trace-registry/pyproject.toml at main · agentrust-io/trace-registry · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "trace-verify"
version = "0.4.1"
description = "Verify TRACE claim inclusion proofs against a TRACE registry anchor"
readme = "README.md"
license = { text = "Apache-2.0" }
requires-python = ">=3.9"
dependencies = ["cryptography>=41.0", "rfc8785>=0.1.2"]
keywords = ["trace", "merkle", "inclusion-proof", "audit", "ai-governance"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.9",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security :: Cryptography",
    "Topic :: Software Development :: Libraries :: Python Modules",
]

[project.optional-dependencies]
signature = []
# The witness verifier needs COSE. Base trace-verify deliberately does not:
# inclusion and chain verification are the common case, and a reader who
# only wants those should not be made to install a CBOR stack for them.
witness = ["cbor2>=5.5", "scitt-cose>=0.3.0"]

[project.scripts]
trace-verify = "trace_verify.__main__:main"

# These pointed at trace-spec because trace-registry was private and every link
# into it returned 404 to a reader of this package, for a week in the case of
# Homepage, Documentation and Changelog. The condition that comment set has been
# met: trace-registry is public. Homepage, Bug Tracker and Changelog come back
# here, because this is where the code, the issues and the changelog actually
# live and a reader filing a trace-verify defect should not have to find that
# out by guessing (they once filed it at trace-spec#138 instead).
#
# The tutorial and the anchor format stay at trace-spec. Those are spec
# documents that happen to describe this implementation, not documents about
# this package, and moving them here would put the normative text behind an
# implementation's URL.
#
# tests/test_trace_verify_pkg.py asserts that any URL naming a file inside this
# repository names one that exists, so a rename fails in CI rather than on PyPI.
# The trace-spec links cannot be checked from here; they are the reason this
# block is commented at all.
[project.urls]
Homepage = "https://github.com/agentrust-io/trace-registry"
Documentation = "https://github.com/agentrust-io/trace-spec/blob/main/docs/tutorials/anchoring-to-the-registry.md"
"Anchor format" = "https://github.com/agentrust-io/trace-spec/blob/main/spec/registry-anchor-v1.md"
"Bug Tracker" = "https://github.com/agentrust-io/trace-registry/issues"
Changelog = "https://github.com/agentrust-io/trace-registry/blob/main/CHANGELOG.md"

[tool.hatch.build.targets.wheel]
packages = ["src/trace_verify"]