search

nxp-mcuxpresso / pypemicro

Other
4 stars 3 forks source link

No tags for releases on pypi.org: 0.1.0 to 0.1.9 - excluding 0.1.3 - are affected #11

Closed dvzrv closed 2 years ago

dvzrv commented 2 years ago

Hi! As I'm currently looking into packaging this project as a dependency for other packages (pyocd-pemicro), I am evaluating the upstreams of many packages.

I realized that although this is the upstream for pypemicro, it does not reflect the releases of many versions in this repository. The pypi history of the project shows releases 0.1.0 up to 0.1.9, however currently there is only a tag for 0.1.3 available in this repository.

@Gargy007 as you seem to maintain this repository and the pypi releases, can you please add tags for the releases? It helps downstreams to switch to them if something is wrong with the sdist tarballs on pypi.org and more importantly it enables anyone to lookup changes more easily and mitigate supply chain attacks.

Generally a workflow in which the release to pypi.org is automated in a CI pipeline from a tag (i.e. tag -> pipeline builds/tests -> release sdist/wheel to pypi.org) is advisable for maximum transparency.

Gargy007 commented 2 years ago

Hello, thanks for reporting issue, I added all missing tags and I will think about use of CI pipeline,