Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add "requires_typeshed" property to prepare for external dependencies #59

Closed
wants to merge 4 commits into from

Conversation

hauntsaninja
Copy link
Contributor

@hauntsaninja hauntsaninja commented Sep 16, 2022

@ilevkivskyi
Copy link
Contributor

Not allowing runtime packages was intentional, otherwise this becomes a security hole. (Especially taking into account that the plan was to give more people typeshed commit rights in future).

@ilevkivskyi
Copy link
Contributor

cc @JukkaL

@hauntsaninja
Copy link
Contributor Author

This is a feature we absolutely need, so we should discuss how we can make it happen. Maybe we can have an allowlist of packages like numpy and cryptography that we trust? Let's move discussion to python/typeshed#5768

I'll also remove requires_external from this PR to reduce scope while we figure out what is needed to make it okay.

@hauntsaninja hauntsaninja changed the title Allow stubs to have external dependencies Rename "requires" field to "requires_typeshed" to prepare for external dependencies Sep 16, 2022
@hauntsaninja hauntsaninja changed the title Rename "requires" field to "requires_typeshed" to prepare for external dependencies Add "requires_typeshed" property to prepare for external dependencies Sep 21, 2022
@hauntsaninja hauntsaninja marked this pull request as ready for review September 21, 2022 04:33
@hauntsaninja
Copy link
Contributor Author

@srittau I've updated this PR to not make any changes to METADATA.toml (or to allow external dependencies). This PR now basically just updates all existing uses of requires that assume it contains typeshed dists to use requires_typeshed property. We also tweak some exceptions and get packaging to do some more stuff for us.

@hauntsaninja
Copy link
Contributor Author

Actually, I'm going to close this out and fold it into the PR that allows external dependencies. This PR ended up pretty watered down and some of the code that this touches goes away, so not sure that it's that helpful to have this split.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants