v0.7.4

See CHANGELOG.md. Verify what you download: carry SHA256SUMS beside the file and ask it about that file, grep " iirds.pyz$" SHA256SUMS | shasum -a 256 -c - — -c on the whole file fails on the assets you did not take. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it. Upgrading an environment that has iirds-validate 0.4.2 or earlier: pip uninstall -y iirds-validate first, then pip install -U iirds. If you already ran pip install -U iirds-validate and no command runs, pip install --force-reinstall --no-deps iirds restores it. Installs that began at 0.5.0 or later are unaffected.

v0.7.3

See CHANGELOG.md. Verify what you download: carry SHA256SUMS beside the file and ask it about that file, grep " iirds.pyz$" SHA256SUMS | shasum -a 256 -c - — -c on the whole file fails on the assets you did not take. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it. Upgrading an environment that has iirds-validate 0.4.2 or earlier: pip uninstall -y iirds-validate first, then pip install -U iirds. If you already ran pip install -U iirds-validate and no command runs, pip install --force-reinstall --no-deps iirds restores it. Installs that began at 0.5.0 or later are unaffected.

v0.7.2

See CHANGELOG.md. Verify what you download: carry SHA256SUMS beside the file and ask it about that file, grep " iirds.pyz$" SHA256SUMS | shasum -a 256 -c - — -c on the whole file fails on the assets you did not take. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it. Upgrading an environment that has iirds-validate 0.4.2 or earlier: pip uninstall -y iirds-validate first, then pip install -U iirds. If you already ran pip install -U iirds-validate and no command runs, pip install --force-reinstall --no-deps iirds restores it. Installs that began at 0.5.0 or later are unaffected.

v0.7.1

See CHANGELOG.md. Verify what you download: carry SHA256SUMS beside the file and ask it about that file, grep " iirds.pyz$" SHA256SUMS | shasum -a 256 -c - — -c on the whole file fails on the assets you did not take. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it. Upgrading an environment that has iirds-validate 0.4.2 or earlier: pip uninstall -y iirds-validate first, then pip install -U iirds. If you already ran pip install -U iirds-validate and no command runs, pip install --force-reinstall --no-deps iirds restores it. Installs that began at 0.5.0 or later are unaffected.

v0.6.3

Who should take this release: anyone running 0.6.2 against packages they did not build. One rendition this checker could not decompress decided what every other content rule examined, and the rules that saw a truncated file set were recorded as having checked the package. The damaged file is reported now and the sound ones are examined; ERROR S16 names a file the container lists as content and will not hand over. A legal package that passed on 0.6.2 passes on 0.6.3.

See CHANGELOG.md, section 0.6.3, for the full notes. Verify what you download: shasum -a 256 -c SHA256SUMS. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it.

v0.6.2

Who should take this release: anyone who checks .iirds files they did not build themselves. Every release up to 0.6.1 can be made to spend far more time and memory on a container than its size suggests, by a container that says so in its own records. A package that passed on 0.6.1 with a bzip2- or lzma-compressed entry fails on 0.6.2 (S14); that is the repair.

See CHANGELOG.md, section 0.6.2, for the full notes. Verify what you download: shasum -a 256 -c SHA256SUMS. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it.

v0.6.1

Who should take this release: anyone on 0.6.0 or earlier who checks an unpacked directory, or points the checker at a directory of packages. Checking .iirds files and nothing else is not affected. The advisory is GHSA-836f-9r66-gxcc.

See CHANGELOG.md. Verify what you download: shasum -a 256 -c SHA256SUMS. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it.

v0.6.0

See CHANGELOG.md. Verify what you download: shasum -a 256 -c SHA256SUMS. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it.

Upgrade note (added 2026-09-07). Upgrading an environment that holds iirds-validate 0.4.2 or earlier with pip install -U iirds-validate leaves it with no working command, and pip list and pip check both report it healthy — 0.5.0 onwards carries no files of its own, so pip writes the new package's iirds_validate/ and then removes the old distribution, deleting every path the two records share.

• Not yet upgraded: pip uninstall -y iirds-validate first, then pip install -U iirds.
• Already upgraded and nothing runs: pip install --force-reinstall --no-deps iirds restores it.
• An install that began at 0.5.0 or later is unaffected.

Added after the fact; the text above this line is what was published at release time.

v0.5.0

See CHANGELOG.md. Verify what you download: shasum -a 256 -c SHA256SUMS. The .pyz needs only a Python — python iirds.pyz your-package.iirds. On PyPI this release is iirds; iirds-validate and iirds-sdk are compatibility names that install it.

Upgrade note (added 2026-09-07). Upgrading an environment that holds iirds-validate 0.4.2 or earlier with pip install -U iirds-validate leaves it with no working command, and pip list and pip check both report it healthy — 0.5.0 onwards carries no files of its own, so pip writes the new package's iirds_validate/ and then removes the old distribution, deleting every path the two records share.

• Not yet upgraded: pip uninstall -y iirds-validate first, then pip install -U iirds.
• Already upgraded and nothing runs: pip install --force-reinstall --no-deps iirds restores it.
• An install that began at 0.5.0 or later is unaffected.

Added after the fact; the text above this line is what was published at release time.

v0.4.2

See CHANGELOG.md. Verify what you download: shasum -a 256 -c SHA256SUMS. The .pyz needs only a Python — python iirds-validate.pyz your-package.iirds.