Dustin Ingram

icon indicating a website link https://di.dev

icon company @google icon location Philadelphia, PA icon location @google open source security team, @psf / @pypi / @pypa

Results 634 comments of Dustin Ingram

Resolve ResouceWarning and DeprecationWarning messages for 3.11

I think based on https://github.com/python/cpython/issues/93610 they were marked as deprecated, but you might want to follow up there.

Support generating and verifying with "Sigstore" bundles

Marking this blocked on https://github.com/sigstore/cosign/issues/2131

Support generating and verifying with "Sigstore" bundles

Or we could have the repo that defines the specs generate/publish the protos package as well.

Add 'Implement metadata PEPs'

Thanks for this Paul. Does PEP 658 still make sense to implement given [PEP 691](https://peps.python.org/pep-0691/) exists (and directly addresses PEP 658-style metadata?)

Revisiting `tox`'s requirement that `build-system` is defined in `pyproject.toml`

> This has been fixed in tox v4. Thanks, I forgot to check against pre-releases! Feel free to close this as that's sufficient for me. (As an aside, is there...

compatibility: go-tuf ecdsa key format is incompatible

@asraa or @haydentherapper, any thoughts here?

Pluggable credential manager framework proposal [PoC included]

The pip project has a similar feature request: https://github.com/pypa/pip/issues/4475

Document how third parties use our undocumented/unsupported APIs

Looks like `oscrypto` is using `twine.cli.dispatch` as well, I've added it above. I couldn't find any reference to twine in buildout: https://github.com/buildout/buildout/search?q=twine

Document how third parties use our undocumented/unsupported APIs

Besides `DEFAULT_REPOSITORY`/`TEST_REPOSITORY`, it looks like hatch is just using one of the entry points we've explicitly defined: https://github.com/pypa/twine/blob/895ac8af383b99d9b1673f2d7edcea92e4b5a429/setup.cfg#L50-L54 Do we consider that to be an unsupported use of an internal...

Document how third parties use our undocumented/unsupported APIs

~I'm confused. Invoking twine like `python -m twine upload` invokes the entrypoint `main` in `twine.commands.upload`. Hatch is using that entrypoint, if it wasn't defined in `twine/setup.cfg` calling `python -m twine...