internetdata 1.0.0__tar.gz

internetdata-1.0.0/.gitignore

@@ -0,0 +1,17 @@
+__pycache__/
+*.py[cod]
+
+# Build output.
+build/
+dist/
+*.egg-info/
+
+# Virtualenvs, including any made to run codegen. Keep them out of the tree entirely.
+.venv/
+venv/
+.venv-*/
+
+# Tool caches.
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/

internetdata-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mslm Dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

internetdata-1.0.0/PKG-INFO

@@ -0,0 +1,184 @@
+Metadata-Version: 2.5
+Name: internetdata
+Version: 1.0.0
+Summary: Official Python client library for the InternetData API. Download and verify licensed IP datasets.
+Project-URL: Homepage, https://internetdata.io
+Project-URL: Documentation, https://docs.internetdata.io
+Project-URL: Source, https://github.com/internetdata/sdk-python
+Project-URL: Issues, https://github.com/internetdata/sdk-python/issues
+Author-email: Mslm Dev <support@internetdata.io>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: asn,bogon,dataset,geolocation,hosting,internetdata,ip-database,ip-intelligence,mmdb,proxy,vpn
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Topic :: Internet
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: attrs>=22.2.0
+Requires-Dist: httpx<1,>=0.27
+Provides-Extra: dev
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: openapi-python-client<0.30,>=0.29; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# [<img src="https://s3.internetdata.io/internetdata-public/brand/mark.svg" alt="InternetData" width="24"/>](https://internetdata.io/) InternetData Python Client Library
+
+[![PyPI](https://img.shields.io/pypi/v/internetdata.svg)](https://pypi.org/project/internetdata/)
+[![license](https://img.shields.io/pypi/l/internetdata.svg)](LICENSE)
+
+The official Python client library for the [InternetData](https://internetdata.io) API.
+
+The library helps you browse the databases your organization is licensed for, check what is in each build before you fetch it, and download and verify the files.
+
+## Getting Started
+
+```bash
+pip install internetdata
+```
+
+Requires Python 3.11 or newer. Type hints are included, and the package ships `py.typed`.
+
+## Usage
+
+Every call needs an API key carrying the `db.download` scope. Create one in the console, then:
+
+```python
+import os
+from internetdata import InternetData
+
+client = InternetData(os.environ["INTERNETDATA_API_KEY"])
+
+for family in client.database.list():
+    print(family.base, family.standing, [v.id for v in family.versions])
+```
+
+The client holds an HTTP connection pool, so use it as a context manager, or call `client.close()` when you are done with it:
+
+```python
+with InternetData(api_key) as client:
+    print(len(client.database.list()))
+```
+
+### The catalog
+
+`list` answers database FAMILIES. A licence is held against a family, while a download names a specific version, so the ids the other calls take come from each family's `versions`:
+
+```python
+for family in client.database.list():
+    if family.standing != "licensed":
+        continue
+    for version in family.versions:
+        print(version.id, version.formats)   # 'bogon_ip_v1' ('csvgz', 'mmdb')
+```
+
+`standing` is `licensed`, `expired` or `unlicensed`, and `redistribution` is what your licence lets you do with the data (`evaluation`, `internal`, `redistribute`, or `None` when there is no licence). A family you have never bought is still listed, as `unlicensed`, so you can see what else exists.
+
+**The catalog is not the same document for every key.** Databases commissioned for a single customer are absent from the listing entirely for everyone else, rather than shown as `unlicensed`. The server decides that per key, so treat what you get back as the answer for the key you asked with: this library never caches a listing, never reuses one across clients, and has no built-in list of database ids to fall back on.
+
+### What is inside a build
+
+`metadata` is cheap enough to poll. It answers when the build was generated, how many rows it has, its columns and a few real rows, and the size of each format in bytes, all without moving the file:
