caddyserver 2.11.7__tar.gz

caddyserver-2.11.7/LICENSE

@@ -0,0 +1,27 @@
+MIT License
+
+Copyright (c) 2026 Sushant Gautam
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+The bundled `caddy` binaries are the official Caddy builds, distributed under
+Caddy's own license (Apache-2.0) by Caddy Server Pty Ltd — see
+https://github.com/caddyserver/caddy

caddyserver-2.11.7/PKG-INFO

@@ -0,0 +1,102 @@
+Metadata-Version: 2.1
+Name: caddyserver
+Version: 2.11.7
+Summary: Caddy web server as platform-specific Python wheels - pip/pipx/uvx installable, offline, no first-run download
+Author: Sushant Gautam
+License: MIT
+Requires-Python: >=3.9
+Project-URL: Homepage, https://github.com/SushantGautam/caddyserve-wheel
+Project-URL: Repository, https://github.com/SushantGautam/caddyserve-wheel
+Project-URL: Issues, https://github.com/SushantGautam/caddyserve-wheel/issues
+Keywords: caddy,webserver,binary,distribution,http3,https
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Server
+Description-Content-Type: text/markdown
+
+# caddyserver
+
+The [Caddy](https://caddyserver.com/) web server as a Python wheel — install with
+`pip`/`uvx`, no mise, no Docker, no Homebrew, no first-run download.
+**Works offline after install.** `pip`/`uv` picks the right binary for your OS
+and architecture automatically (Windows, macOS, Linux; x86-64 and ARM64).
+
+> [!IMPORTANT]
+> **Community-maintained, not the Caddy project.** Official project:
+> https://caddyserver.com / https://github.com/caddyserver/caddy. The binaries
+> here are the official Caddy builds, repackaged as wheels.
+> **Handover:** happy to **hand over the `caddyserver` PyPI project to the
+> official Caddy team** if they want to maintain it — open an issue.
+
+## Quick run (no install)
+
+```console
+uvx caddyserver version
+uvx caddyserver file-server --listen :8080
+```
+
+`uvx caddyserver ...` runs Caddy directly — anything after `caddyserver` is
+passed straight to the Caddy CLI.
+
+## Install
+
+```console
+pip install caddyserver       # or: uv tool install caddyserver / pipx install caddyserver
+caddy version
+```
+
+## CLI usage
+
+The wheel puts the real `caddy` binary on your PATH, so the full official CLI
+works as-is:
+
+```console
+caddy version                        # show version
+caddy file-server --listen :8080     # serve the current directory
+caddy run --config Caddyfile         # start with your Caddyfile
+caddy validate --config Caddyfile    # check config syntax
+caddy adapt --config Caddyfile       # Caddyfile -> JSON
+caddy list modules                   # list compiled-in modules
+```
+
+Any `caddy` subcommand works — this is the unmodified official binary.
+A `caddyserver` console script does the same thing (Python launcher), useful
+when `bin/` is not on PATH: `uvx caddyserver version`.
+
+### Programmatic use
+
+```python
+from caddyserver import get_caddy_executable
+exe = get_caddy_executable()  # Path to the bundled caddy binary
+```
+
+The package **version mirrors the Caddy version**
+(e.g. `caddyserver==2.11.7` bundles Caddy v2.11.7).
+
+## Maintenance
+
+Committed to tracking the **latest Caddy release** — a bump is one line plus a
+tag, and the pipeline builds, verifies, and publishes automatically.
+**If I am slow to pick up a new Caddy release, [open an issue](https://github.com/SushantGautam/caddyserve-wheel/issues) —
+I will push a new version promptly.** PRs bumping `build/version.txt` welcome.
+
+## Verification
+
+Every GitHub Release lists the **wheel SHA-256** and the **upstream Caddy
+asset digest** for each file; the build fails hard if any downloaded asset
+doesn't match the [official checksums](https://github.com/caddyserver/caddy/releases).
+
+## Version bump (maintainers)
+
+```bash
+echo "2.12.0" > build/version.txt
+# also update pyproject.toml version + src/caddyserver/__init__.py __version__
+git commit -am "bump to 2.12.0"
+git tag v2.12.0 && git push --tags   # CI builds, verifies, publishes
+```
+

caddyserver-2.11.7/README.md

@@ -0,0 +1,80 @@
+# caddyserver
+
+The [Caddy](https://caddyserver.com/) web server as a Python wheel — install with
+`pip`/`uvx`, no mise, no Docker, no Homebrew, no first-run download.
+**Works offline after install.** `pip`/`uv` picks the right binary for your OS
+and architecture automatically (Windows, macOS, Linux; x86-64 and ARM64).
+
+> [!IMPORTANT]
+> **Community-maintained, not the Caddy project.** Official project:
+> https://caddyserver.com / https://github.com/caddyserver/caddy. The binaries
+> here are the official Caddy builds, repackaged as wheels.
+> **Handover:** happy to **hand over the `caddyserver` PyPI project to the
+> official Caddy team** if they want to maintain it — open an issue.
+
+## Quick run (no install)
+
+```console
+uvx caddyserver version
+uvx caddyserver file-server --listen :8080
+```
+
+`uvx caddyserver ...` runs Caddy directly — anything after `caddyserver` is
+passed straight to the Caddy CLI.
+
+## Install
+
+```console
+pip install caddyserver       # or: uv tool install caddyserver / pipx install caddyserver
+caddy version
+```
+
+## CLI usage
+
+The wheel puts the real `caddy` binary on your PATH, so the full official CLI
+works as-is:
+
+```console
+caddy version                        # show version
+caddy file-server --listen :8080     # serve the current directory
+caddy run --config Caddyfile         # start with your Caddyfile
+caddy validate --config Caddyfile    # check config syntax
+caddy adapt --config Caddyfile       # Caddyfile -> JSON
+caddy list modules                   # list compiled-in modules
+```
+
+Any `caddy` subcommand works — this is the unmodified official binary.
+A `caddyserver` console script does the same thing (Python launcher), useful
+when `bin/` is not on PATH: `uvx caddyserver version`.
+
+### Programmatic use
+
+```python
+from caddyserver import get_caddy_executable
+exe = get_caddy_executable()  # Path to the bundled caddy binary
+```
+
+The package **version mirrors the Caddy version**
+(e.g. `caddyserver==2.11.7` bundles Caddy v2.11.7).
+
+## Maintenance
+
+Committed to tracking the **latest Caddy release** — a bump is one line plus a
+tag, and the pipeline builds, verifies, and publishes automatically.
+**If I am slow to pick up a new Caddy release, [open an issue](https://github.com/SushantGautam/caddyserve-wheel/issues) —
+I will push a new version promptly.** PRs bumping `build/version.txt` welcome.
+
+## Verification
+
+Every GitHub Release lists the **wheel SHA-256** and the **upstream Caddy
+asset digest** for each file; the build fails hard if any downloaded asset
+doesn't match the [official checksums](https://github.com/caddyserver/caddy/releases).
+
+## Version bump (maintainers)
+
+```bash
+echo "2.12.0" > build/version.txt
+# also update pyproject.toml version + src/caddyserver/__init__.py __version__
+git commit -am "bump to 2.12.0"
+git tag v2.12.0 && git push --tags   # CI builds, verifies, publishes
+```

caddyserver-2.11.7/pyproject.toml

@@ -0,0 +1,37 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+# NOTE: keep in sync with build/version.txt (build/wheels.py verifies this).
+version = "2.11.7"
+name = "caddyserver"
+description = "Caddy web server as platform-specific Python wheels — pip/pipx/uvx installable, offline, no first-run download"
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Sushant Gautam" }]
+keywords = ["caddy", "webserver", "binary", "distribution", "http3", "https"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Environment :: Console",
+    "Intended Audience :: System Administrators",
+    "Operating System :: Microsoft :: Windows",
+    "Operating System :: MacOS :: MacOS X",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Topic :: Internet :: WWW/HTTP :: Servers",
+]
+
+[project.urls]
+Homepage = "https://github.com/SushantGautam/caddyserve-wheel"
+Repository = "https://github.com/SushantGautam/caddyserve-wheel"
+Issues = "https://github.com/SushantGautam/caddyserve-wheel/issues"
+
+[project.scripts]
+# Only `caddyserver`: a `caddy` entry point would clobber the real caddy
+# binary that ships in the wheel's .data/scripts/ and lands on PATH.
+caddyserver = "caddyserver.cli:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/caddyserver"]

caddyserver-2.11.7/src/caddyserver/__init__.py

@@ -0,0 +1,9 @@
+"""caddyserver: official Caddy binaries distributed as Python wheels.
+
+The package version mirrors the bundled Caddy version.
+"""
+
+__version__ = "2.11.7"
+CADDY_VERSION = __version__
+
+from caddyserver.cli import get_caddy_executable, main  # noqa: E402,F401

caddyserver-2.11.7/src/caddyserver/cli.py

@@ -0,0 +1,63 @@
+"""Console entry point: locate the bundled Caddy binary and exec it.
+
+The binary ships inside the wheel under ``.data/scripts/`` and is installed
+by pip into the same directory as the interpreter's executable
+(venv/pipx ``bin/`` on POSIX, the Scripts-less venv root on Windows).
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import sysconfig
+from pathlib import Path
+
+_BIN = "caddy.exe" if os.name == "nt" else "caddy"
+
+
+class CaddyNotFound(Exception):
+    pass
+
+
+def get_caddy_executable() -> Path:
+    """Return the path to the bundled Caddy binary."""
+    candidates = []
+
+    # Primary: pip installs .data/scripts/ into the scheme scripts dir,
+    # which is exactly where the `caddy`/`caddyserver` console scripts live.
+    # (Do NOT resolve sys.executable: venvs symlink the interpreter to the
+    # base install, which would point at the wrong bin/.)
+    candidates.append(Path(sysconfig.get_path("scripts")) / _BIN)
+    candidates.append(Path(sys.executable).parent / _BIN)
+
+    # Fallbacks: relative to this package (uninstalled tree, exotic layouts).
+    # `pkg` is the caddyserver package dir; `pkg.parent` is site-packages.
+    pkg = Path(__file__).resolve().parent
+    sp = pkg.parent
+    candidates += [
+        sp / _BIN,
+        pkg / _BIN,
+        # uv (uvx / `uv tool install`) leaves the .data tree under
+        # site-packages instead of moving it to the scheme scripts dir.
+        sp / ".data" / "scripts" / _BIN,
+        sp / "data" / "scripts" / _BIN,
+        pkg.parent.parent / "bin" / _BIN,
+    ]
+
+    for c in candidates:
+        c = c.resolve() if c.exists() else c
+        if c.is_file():
+            return c
+
+    raise CaddyNotFound(
+        "Bundled Caddy binary not found. Looked for:\n  "
+        + "\n  ".join(str(c) for c in candidates)
+        + "\nWas this package installed from a platform wheel, not the source tree?"
+    )
+
+
+def main(argv: list[str] | None = None) -> int:
+    exe = get_caddy_executable()
+    args = sys.argv[1:] if argv is None else argv
+    os.execvp(str(exe), [str(exe), *args])
+    # Unreachable on success; execvp raises on failure.

caddyserver-2.11.7/version.txt

@@ -0,0 +1 @@
+2.11.7

caddyserver-2.11.7/wheels.py

@@ -0,0 +1,269 @@
+#!/usr/bin/env python3
+"""Build platform-specific wheels bundling official Caddy binaries.
+
+Pure standard library. Flow:
+  1. Read the pinned Caddy version from build/version.txt.
+  2. Download caddy_{v}_checksums.txt from the official caddyserver/caddy
+     GitHub release.
+  3. Download each platform archive, verify its SHA-256 (hard fail on mismatch).
+  4. Emit one wheel per platform tag plus an sdist into dist/, and write
+     build/release_manifest.json (upstream + wheel digests for release notes).
+
+Usage:  python build/wheels.py
+Env:    CADDY_CHECKSUMS_URL override for testing (not used in CI).
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import io
+import json
+import os
+import re
+import shutil
+import sys
+import tarfile
+import time
+import urllib.request
+import zipfile
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+DIST = REPO / "dist"
+
+# (upstream caddy asset suffix, wheel platform tag, binary name in archive)
+PLATFORMS = [
+    ("windows_amd64.zip", "win_amd64", "caddy.exe"),
+    ("windows_arm64.zip", "win_arm64", "caddy.exe"),
+    ("mac_amd64.tar.gz", "macosx_11_0_x86_64", "caddy"),
+    ("mac_arm64.tar.gz", "macosx_11_0_arm64", "caddy"),
+    ("linux_amd64.tar.gz", "manylinux2014_x86_64.musllinux_1_1_x86_64", "caddy"),
+    ("linux_arm64.tar.gz", "manylinux2014_aarch64.musllinux_1_1_aarch64", "caddy"),
+]
+
+PKG_NAME = "caddyserver"
+DIST_NAME = "caddyserver"
+REQUIRES_PYTHON = ">=3.9"
+
+
+def shorthash(data: bytes) -> str:
+    return base64.urlsafe_b64encode(hashlib.sha256(data).digest()).rstrip(b"=").decode()
+
+
+def load_version() -> str:
+    v = (REPO / "build" / "version.txt").read_text().strip()
+    if not re.fullmatch(r"\d+\.\d+\.\d+", v):
+        sys.exit(f"bad version in build/version.txt: {v!r} (expect X.Y.Z)")
+    return v
+
+
+def fetch(url: str) -> bytes:
+    req = urllib.request.Request(url, headers={"User-Agent": "caddyserver-builder"})
+    with urllib.request.urlopen(req, timeout=120) as r:
+        return r.read()
+
+
+def parse_checksums(text: str) -> dict[str, str]:
+    # Official Caddy releases publish full SHA-512 (128 hex) digests in
+    # checksums.txt. Accept 64- or 128-char digests for forward compatibility.
+    out: dict[str, str] = {}
+    for line in text.splitlines():
+        m = re.match(r"^([0-9a-f]{64,128})\s+\*?(\S+)$", line.strip())
+        if m:
+            out[m.group(2)] = m.group(1)
+    return out
+
+
+def digest_of(blob: bytes, pub_len: int) -> str:
+    algo = hashlib.sha512 if pub_len == 128 else hashlib.sha256
+    return algo(blob).hexdigest()
+
+
+def build_wheel(
+    version: str, tag: str, binary: Path, metadata: dict, readme: str, out: Path
+) -> None:
+    exe = binary.read_bytes()
+    dist_info = f"{PKG_NAME}-{version}.dist-info"
+    files: dict[str, bytes] = {
+        f"{PKG_NAME}/__init__.py": (REPO / "src" / PKG_NAME / "__init__.py").read_bytes(),
+        f"{PKG_NAME}/cli.py": (REPO / "src" / PKG_NAME / "cli.py").read_bytes(),
+        f".data/scripts/{binary.name}": exe,
+        f"{dist_info}/METADATA": metadata,
+        # NOTE: only the `caddyserver` entry point is defined. A `caddy`
+        # entry point would collide with the real `caddy` binary pip installs
+        # from .data/scripts (the generated wrapper would clobber it).
+        f"{dist_info}/entry_points.txt": (
+            "[console_scripts]\n"
+            f"{DIST_NAME} = {PKG_NAME}.cli:main\n"
+        ).encode(),
+        f"{dist_info}/WHEEL": (
+            "Wheel-Version: 1.0\n"
+            "Generator: caddyserver build/wheels.py\n"
+            "Root-Is-Purelib: false\n"
+            "Tag: py3-none-" + tag + "\n"
+        ).encode(),
+    }
+
+    record_lines = [
+        f"{name},{shorthash(data)},{len(data)}" for name, data in sorted(files.items())
+    ]
+    record_lines.append(f"{dist_info}/RECORD,,")
+    files[f"{dist_info}/RECORD"] = ("\n".join(record_lines) + "\n").encode()
+
+    out.parent.mkdir(parents=True, exist_ok=True)
+    zf = zipfile.ZipFile(out, "w", zipfile.ZIP_DEFLATED, compresslevel=6)
+    for name, data in sorted(files.items()):
+        zi = zipfile.ZipInfo(name)
+        zi.date_time = (2024, 1, 1, 0, 0, 0)
+        # External attrs must carry the full file mode in the high 16 bits,
+        # including the regular-file bits: pip checks stat.S_ISREG(mode) before
+        # restoring the executable bit on extracted data/scripts files.
+        if name == f".data/scripts/{binary.name}":
+            zi.external_attr = 0o100755 << 16
+        else:
+            zi.external_attr = 0o100644 << 16
+        zf.writestr(zi, data)
+    zf.close()
+    print(f"  wrote {out.name} ({out.stat().st_size / 1e6:.1f} MB)")
+
+
+def main() -> None:
+    version = load_version()
+    print(f"== caddyserver build: Caddy v{version}")
+
+    checksums = parse_checksums(fetch(
+        f"https://github.com/caddyserver/caddy/releases/download/v{version}/caddy_{version}_checksums.txt"
+    ).decode())
+    missing = [a for a, _, _ in PLATFORMS if f"caddy_{version}_{a}" not in checksums]
+    if missing:
+        sys.exit(f"assets missing from checksums.txt: {missing}")
+
+    work = REPO / "build" / "work"
+    shutil.rmtree(work, ignore_errors=True)
+    work.mkdir(parents=True)
+
+    def get_binary(args: tuple) -> Path:
+        suffix, sha, bin_name = args
+        sub = work / suffix.replace(".", "_")
+        sub.mkdir(parents=True)
+        blob = fetch(
+            f"https://github.com/caddyserver/caddy/releases/download/v{version}/caddy_{version}_{suffix}"
+        )
+        actual = digest_of(blob, len(sha))
+        if actual != sha:
+            sys.exit(f"CHECKSUM MISMATCH {suffix}: expected {sha}, got {actual}")
+        archive = sub / f"caddy_{version}_{suffix}"
+        archive.write_bytes(blob)
+        extract = sub / "extract"
+        extract.mkdir()
+        if suffix.endswith(".zip"):
+            with zipfile.ZipFile(archive) as zf:
+                zf.extractall(extract)
+        else:
+            with tarfile.open(archive, "r:gz") as tf:
+                tf.extractall(extract, filter="data")
+        for f in extract.iterdir():
+            if f.is_file() and f.name == bin_name:
+                return f
+        sys.exit(f"binary {bin_name} not found in {suffix}")
+
+    print("== downloading + verifying binaries (6 in parallel)")
+    jobs = [(suffix, checksums[f"caddy_{version}_{suffix}"], bin_name) for suffix, _, bin_name in PLATFORMS]
+    with ThreadPoolExecutor(max_workers=6) as pool:
+        binaries = list(pool.map(get_binary, jobs))
+
+    # Sanity: every binary must report the right version.
+    import subprocess
+
+    host_arch = os.uname().machine  # arm64/x86_64 on macOS, etc.
+    for (suffix, tag, _), bin_path in zip(PLATFORMS, binaries):
+        if os.uname().sysname != "Darwin":
+            continue
+        host_tag = "macosx_11_0_arm64" if host_arch in ("arm64", "aarch64") else "macosx_11_0_x86_64"
+        if tag != host_tag:
+            continue
+        bin_path.chmod(0o755)
+        r = subprocess.run([str(bin_path), "version"], capture_output=True, text=True)
