wasi-python 0.1.0a5

The first release since 0.1.0a3. 0.1.0a4 was tagged but never published (see its section):
everything listed under 0.1.0a4 ships in this release too, including the security fixes of specs
048 and 056.

• Read-only code on the import path (spec 054). Added: run(import_path=[…]) and
  run_async(import_path=[…]), and wasi-python run --import-path GUEST. Each entry, a folder
  or a zip file inside a read-only grant, goes on sys.path after the stdlib zip. The runner
  refuses, before any work, an entry the root, a writable grant or a mount serves, a writable
  grant or a mount under an entry, and a writable grant or root inside the grant serving one.
  No .pyc is written. A module the runtime has is always the runtime's; one it looks for and
  lacks (_hashlib, pytz, …) is taken from an entry, on the plain binary also for packages
  the snapshot pre-imported (README, The import path). Fixed (docs): the README no longer says
  a writable mount at / puts / on a -c program's sys.path; nothing writable is ever
  there.
• A Windows grant renames a folder over a file (spec 058). The 0.1.0a4 release run stopped
  on Windows, where a writable grant lets os.rename replace a file with a folder; a mount
  answers ENOTDIR (54) there as on every host, and as a Linux or macOS grant does. The judge
  now asserts that row's grant answer, and the listing that follows from it, exactly per system,
  and the mount's answer everywhere; Linux's and macOS's assertions are kept, and each gains an
  exact value. The README names it, and a second Windows difference the same run showed: a
  Windows grant cannot remove or rename a file the guest holds open, so tempfile.TemporaryFile
  fails there. Nothing in the runtime or the artifact set changes.
• The public API is frozen and documented (spec 049).
  • Added: defaults() and set_defaults(), which replace assigning
    wasi_python.runner.DEFAULTS (that still works, unpromised, until the internal name
    changes); Defaults and stats() at the top level; PROTOCOL in
    wasi_python.tools.__all__; py.typed, so a type checker reads the package's hints; tool's
    two overloads, so a function decorated with @tool keeps a type; and the README's "API
    reference", generated from the same render as tests/public_api.txt, the judge's snapshot of
    the surface.
  • Changed: the seventeen other wasi_python.tools constants (TOOL_REQUEST_BYTES and the
    rest) and wasi_python's ARTIFACT_DIR, ARTIFACTS_ENV and CHECKOUT_ARTIFACT_DIR are
    private, each with a leading _; the numbers stay in the README. Defaults' memory_bytes,
    deadline_s, output_bytes and file_calls are annotated … | None, host as returning
    bytes | bytearray | memoryview, and Mount.provider as a FileProvider, as the code
    already accepts. A call reads the defaults once, when it is made, so a set_defaults on
    another thread never gives it a mix. The README no longer names wasi_python.runner or
    DEFAULTS.
  • The promise, from 0.1.0, the first final release: a patch release changes nothing
    public; a minor release may add; a deprecated thing keeps working for at least two final
    minor releases (deprecated in 0.N, removable in 0.N+2); a tighter default, in a minor release,
    and a security fix, in any release, need no deprecation. The README's "API reference" says
    what is promised and what is not.

Verify a download (gh logged in; see the README's Verifying a download):

gh attestation verify <asset> --repo ClayGendron/wasi_python \
  --signer-workflow ClayGendron/wasi_python/.github/workflows/release.yml@refs/tags/v0.1.0a5 \
  --source-ref refs/tags/v0.1.0a5 --deny-self-hosted-runners