chore(meta): add PyPI discovery metadata and regulatory keyword coverage - #106
Merged
Merged
Conversation
The package shipped with no keywords, no classifiers and no license field, so the PyPI page carried zero search facets and no license signal despite the Apache-2.0 LICENSE on disk. Add all three, plus a guard test, since none of this is runtime behaviour and all of it is silently deleteable in a routine pyproject edit. - pyproject: license Apache-2.0, 22 keywords, 15 classifiers - pyproject: rewrite the summary, which read "a tool that that detects" - README: PyPI downloads badge, and a regulatory-risk bullet covering EU AI Act Article 53 / Annex XI, the EU Cyber Resilience Act and FDA 524B, framed as evidence rather than as a compliance verdict - tests: assert the keywords, classifiers, license and README terms hold No runtime code is touched. Refs #122.
`_write_malicious_pt` called `writestr` with a plain entry name, which stamps each entry with the current local time at the DOS format's 2-second granularity. `test_default_scan_preserves_every_1_6_component_field` regenerates the artifact before each of its two scans and then asserts the component hashes match, so it failed whenever the first scan happened to cross a 2-second boundary — a coin flip, latent since the test was written, and unrelated to whatever change is on the branch when it fires. Pin the entry timestamps and add a regression test asserting the fixture is reproducible. Verified by writing the fixture twice 2.1s apart: identical SHA-256 with the fix, different without it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the CLI half of
Lab700xOrg/aisbom-ops#122(SEO/discovery metadata pass).Why
The package shipped with no
keywords, noclassifiersand nolicensefield, so the PyPI page carried zero search facets and no license signal — despite the Apache-2.0LICENSEsitting in the repo. The README also had no coverage of the regulatory terms buyers actually search for (EU AI Act0 hits,Annex XI0,Cyber Resilience Act0,MLSecOps0).What changed
pyproject.toml—license = "Apache-2.0", 22keywords, 15classifiers.pyproject.toml— rewrote the PyPI summary, which read "An AI Supply Chain security tool that that detects…", and aligned it with the GitHub repo description.README.md— PyPI downloads badge; a "The regulatory risk" bullet covering EU AI Act Article 53 / Annex XI, the EU Cyber Resilience Act and FDA §524B.tests/test_packaging_metadata.py— new guards. None of this metadata is runtime behaviour, which is exactly why it needs a test: it is invisible in a normal review and silently deleteable in a routinepyproject.tomledit.The regulatory copy is evidence-framed, never a verdict — it closes with "it doesn't assess or certify compliance, and that assessment stays with you as the provider." It claims no Article 53 feature;
aisbom complyis not built.Verification
poetry run pytest→ 1148 passed, coverage 92.80% (gate 85%).poetry build+ read the real wheelMETADATA→License: Apache-2.0, the fullKeywords:line and every classifier present. Poetry additionally auto-addedProgramming Language :: Python :: 3.14andLicense-File: LICENSE. This proves PyPI rendering without publishing.poetry check→ warnings only, all pre-existing[tool.poetry]-vs-[project]deprecations that affect the existing keys too.aisbom/is touched by this diff, so there is no scan behaviour to regress.Deliberately not done
[project]migration. Poetry warns that movingclassifiersthere disables its automatic enrichment, so we would lose the auto Python/license classifiers. Left as a follow-up.