What belongs in the manifest? #1708
-
|
I've noticed that some top-level files that are often not included in sdist and wheel distributions for PyPI, such as In spite of being top-level in the repository, arguably A perhaps better reason to omit it is that researchers reporting vulnerabilities are always best informed by whatever the latest guidance in |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment · 4 replies
-
|
That's a great question, and one I have no answer for. I think historically this template was created based on a list of files from the old days without deep thinking, and it hasn't been updated since. To my mind, it should contain whatever is customary so it matches the average person's expectation, but I don't have preferences myself. In Rust, I let my crates only contain the source (without tests), the license and a changelog, as all of these affect the usage of the contents of the package, just because this makes sense to me. |
Beta Was this translation helpful? Give feedback.
-
I'll look into what similarly arranged Python projects that use the setuptools backend and have manifest files are doing with them. |
Beta Was this translation helpful? Give feedback.
-
|
One thing I've come to wonder about is why the problem in gitpython-developers/gitdb#25 happened for gitdb but not for smmap or GitPython (both of which have |
Beta Was this translation helpful? Give feedback.
-
|
Although this isn't a complete (or really any) explanation, on closer inspection, it looks from the error message like this was due to C code in All the C-related stuff in |
Beta Was this translation helpful? Give feedback.
-
|
Relating to #1716 (comment), I think the question of what belongs in |
Beta Was this translation helpful? Give feedback.
That's a great question, and one I have no answer for.
I think historically this template was created based on a list of files from the old days without deep thinking, and it hasn't been updated since.
To my mind, it should contain whatever is customary so it matches the average person's expectation, but I don't have preferences myself.
In Rust, I let my crates only contain the source (without tests), the license and a changelog, as all of these affect the usage of the contents of the package, just because this makes sense to me.