6863401c"><code>5f1a5a4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/pypa/twine/issues/849">#849</a> from bhrutledge/847-log-keyring</li>
<li><a href="https://github.com/pypa/twine/commit/86723c468b8cba1afc61419d1df6363beccb34a3"><code>86723c4</code></a> Add verbose logging for getting keyring credentials</li>
<li>See full diff in <a href="https://github.com/pypa/twine/compare/3.7.1...3.8.0">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>
@bhrutledge bhrutledge mentioned this pull request Jun 6, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sigmavirus24 sigmavirus24 sigmavirus24 approved these changes

@FFY00 FFY00 Awaiting requested review from FFY00

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add support for metadata 2.2
6 participants
@bhrutledge @FFY00 @tseaver @pfmoore @hroncok @sigmavirus24