Roundup

Latest version: v2.3.0

Safety actively analyzes 642295 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 2 of 21

11b.

cd dist
gpg --detach-sign --armor -u 1F2DD0CB756A76D8 <filename>.tar.gz

you should be prompted to use the roundup release key. If not you
can add --local=roundup-devellists.sourceforge.net.
This will create a file by the name <filename>.tar.gz.asc.

Move file to website/www/signature directory

mv <filename>.tar.gz.asc ../webite/www/signatures/.
hg add ../website/www/signature/<filename>.tar.gz.asc
commiting the file will be done in step 12
cd ..

Add a link to the signature to doc/security.txt. Add a new link
to the start of the signature list in doc/security.txt (look for
the word multicol).

12. Assuming all is well commit and tag the release in the version-control
system.
a) hg commit ... commit any edits from steps 1-5
b) hg tag 2.1.0 use right version. Should create/commit a changeset
c) hg push update main repo
d) hg sum verify that the tag shows up

13. Upload source distribution to PyPI - requires you sign up for a
pypi account and be added as a maintainer to roundup. Ask existing
maintainer for access. Do this using twine (pip install twine).

The original directions used twine to upload the tarball and the
signature, but as of May 2023, PyPI no longer accepts signature
files. So we publish the signature as part of the website.

Use twine to upload the distribution tarball. E.G.

twine upload --repository pypi <filename>.tar.gz

The distribution file should appear on
https://pypi.python.org/pypi/roundup in no time. If you are using
python older than 2.7.13 you need a .pypirc shown below since the
URL has changed.

You can also use twine to upload the .whl (wheel) format
distributions (if created). Follow the directions for generating
the gpg asc files and place the .whl.asc in the signature
directory.

Another way to upload is to use:

python3 setup.py sdist upload --repository pypi

BUT this rebuilds the source distribution tarball and uploads it.
This means that you have uploaded something that is not tested.
Also the metadata in the file changes and will not match the GPG
signature you commited in step 12. So use twine.

14. Refresh website.
website/README.txt
https://www.roundup-tracker.org/ should state that the stable
version is the one that you released.
https://www.roundup-tracker.org/docs.html should also match the
released version (or at least the major non pre-release
1.x/2.x version).

15. Send doc/announcement.txt to python-announcepython.org,
roundup-userslists.sourceforge.net,
roundup-devellists.sourceforge.net, and lwnlwn.net.

11a.

9a.

executable scripts properly and update these directions to test.

python2 setup.py bdist_wheel; python3 setup.py bdist_wheel

to create binary distributions in wheel format. (egg format is
deprecated.)

10. Check the roundup.egg-info/SOURCES.txt to make sure that any new files are
included. (use hg status --rev <last release or tag>:tip to list changed
added and removed files. Last release e.g. 1.5.1 where tip is what would
become 1.6) E.G.

hg status --rev 2.2.0:tip | sed -ne 's/^A //p' | while read i ; \
do echo $i; grep "$i" roundup.egg-info/SOURCES.txt; done | \
uniq -c | sort -rn

Anything with a count of 1 is not in the manifest.
If there are missing files that should be in the manifest,
edit MANIFEST.in to include them. For format docs see
https://packaging.python.org/guides/using-manifest-in/#using-manifest-in
(Note: files under website/ shouldn't be in the manifest.)
10a: Check for removed files still in manifest:

hg status --rev 2.2.0:tip | sed -ne 's/^R //p' | while read i ; \
do echo $i; grep "$i" roundup.egg-info/SOURCES.txt; done | \
uniq -c | sort -n

any file with a count of 2 or more needs to be removed from
MANIFEST.in and possibly cleaned out of the build tree.
10b: if you added/removed files rebuild starting at step 6a.

11. Unpack the new tarball created in dist/roundup-<version>.tar.gz
file in /tmp then
a) run tests using installed pytest run under python2 and
python3. (python2 -m pytest test/; python3 -m pytest test/)
b) demo.py
with all available Python versions.

6a.

cd locale
make
cd ..

7. Remove previous build files

python3 setup.py clean --all
rm -rf build/share deletes locale .mo files

Build including new .mo files built in 6a.

python3 setup.py build

(sdist generation will fail if this isn't done)

8. Rebuild documentation in "share/doc/roundup/html"

python3 setup.py build_doc

9. Generate source distribution:

python3 setup.py sdist

(if you find sdist a little verbose, add "--quiet" to the end of the
command)

4a.

_tmp/linkcheck/output.txt
fix broken references in docs
verify redirects are correct

Use::

grep '\[broken\]\s*htt' _tmp/linkcheck/output.txt

to find external refs only. Internal refs will probably fail
because they don't use :ref: or :doc: roles to reference them.
They are referenced using html link syntax.

5. Update setup.py info if needed (contacts, classifiers, etc.). When
releasing check that Development Status matches release: stable,
beta alpha etc.

Check that metadata is valid and long descriptions is proper reST:

python3 setup.py check --restructuredtext --metadata --strict

6. Clean out all *.orig, *.rej, .* files from the source.

find . -name '*.orig' -exec rm {} \;
find . -name '*.rej' -exec rm {} \;
find . -name '.*' -exec rm {} \;

3b.

release, churn contributers etc.). (Use hg churn -c -r ..)

4. Update documentation
doc/announcement.txt
doc/upgrading.txt

Use::

sed -ne '/^20[0-9][0-9]-XX/,/^202[0-9]-/{/^-/p}' CHANGES.txt | wc -l

to get number of features/fixes included in the release.

Page 2 of 21

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.