Bump twine to 7.0.0 so it accepts Metadata-Version 2.5 - #24
Merged
Conversation
`twine check` fails both workflows on every branch:
InvalidDistribution: Invalid distribution metadata: '2.5' is not a
valid metadata version
`[build-system] requires = ["hatchling"]` is unpinned, so `python -m build`
resolves the current hatchling into its isolated environment. Hatchling 1.32.0
emits `Metadata-Version: 2.5`, which the `packaging` bundled with twine 6.2.0
does not know. Nothing in the distribution is wrong — the checker is older than
the metadata standard the backend now writes.
twine 7.0.0 pulls packaging 26.x, which accepts 2.5; both the wheel and the
sdist pass. Bumping the checker rather than pinning the backend keeps the
distribution current with the standard instead of freezing it at 2.4.
Release runs the same check before publishing, so both workflows move together.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`license = "MIT"` with `license-files` is PEP 639, which hatchling honors from 1.27.0. An older backend builds the wheel without complaint and emits the SPDX string as a legacy free-text field instead, dropping `License-Expression` and `License-File` entirely — hatchling 1.26.3 produces `Metadata-Version: 2.3` and `License: MIT`, which `twine check` passes. The requirement is already real; an unbounded `requires` merely left it undeclared, so a build environment that resolved an older hatchling would publish the package as though it had no machine-readable license. A floor rather than a pin: redistributors build the sdist against their own packaged hatchling, and an `==` here would force them to patch pyproject.toml. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits, both about the same drift: the build backend floats while the tools
around it are pinned.
1.
twine6.2.0 → 7.0.0Buildis red onmainand on every open branch:[build-system] requireswas unbounded, sopython -m buildresolves thecurrent hatchling into its isolated environment. Hatchling 1.32.0 emits
Metadata-Version: 2.5; thepackagingbundled with the pinnedtwine==6.2.0tops out below that. The distribution is fine — the checker is older than the
metadata standard the backend now writes.
Bumping the checker rather than pinning the backend keeps the distribution
current with the standard instead of freezing it at 2.4.
release.ymlruns thesame check before publishing to PyPI, so both workflows move together.
2.
requires = ["hatchling>=1.27"]The same unbounded requirement hides a second, quieter problem.
license = "MIT"with
license-filesis PEP 639, honored by hatchling from 1.27.0. An olderbackend builds the wheel without complaint and emits the SPDX string as a legacy
free-text field, dropping
License-ExpressionandLicense-File:twine checkLicense: MIT(legacy free-text)License-Expression: MIT+License-File: LICENSENote that
twine checkpasses the degraded wheel — a build environmentresolving an older hatchling would publish this package as though it had no
machine-readable license, and nothing in CI would say so. The floor declares a
requirement the project already has.
A floor rather than a pin: redistributors build the sdist against their own
packaged hatchling, and an
==here would force them to patchpyproject.toml.Verified locally with the floor in place:
python -m buildproducesMetadata-Version: 2.5withLicense-Expression: MITandLicense-File: LICENSE;twine checkpasses wheel and sdist.Nothing enforces this floor — as with every other
>=inpyproject.toml.Filed separately: a minimum-versions CI leg that would make all of them tested
claims, and which is where a license-metadata assertion belongs.
Once this lands,
mainmerged forward turnsBuildgreen on #22 and #23,which fail only there.
This change is