trailofbits / trailofbits/polyfile

Cut the v0.6.0 release

Open
#3,533 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
390
Forks
31
Avg merge
7h 52m
Merged PRs (30d)
72

Description

Summary

Cut the v0.6.0 release once every other issue in the milestone has merged. This is the last item in
the milestone and it is blocked by all of them.

There are 161 commits since the v0.5.6 tag, and pyproject.toml:12 still reads
version = "0.5.6".

Scope

  1. Bump the version. pyproject.toml:12 is the whole change. polyfile/polyfile.py:19 reads
    __version__ from package metadata through importlib.metadata.version("polyfile"), so nothing
    else carries a hard-coded version string.

  2. Write polyfile_0.6.0.md. Follow the structure of polyfile_0.5.6.md: Performance
    Improvements, Bug Fixes, New Features, Magic Definitions, Breaking Changes, Dependencies. Omit a
    section that has nothing in it.

    The release covers two bodies of work. Summarize rather than list every issue:

    • libmagic fidelity. The definitions moved to 5.48, and all 88 stems of the upstream corpus
      now match what file reports. tests/test_magic.py::KNOWN_FAILURES is empty. #3480 records how
      the previous fourteen failures were retired.
    • Packaging. setup.py was replaced by pyproject.toml and the in-tree PEP 517 backend
      build_backend.py (#3513).

    Call out under Breaking Changes anything in this milestone that changes observable output. At
    minimum: #3499 changes how an untyped indirect offset reads its field, #3500 changes what a
    BOM-prefixed JSON document reports, #3497 changes the accepted values of --format, and #3465
    removes the try_all_offsets parameter from Matcher and Analyzer.

  3. Verify the distribution. uv build, then uvx twine check dist/*. The distributions job in
    .github/workflows/tests.yml already asserts that the wheel is built from the sdist, that no
    non-permissive .ksy reached the sdist, and that the package-data counts match git ls-files;
    confirm it is green rather than re-deriving it.

Note

Publishing is out of scope for the pull request. .github/workflows/pythonpublish.yml runs on
release: published and uploads through PyPI Trusted Publishing, so the actual release is cut from
the GitHub UI after this merges.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Wait for the other milestone issues to merge, then update version = "0.5.6" in pyproject.toml:12 and write polyfile_0.6.0.md following polyfile_0.5.6.md. Summarize the listed libmagic and packaging work, document observable breaking changes, run uv build and uvx twine check dist/*, and confirm the distributions job in .github/workflows/tests.yml is green.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system, documentation, release
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.