+        first = r.stdout.splitlines()[0] if r.stdout else r.stderr
+        print(f"  {tag}: {first}")
+
+    DIST.mkdir(exist_ok=True)
+    readme = (REPO / "README.md").read_text() if (REPO / "README.md").exists() else ""
+
+    metadata = (
+        "Metadata-Version: 2.1\n"
+        f"Name: {DIST_NAME}\n"
+        f"Version: {version}\n"
+        "Summary: Caddy web server as platform-specific Python wheels - pip/pipx/uvx "
+        "installable, offline, no first-run download\n"
+        "Author: Sushant Gautam\n"
+        "License: MIT\n"
+        f"Requires-Python: {REQUIRES_PYTHON}\n"
+        "Project-URL: Homepage, https://github.com/SushantGautam/caddyserve-wheel\n"
+        "Project-URL: Repository, https://github.com/SushantGautam/caddyserve-wheel\n"
+        "Project-URL: Issues, https://github.com/SushantGautam/caddyserve-wheel/issues\n"
+        "Keywords: caddy,webserver,binary,distribution,http3,https\n"
+        "Classifier: Development Status :: 5 - Production/Stable\n"
+        "Classifier: Environment :: Console\n"
+        "Classifier: Intended Audience :: System Administrators\n"
+        "Classifier: Operating System :: Microsoft :: Windows\n"
+        "Classifier: Operating System :: MacOS :: MacOS X\n"
+        "Classifier: Operating System :: POSIX :: Linux\n"
+        "Classifier: Programming Language :: Python :: 3\n"
+        "Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Server\n"
+        "Description-Content-Type: text/markdown\n"
+        # PEP 643: the description body is everything after the single blank
+        # line that ends the header block (there is no "Description:" field).
+        f"\n{readme}\n"
+    ).encode()
+
+    print("== building wheels")
+    manifest: list[dict] = []
+    for (suffix, tag, _), bin_path in zip(PLATFORMS, binaries):
+        out = DIST / f"{PKG_NAME}-{version}-py3-none-{tag}.whl"
+        build_wheel(version, tag, bin_path, metadata, readme, out)
+        manifest.append({
+            "file": out.name,
+            "sha256": hashlib.sha256(out.read_bytes()).hexdigest(),
+            "size": out.stat().st_size,
+            "upstream_asset": f"caddy_{version}_{suffix}",
+            "upstream_digest": checksums[f"caddy_{version}_{suffix}"],
+        })
+
+    # sdist (source only; wheels are produced by build/wheels.py or CI)
+    print("== building sdist")
+    sdist = DIST / f"{DIST_NAME}-{version}.tar.gz"
+    with tarfile.open(sdist, "w:gz") as tf:
+        for f in [
+            REPO / "pyproject.toml",
+            REPO / "README.md",
+            REPO / "LICENSE",
+            REPO / "build" / "version.txt",
+            REPO / "build" / "wheels.py",
+            REPO / "src",
+        ]:
+            if f.exists():
+                tf.add(f, arcname=f"{DIST_NAME}-{version}/{f.name}", recursive=True)
+        # PEP 643 / PyPI requirement: sdist needs a PKG-INFO with Metadata-Version
+        info = tarfile.TarInfo(f"{DIST_NAME}-{version}/PKG-INFO")
+        info.size = len(metadata)
+        info.mtime = int(time.time())
+        tf.addfile(info, io.BytesIO(metadata))
+    manifest.append({
+        "file": sdist.name,
+        "sha256": hashlib.sha256(sdist.read_bytes()).hexdigest(),
+        "size": sdist.stat().st_size,
+        "upstream_asset": None,
+        "upstream_digest": None,
+    })
+
+    (REPO / "build" / "release_manifest.json").write_text(json.dumps(manifest, indent=2))
+    print("== done")
+    for m in manifest:
+        print(f"  {m['file']}  sha256={m['sha256'][:16]}…  {m['size'] / 1e6:.1f} MB")
+
+
+if __name__ == "__main__":
+    main()