Skip to content

Bump twine to 7.0.0 so it accepts Metadata-Version 2.5 - #24

Merged
imnasnainaec merged 2 commits into
mainfrom
ci/twine-7
Aug 11, 2026
Merged

Bump twine to 7.0.0 so it accepts Metadata-Version 2.5#24
imnasnainaec merged 2 commits into
mainfrom
ci/twine-7

Conversation

@imnasnainaec

@imnasnainaec imnasnainaec commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator

Two commits, both about the same drift: the build backend floats while the tools
around it are pinned.

1. twine 6.2.0 → 7.0.0

Build is red on main and on every open branch:

Checking dist/sil_lift-0.1.0-py3-none-any.whl: ERROR
  InvalidDistribution: Invalid distribution metadata:
  '2.5' is not a valid metadata version

[build-system] requires was unbounded, so python -m build resolves the
current hatchling into its isolated environment. Hatchling 1.32.0 emits
Metadata-Version: 2.5; the packaging bundled with the pinned twine==6.2.0
tops out below that. The distribution is fine — the checker is older than the
metadata standard the backend now writes.

Bumping the checker rather than pinning the backend keeps the distribution
current with the standard instead of freezing it at 2.4. release.yml runs the
same check before publishing to PyPI, so both workflows move together.

2. requires = ["hatchling>=1.27"]

The same unbounded requirement hides a second, quieter problem. license = "MIT"
with license-files is PEP 639, honored by hatchling from 1.27.0. An older
backend builds the wheel without complaint and emits the SPDX string as a legacy
free-text field, dropping License-Expression and License-File:

hatchling Metadata-Version License fields twine check
1.26.3 2.3 License: MIT (legacy free-text) PASSED
1.27.0 2.4 License-Expression: MIT + License-File: LICENSE PASSED
1.32.0 2.5 same as 1.27.0 fails on twine 6.2.0 only

Note that twine check passes the degraded wheel — a build environment
resolving an older hatchling would publish this package as though it had no
machine-readable license, and nothing in CI would say so. The floor declares a
requirement the project already has.

A floor rather than a pin: redistributors build the sdist against their own
packaged hatchling, and an == here would force them to patch
pyproject.toml.

Verified locally with the floor in place: python -m build produces
Metadata-Version: 2.5 with License-Expression: MIT and
License-File: LICENSE; twine check passes wheel and sdist.

Nothing enforces this floor — as with every other >= in pyproject.toml.
Filed separately: a minimum-versions CI leg that would make all of them tested
claims, and which is where a license-metadata assertion belongs.

Once this lands, main merged forward turns Build green on #22 and #23,
which fail only there.


This change is Reviewable

imnasnainaec and others added 2 commits August 11, 2026 15:02
`twine check` fails both workflows on every branch:

    InvalidDistribution: Invalid distribution metadata: '2.5' is not a
    valid metadata version

`[build-system] requires = ["hatchling"]` is unpinned, so `python -m build`
resolves the current hatchling into its isolated environment. Hatchling 1.32.0
emits `Metadata-Version: 2.5`, which the `packaging` bundled with twine 6.2.0
does not know. Nothing in the distribution is wrong — the checker is older than
the metadata standard the backend now writes.

twine 7.0.0 pulls packaging 26.x, which accepts 2.5; both the wheel and the
sdist pass. Bumping the checker rather than pinning the backend keeps the
distribution current with the standard instead of freezing it at 2.4.

Release runs the same check before publishing, so both workflows move together.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`license = "MIT"` with `license-files` is PEP 639, which hatchling honors from
1.27.0. An older backend builds the wheel without complaint and emits the SPDX
string as a legacy free-text field instead, dropping `License-Expression` and
`License-File` entirely — hatchling 1.26.3 produces `Metadata-Version: 2.3` and
`License: MIT`, which `twine check` passes. The requirement is already real; an
unbounded `requires` merely left it undeclared, so a build environment that
resolved an older hatchling would publish the package as though it had no
machine-readable license.

A floor rather than a pin: redistributors build the sdist against their own
packaged hatchling, and an `==` here would force them to patch pyproject.toml.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@imnasnainaec imnasnainaec self-assigned this Aug 11, 2026
@imnasnainaec imnasnainaec added the 🟥High High-priority PR: please review this asap! label Aug 11, 2026
@imnasnainaec
imnasnainaec merged commit 3929c42 into main Aug 11, 2026
12 checks passed
@imnasnainaec
imnasnainaec deleted the ci/twine-7 branch August 11, 2026 19:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🟥High High-priority PR: please review this asap!

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant