Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No tags for releases on pypi.org: 0.1.0 to 0.1.9 - excluding 0.1.3 - are affected #11

Closed
dvzrv opened this issue Jan 22, 2022 · 1 comment

Comments

@dvzrv
Copy link

dvzrv commented Jan 22, 2022

Hi! As I'm currently looking into packaging this project as a dependency for other packages (pyocd-pemicro), I am evaluating the upstreams of many packages.

I realized that although this is the upstream for pypemicro, it does not reflect the releases of many versions in this repository.
The pypi history of the project shows releases 0.1.0 up to 0.1.9, however currently there is only a tag for 0.1.3 available in this repository.

@Gargy007 as you seem to maintain this repository and the pypi releases, can you please add tags for the releases? It helps downstreams to switch to them if something is wrong with the sdist tarballs on pypi.org and more importantly it enables anyone to lookup changes more easily and mitigate supply chain attacks.

Generally a workflow in which the release to pypi.org is automated in a CI pipeline from a tag (i.e. tag -> pipeline builds/tests -> release sdist/wheel to pypi.org) is advisable for maximum transparency.

@Gargy007
Copy link
Contributor

Gargy007 commented Jan 24, 2022

Hello, thanks for reporting issue, I added all missing tags and I will think about use of CI pipeline,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants