-
Notifications
You must be signed in to change notification settings - Fork 384
Closed
Description
The 1.2.0 release up on PyPI contains python bytecode in the source tarball:
$ mkdir /tmp/invoke-dl/ && cd /tmp/invoke-dl
$ wget https://files.pythonhosted.org/packages/ef/80/cef14194e2dd62582cc0a4f5f2db78fb00de3ba5d1bc0e50897b398ea984/invoke-1.2.0.tar.gz
$ tar xzf invoke-1.2.0.tar.gz
$ find invoke-1.2.0 -name \*.pyc
invoke-1.2.0/invoke/completion/__pycache__/complete.cpython-36.pyc
invoke-1.2.0/invoke/completion/__pycache__/__init__.cpython-36.pyc
These are, transitively, included in the wheel files too.
Please make sure to not include __pycache__ directories in the source tarball. I suspect that it ends up in the source tarball due to the following line in MANIFEST.in:
Line 4 in e4bbd9b
| recursive-include invoke/completion * |
😞
I suspect that all it takes is to add
recursive-exclude * __pycache__
recursive-exclude * *.py[co]
to MANIFEST.in to prevent this.