+
+```python
+meta = client.database.metadata("bogon_ip_v1")
+
+print(meta.updated)                  # datetime.date(2026, 9, 4)
+print(meta.entries)                  # 1234
+print(meta.size["csvgz"])            # 760
+print([c.name for c in meta.schema["csvgz"]])
+```
+
+Checking `size` before a download is worth the round trip: the catalog spans a few hundred bytes to several gigabytes.
+
+### Downloading
+
+Three ways, depending on what you want to do with the bytes:
+
+```python
+url = client.database.download_url("bogon_ip_v1", "csvgz")
+raw = client.database.download_bytes("bogon_ip_v1", "csvgz")
+written = client.database.download("bogon_ip_v1", "mmdb", "./bogon_ip_v1.mmdb")
+```
+
+`download_url` hands back a time-limited link straight to object storage. It carries its own signature and none of your API key, so you can pass it to `curl`, a job runner or anything else that speaks HTTP. The link authorizes the START of a transfer, so one already running is not cut off when it lapses.
+
+`download` streams to a file, so nothing larger than a chunk is ever held in memory. The bytes land in a neighboring `.part` file that is moved into place only once the whole transfer has arrived, so a failed refresh leaves the copy you already had untouched. `download_bytes` holds the whole file in memory, so reach for it only at the small end of the catalog.
+
+Either way a short transfer fails rather than handing you a truncated file, and the key is never sent to object storage.
+
+Verify what you fetched against the published digests:
+
+```python
+import hashlib
+
+digests = client.database.checksums("bogon_ip_v1", "csvgz")
+assert hashlib.sha256(raw).hexdigest() == digests["sha256"]
+```
+
+### Download history
+
+`downloads` answers your organization's recent attempts, newest first, refusals included. A denial is what answers "it stopped working", and its absence answers nothing:
+
+```python
+for attempt in client.database.downloads(limit=20):
+    print(attempt.created, attempt.dataset_id, attempt.outcome, attempt.http_status)
+```
+
+### Async
+
+Everything above works the same way under asyncio, with `AsyncInternetData`:
+
+```python
+import asyncio
+from internetdata import AsyncInternetData
+
+async def main():
+    async with AsyncInternetData(api_key) as client:
+        meta = await client.database.metadata("bogon_ip_v1")
+        await client.database.download("bogon_ip_v1", "csvgz", "./bogon_ip_v1.csv.gz")
+        print(meta.entries)
+
+asyncio.run(main())
+```
+
+### Errors
+
+Failures raise an `InternetDataError` carrying a `kind` and a `retryable` flag:
+
+```python
+from internetdata import InternetDataError
+
+try:
+    client.database.download_url("vpn_ip_v1", "mmdb")
+except InternetDataError as err:
+    print(err.kind, err.retryable, err.message)   # forbidden False NOT_LICENSED
+```
+
+`kind` is one of `bad_request`, `unauthorized`, `forbidden`, `rate_limited`, `quota_exceeded`, `server_error` or `network`. `message` is the API's own result code, passed through as it was sent, so you can switch on `NOT_LICENSED` against `LICENSE_EXPIRED` without reading the status.
+
+Note that `rate_limited` and `quota_exceeded` both arrive as HTTP 429 and are not the same thing. A rate limit is the API facing a traffic burst, and retrying later works; a spent quota needs your allowance raised or the window to roll over. The library retries rate limits for you, and server and network failures, but never a spent quota or anything else you sent.
+
+## Other Libraries
+
+There are official InternetData client libraries available for many languages including PHP, Python, Go, Java, Ruby, and many popular frameworks such as Django, Rails, and Laravel. See our GitHub at https://github.com/internetdata for more.
+
+## About InternetData
+
+InternetData: IP and network intelligence databases, published as CSV and MMDB, licensed by contract and downloadable on demand.
+
+[<img src="https://s3.internetdata.io/internetdata-public/brand/mark.svg" alt="InternetData" width="96"/>](https://internetdata.io/)
+
+## License
+
+This project is licensed under the [MIT License](LICENSE).

internetdata-1.0.0/README.md

@@ -0,0 +1,150 @@
+# [<img src="https://s3.internetdata.io/internetdata-public/brand/mark.svg" alt="InternetData" width="24"/>](https://internetdata.io/) InternetData Python Client Library
+
+[![PyPI](https://img.shields.io/pypi/v/internetdata.svg)](https://pypi.org/project/internetdata/)
+[![license](https://img.shields.io/pypi/l/internetdata.svg)](LICENSE)
+
+The official Python client library for the [InternetData](https://internetdata.io) API.
+
+The library helps you browse the databases your organization is licensed for, check what is in each build before you fetch it, and download and verify the files.
+
+## Getting Started
+
+```bash
+pip install internetdata
+```
+
+Requires Python 3.11 or newer. Type hints are included, and the package ships `py.typed`.
+
+## Usage
+
+Every call needs an API key carrying the `db.download` scope. Create one in the console, then:
+
+```python
+import os
+from internetdata import InternetData
+
+client = InternetData(os.environ["INTERNETDATA_API_KEY"])
+
+for family in client.database.list():
+    print(family.base, family.standing, [v.id for v in family.versions])
+```
+
+The client holds an HTTP connection pool, so use it as a context manager, or call `client.close()` when you are done with it:
+
+```python
+with InternetData(api_key) as client:
+    print(len(client.database.list()))
+```
+
+### The catalog
+
+`list` answers database FAMILIES. A licence is held against a family, while a download names a specific version, so the ids the other calls take come from each family's `versions`:
+
+```python
+for family in client.database.list():
+    if family.standing != "licensed":
+        continue
+    for version in family.versions:
+        print(version.id, version.formats)   # 'bogon_ip_v1' ('csvgz', 'mmdb')
+```
+
+`standing` is `licensed`, `expired` or `unlicensed`, and `redistribution` is what your licence lets you do with the data (`evaluation`, `internal`, `redistribute`, or `None` when there is no licence). A family you have never bought is still listed, as `unlicensed`, so you can see what else exists.
+
+**The catalog is not the same document for every key.** Databases commissioned for a single customer are absent from the listing entirely for everyone else, rather than shown as `unlicensed`. The server decides that per key, so treat what you get back as the answer for the key you asked with: this library never caches a listing, never reuses one across clients, and has no built-in list of database ids to fall back on.
+
+### What is inside a build
+
+`metadata` is cheap enough to poll. It answers when the build was generated, how many rows it has, its columns and a few real rows, and the size of each format in bytes, all without moving the file:
+
+```python
+meta = client.database.metadata("bogon_ip_v1")
+
+print(meta.updated)                  # datetime.date(2026, 9, 4)
+print(meta.entries)                  # 1234
+print(meta.size["csvgz"])            # 760
+print([c.name for c in meta.schema["csvgz"]])
+```
+
+Checking `size` before a download is worth the round trip: the catalog spans a few hundred bytes to several gigabytes.
+
+### Downloading
+
+Three ways, depending on what you want to do with the bytes:
+
+```python
+url = client.database.download_url("bogon_ip_v1", "csvgz")
+raw = client.database.download_bytes("bogon_ip_v1", "csvgz")
+written = client.database.download("bogon_ip_v1", "mmdb", "./bogon_ip_v1.mmdb")
+```
+
+`download_url` hands back a time-limited link straight to object storage. It carries its own signature and none of your API key, so you can pass it to `curl`, a job runner or anything else that speaks HTTP. The link authorizes the START of a transfer, so one already running is not cut off when it lapses.
+
+`download` streams to a file, so nothing larger than a chunk is ever held in memory. The bytes land in a neighboring `.part` file that is moved into place only once the whole transfer has arrived, so a failed refresh leaves the copy you already had untouched. `download_bytes` holds the whole file in memory, so reach for it only at the small end of the catalog.
+
+Either way a short transfer fails rather than handing you a truncated file, and the key is never sent to object storage.
+
+Verify what you fetched against the published digests:
+
+```python
+import hashlib
+
+digests = client.database.checksums("bogon_ip_v1", "csvgz")
+assert hashlib.sha256(raw).hexdigest() == digests["sha256"]
+```
+
+### Download history
+
+`downloads` answers your organization's recent attempts, newest first, refusals included. A denial is what answers "it stopped working", and its absence answers nothing:
+
+```python
+for attempt in client.database.downloads(limit=20):
+    print(attempt.created, attempt.dataset_id, attempt.outcome, attempt.http_status)
+```
+
+### Async
+
+Everything above works the same way under asyncio, with `AsyncInternetData`:
+
+```python
+import asyncio
+from internetdata import AsyncInternetData
+
+async def main():
+    async with AsyncInternetData(api_key) as client:
+        meta = await client.database.metadata("bogon_ip_v1")
+        await client.database.download("bogon_ip_v1", "csvgz", "./bogon_ip_v1.csv.gz")
+        print(meta.entries)
+
+asyncio.run(main())
+```
+
+### Errors
+
+Failures raise an `InternetDataError` carrying a `kind` and a `retryable` flag:
+
+```python
+from internetdata import InternetDataError
+
+try:
+    client.database.download_url("vpn_ip_v1", "mmdb")
+except InternetDataError as err:
+    print(err.kind, err.retryable, err.message)   # forbidden False NOT_LICENSED
+```
+
+`kind` is one of `bad_request`, `unauthorized`, `forbidden`, `rate_limited`, `quota_exceeded`, `server_error` or `network`. `message` is the API's own result code, passed through as it was sent, so you can switch on `NOT_LICENSED` against `LICENSE_EXPIRED` without reading the status.
+
+Note that `rate_limited` and `quota_exceeded` both arrive as HTTP 429 and are not the same thing. A rate limit is the API facing a traffic burst, and retrying later works; a spent quota needs your allowance raised or the window to roll over. The library retries rate limits for you, and server and network failures, but never a spent quota or anything else you sent.
+
+## Other Libraries
+
+There are official InternetData client libraries available for many languages including PHP, Python, Go, Java, Ruby, and many popular frameworks such as Django, Rails, and Laravel. See our GitHub at https://github.com/internetdata for more.
+
+## About InternetData
+
+InternetData: IP and network intelligence databases, published as CSV and MMDB, licensed by contract and downloadable on demand.
+
+[<img src="https://s3.internetdata.io/internetdata-public/brand/mark.svg" alt="InternetData" width="96"/>](https://internetdata.io/)
+
+## License
+
+This project is licensed under the [MIT License](LICENSE).

internetdata-1.0.0/pyproject.toml

@@ -0,0 +1,97 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "internetdata"
+dynamic = ["version"]
+description = "Official Python client library for the InternetData API. Download and verify licensed IP datasets."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.11"
+authors = [{ name = "Mslm Dev", email = "support@internetdata.io" }]
+keywords = [
+    "internetdata",
+    "ip-database",
+    "ip-intelligence",
+    "mmdb",
+    "geolocation",
+    "asn",
+    "bogon",
+    "vpn",
+    "proxy",
+    "hosting",
+    "dataset",
+]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Topic :: Internet",
+    "Topic :: Security",
+    "Typing :: Typed",
+]
+dependencies = [
+    "httpx>=0.27,<1",
+    "attrs>=22.2.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "pytest-asyncio>=0.24",
+    "mypy>=1.11",
+    "ruff>=0.6",
+    "openapi-python-client>=0.29,<0.30",
+]
+
+[project.urls]
+Homepage = "https://internetdata.io"
+Documentation = "https://docs.internetdata.io"
+Source = "https://github.com/internetdata/sdk-python"
+Issues = "https://github.com/internetdata/sdk-python/issues"
+
+[tool.hatch.version]
+path = "src/internetdata/__init__.py"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/internetdata"]
+
+# Root-anchored, because a bare "scripts" also matches integration/scripts and would ship
+# a runner without the suite it drives.
+[tool.hatch.build.targets.sdist]
+include = ["/src", "/tests", "/testdata", "/spec", "/scripts", "/README.md", "/LICENSE"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+asyncio_mode = "auto"
+
+# Read by `ruff`, which openapi-python-client runs over its own output, so the generated
+# client and the hand-written layer are formatted to the same width.
+[tool.ruff]
+line-length = 100
+
+[tool.ruff.lint.per-file-ignores]
+# The generated tree is replaced wholesale by scripts/generate.sh, so a lint fix here
+# would be undone by the next spec refresh. This one fires because the spec spells
+# `redistribution` as a nullable enum and the generator renders that as three separate
+# single-member classes, hence three `isinstance` arms it will not merge.
+"src/internetdata/_generated/**/*.py" = ["SIM101"]
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+# The integration suite is checked by a second invocation rather than listed here: it
+# carries a conftest.py of its own, and mypy cannot hold two modules of one name at once.
+files = ["src/internetdata", "tests"]
+
+# Generated from spec/openapi.yaml. It is checked by being regenerated, not by mypy.
+[[tool.mypy.overrides]]
+module = "internetdata._generated.*"
+ignore_errors = true

internetdata-1.0.0/scripts/download-spec.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Refreshes the pinned OpenAPI spec from the published one.
+#
+# The copy in spec/ is what codegen reads, so a build stays reproducible and
+# offline and the diff shows exactly which spec version produced the client. Run
+# this deliberately, then commit the spec change alongside the regenerated
+# client, so a reviewer sees both.
+#
+# The whole published document is pinned, v1 included, so the diff is against
+# what the API actually publishes. `generate.sh` is what narrows it to v2.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+SPEC_URL="${SPEC_URL:-https://s3.internetdata.io/internetdata-public/openapi/openapi.yaml}"
+
+curl -fsS "$SPEC_URL" -o spec/openapi.yaml
+echo "spec/openapi.yaml <- ${SPEC_URL}"
+grep -m1 '^  version:' spec/openapi.yaml

internetdata-1.0.0/scripts/generate.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+# Regenerates src/internetdata/_generated/ from the PINNED spec in this repo.
+#
+# Unlike most of the SDKs, the generated client is COMMITTED here: a Python
+# package is installed from source, so a gitignored generated tree would mean a
+# `pip install` of this repo produced a package that cannot import itself.
+# Refresh it deliberately and commit the diff alongside any spec change.
+#
+# The generator lives in a throwaway virtualenv under /tmp rather than in the
+# working tree, because a venv is thousands of files and one committed by
+# accident is far more annoying to remove than to recreate.
+#
+#   ./scripts/generate.sh
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+VENV="${VENV:-/tmp/internetdata-sdk-python-codegen}"
+GENERATOR_VERSION="${GENERATOR_VERSION:-0.29.1}"
+SUBSET="${SUBSET:-/tmp/internetdata-sdk-python-v2.yaml}"
+
+if [ ! -x "$VENV/bin/openapi-python-client" ] ; then
+    python3 -m venv "$VENV"
+    "$VENV/bin/pip" install --quiet --upgrade pip
+    "$VENV/bin/pip" install --quiet "openapi-python-client==${GENERATOR_VERSION}"
+fi
+
+# ruff must be on PATH: the generator shells out to it to format and lint its
+# own output, and silently skips both when it cannot find it. It picks up this
+# repo's pyproject.toml, so `requires-python` decides whether the models import
+# `Self` from typing or from typing_extensions - which is the difference between
+# three runtime dependencies and four.
+export PATH="$VENV/bin:$PATH"
+
+# The pinned spec carries v1 as well, and this client does not target it. See
+# scripts/v2_subset.py for why the narrowing happens here and not in spec/.
+python3 scripts/v2_subset.py spec/openapi.yaml "$SUBSET"
+
+rm -rf src/internetdata/_generated
+openapi-python-client generate \
+    --path "$SUBSET" \
+    --meta none \
+    --output-path src/internetdata/_generated
+
+# The generator's own docstring templates carry em-dashes, which this codebase does
+# not use anywhere. Normalizing them here keeps generation deterministic.
+find src/internetdata/_generated -name '*.py' -exec sed -i 's/\xe2\x80\x94/ - /g' {} +
+
+echo "src/internetdata/_generated <- spec/openapi.yaml"
+grep -m1 '^  version:' spec/openapi.yaml

internetdata-1.0.0/scripts/publish.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Publishes the package to PyPI from inside the official Python image, so a
+# release needs nothing installed locally beyond docker and works identically on
+# any machine. The release workflow does the same steps on a tag; this is the
+# manual path for a first release or when Actions is not an option.
+#
+#   PYPI_TOKEN=... ./scripts/publish.sh            # publish
+#   DRY_RUN=1 ./scripts/publish.sh                 # build + check, upload nothing
+#
+# A token is only needed for the FIRST publish: PyPI configures trusted
+# publishing against an EXISTING project, so there is nothing to attach an OIDC
+# publisher to until the name is taken. Once release.yml has published once with
+# a trusted publisher configured, the token can be deleted.
+#
+# The dist/ directory is an anonymous volume so a build inside the container
+# cannot leave root-owned artifacts in the working tree.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+PYTHON_IMAGE="${PYTHON_IMAGE:-python:3.13-slim}"
+DRY_RUN="${DRY_RUN:-}"
+
+if [ -z "$DRY_RUN" ] ; then
+    : "${PYPI_TOKEN:?set PYPI_TOKEN to a PyPI API token, or set DRY_RUN=1 to rehearse}"
+    upload="twine upload dist/*"
+else
+    PYPI_TOKEN=""
+    upload="echo 'DRY_RUN: built and checked, uploading nothing'"
+fi
+
+docker run --rm \
+    -v "$PWD:/w" -v /w/dist \
+    -w /w \
+    -e TWINE_USERNAME=__token__ \
+    -e TWINE_PASSWORD="$PYPI_TOKEN" \
+    -e PIP_ROOT_USER_ACTION=ignore \
+    "$PYTHON_IMAGE" sh -euc "
+        pip install --quiet --upgrade pip build twine
+        pip install --quiet -e '.[dev]'
+        pytest -q
+        python -m build
+        twine check dist/*
+        $upload
+    "