#pep740 — Public Fediverse posts

@sysosmaster @0x40k

Trusted Publishing gives provenance of which repo the files were uploaded from, the workflow file, and commit. For example:

https://pypi.org/project/urllib3/2.3.0/#urllib3-2.3.0-py3-none-any.whl

Downstream verification for installers such as pip is the next step:

https://blog.trailofbits.com/2024/11/14/attestations-a-new-generation-of-signatures-on-pypi/

#python #PEP740 #PyPI #TrustedPublishing

Just released: blurb 1.3.0 🚀

blurb is the CLI we use for managing CPython's news/changelog entries.

🗞️ Add support for Python 3.13

🗞️ Drop support for Python 3.8

🗞️ Generate digital attestations for PyPI (PEP 740)

🗞️ Allow running blurb test from blurb-* directories by

🗞️ Add version subcommand

🗞️ Generate __version__ at build to avoid slow importlib.metadata

https://pypi.org/project/blurb/1.3.0/

#Python #CPython #blurb #release #CLI #changelog #news #PEP740 #Python313 #Python38

Just released: pepotron 1.3.0 🚀

🔩 Generate digital attestations for PyPI (PEP 740)

🔩 Drop support for Python 3.8

🔩 Generate __version__ at build to avoid slow importlib.metadata

🔩 Test on CI with uv

https://pypi.org/project/pepotron/1.3.0/

Pepotron is a CLI for opening PEPs in your browser. For example, try:

$ pep 8

$ pep 3.14

$ pep dead batteries

$ pep calendar

#Python #release #pepotron #PEP #CLI #PEP740 #Python38

Just released: pypistats 1.7.0 🚀

📈 Generate digital attestations for PyPI (PEP 740)

📉 Drop support for EOL Python 3.8

📈 Generate __version__ at build to avoid slow importlib.metadata

https://pypi.org/project/pypistats/1.7.0/

#Python #release #pypistats #CLI #PEP740 #Python38