Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
pkginfo
READMEThis package provides an API for querying the distutils metadata written in
the PKG-INFO
file inside a source distribution (an sdist
) or a
binary distribution (e.g., created by running bdist_egg
). It can
also query the EGG-INFO
directory of an installed distribution, and
the *.egg-info
stored in a "development checkout"
(e.g, created by running setup.py develop
).
Please see the pkginfo docs <http://packages.python.org/pkginfo>
_
for detailed documentation.
pkginfo
ChangelogAdd support for Python 3.13.
Drop support for Python 3.7.
Emit warnings for distributions parsed with unknown metadata versions, or metadata versions newer than highest supported version. LP #2058697.
Improve exception message when failing to find a valid 'PKG-INFO' file within an 'sdist' archive. LP #2064652.
Add support for Python 3.11 and 3.12.
Drop support for Python 3.6.
Declare explicit testing dependency on 'wheel'.
Add support for Metadata 2.3.
Add stricter typing checks, matching those used in 'twine'.
Fix typing errors / gaps reported from 'twine' CI failure. LP #2002104.
Restore a deprecated alias for the '_must_decode' helper function, moved from 'pkginfo._compat.must_decode' to 'pkginfo.distribution._must_decode' in 1.90.
Repair unit tests broken by dropping Python 2.7 classifier.
Drop support for Python 2.7.
Switch to use 'pytest' vs. 'nose', which doesn't support Python > 3.9.
Support new standard metadata location for installed dists. LP #1865286.
Don't overwrite header-based 'description' with empty payload. LP #1885458.
Add support for Metadata-Version 2.2. LP #1928729.
Add support for uncompressed tarballs for sdists. LP #1951457.
Add support for Python 3.10.
Add support for Python 3.9.
Drop support for Python 3.5.
Add support for Python 3.8. LP #1869854.
Drop support for Python 3.4.
Update tests to match setuptools' change, no longer reporting metadata version for installed packages w/o explicit metadata. LP #1870197.
Fix 'console_scripts' entry point syntax. LP #1810734.
Add support for JSON output from the CLI. LP #1700580.
Add support for installed wheels. E.g., 'dist-info/' dirs. LP #1700200.
Harden metadata extraction against unexpected encodings. LP #1780454.
Update tests to match pip/setuptools' use of new metadata version. LP #1772274.
Add support for Python 3.6 and 3.7.
Drop support for Python 3.3.
Use relative imports in pkginfo modules. Supports vendoring of the package into setuptools.
Add support for Provides-Extra
and Description-Content-Type
fields.
Per https://packaging.python.org/specifications/. See: PEP 566.
Remove support for old setuptools leaving PKG-INFO
in the root of
the project directory.
Update homepage URL to point to Launchpad, rather than PyPI.
Add support for building wheels.
Add support for Python 3.5.
Drop support for Python 2.6 and 3.2.
Add support for Python 3.4, PyPy3.
Add 100% coverage for pkginfo.commandline
module.
twine
package.Support "develop" packages which keep their *.egg-info
in a subdirectory.
See https://bugs.launchpad.net/pkginfo/+bug/919147.
Add support for "unpacked SDists" (thanks to Mike Lundy for the patch).
Suppress resource warning leaks reported against clients.
Fix 'commandline' module under Py3k.
Add support for Python 3.2 and 3.3, including testing them under tox
.
Add support for PyPy, including testing it under tox
.
Test supported Python versions under tox
.
Drop support for Python 2.5.
Add a setup.py dev
alias: runs setup.py develop
and installs
testing extras (nose
and coverage
).
Fix introspection of installed namespace packages. They may be installed as eggs or via dist-installed 'egg-info' files. https://bugs.launchpad.net/pkginfo/+bug/934311
Avoid a regression in 0.8 under Python 2.6 / 2.7 when parsing unicode. https://bugs.launchpad.net/pkginfo/+bug/733827/comments/3
Work around Python 2.7's breakage of StringIO. Fixes https://bugs.launchpad.net/pkginfo/+bug/733827
Fix bug in introspection of installed packages missing the
__package__
attribute.
Preserve newlines in the description
field. Thanks to Sridhar
Ratnakumar for the patch.
100% test coverage.
Replace use of StringIO.StringIO
with io.StringIO
, where available
(Python >= 2.6).
Replace use of rfc822
stdlib module with email.parser
, when
available (Python >= 2.5). Ensured that distributions "unfold" wrapped
continuation lines, stripping any leading / trailing whitespace, no matter
which module was used for parsing.
Remove bogus testing dependency on zope.testing
.
Add tests that the "environment markers" spelled out in the approved PEP 345 are captured.
Add Project-URL
for 1.2
PKG-INFO metadata (defined in the accepted
version of PEP 345).
Marked package as non-zip-safe.
Fix Trove metadata misspelling.
Restore compatibility with Python 2.4.
Note that the introspection of installed packages / modules works only in Python 2.6 or later.
Add Index
class as an abstraction over a collection of distributions.
Add download_url_prefix
argument to pkginfo
script. If passed,
the script will use the prefix to synthesize a download_url
for
distributions which do not supply that value directly.
__file__
or PKG-INFO
.Extend the console script to allow output as CSV or INI. Also, added arguments to specify the metadata version and other parsing / output policies.
Add support for the different metadata versions specified in PEPs
241, 314, and 345. Distributions now parse and expose only the attributes
corresponding to their metadata version, which defaults to the version
parsed from the PKG-INFO
file. The programmer can override that version
when creating the distribution object.
Add support for introspection of "development eggs" (checkouts with
PKG-INFO
, perhaps created via setup.py develop
).
Add a console script, pkginfo
, which takes one or more paths
on the command line and writes out the associated information. Thanks
to runeh
for the patch!
Add get_metadata
helper function, which dispatches a given path or
module across the available distribution types, and returns a distribution
object. Thanks to runeh
for the patch!
Make distribution objects support iteration over the metadata fields.
Thanks to runeh
for the patch!
Make Distribution
and subclasses new-style classes. Thanks to runeh
for the patch!
bdist_egg
binary distributions.FAQs
Query metadata from sdists / bdists / installed packages.
We found that pkginfo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.