rust-audit 0.2.3__tar.gz → 0.2.4__tar.gz

{rust_audit-0.2.3/scripts/rust_audit.egg-info → rust_audit-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rust-audit
-Version: 0.2.3
+Version: 0.2.4
 Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
 Author-email: Antonio Cantallops Alba <contact@exyonq.org>
 License-Expression: Apache-2.0
@@ -44,9 +44,11 @@ pipx install rust-audit      # or: pip install rust-audit
 rust-audit selftest          # prints `selftest PASS`
 ```
 
-From PyPI as **`rust-audit`**; the one-word alias **`rustaudit`** is the same
-package under a name that resolves to it, and both `rust-audit` and `rustaudit`
-run from either install. Nothing is fetched or executed at install time, and
+From PyPI as **`rust-audit`**, whose wheel installs both commands: `rust-audit`
+and `rustaudit` run the same module. There is no separate one-word project on
+PyPI — it answers "This project name is too similar to an existing project" —
+so the spelling is served by this package's own entry point.
+Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
@@ -56,7 +58,7 @@ verify-before-use chain below still applies to the script you download.
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.3 ./rust_audit.py
+scripts/verify_release.sh v0.2.4 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.3 → rust_audit-0.2.4}/README.md

@@ -14,9 +14,11 @@ pipx install rust-audit      # or: pip install rust-audit
 rust-audit selftest          # prints `selftest PASS`
 ```
 
-From PyPI as **`rust-audit`**; the one-word alias **`rustaudit`** is the same
-package under a name that resolves to it, and both `rust-audit` and `rustaudit`
-run from either install. Nothing is fetched or executed at install time, and
+From PyPI as **`rust-audit`**, whose wheel installs both commands: `rust-audit`
+and `rustaudit` run the same module. There is no separate one-word project on
+PyPI — it answers "This project name is too similar to an existing project" —
+so the spelling is served by this package's own entry point.
+Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
@@ -26,7 +28,7 @@ verify-before-use chain below still applies to the script you download.
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.3 ./rust_audit.py
+scripts/verify_release.sh v0.2.4 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.3 → rust_audit-0.2.4}/pyproject.toml

@@ -42,9 +42,9 @@ dev = ["pytest>=7.4.0"]
 
 [project.scripts]
 rust-audit = "rust_audit:main"
-# Same entry point under the one-word spelling; the `rustaudit` distribution on
-# PyPI is an alias that pulls this one in, so either name on the prompt runs
-# the same code once this package is installed.
+# Same entry point under the one-word spelling. There is no `rustaudit`
+# distribution on PyPI: it is refused as "too similar to an existing project"
+# next to `rust-audit`, so this wheel is the only place that name comes from.
 rustaudit = "rust_audit:main"
 
 [project.urls]

{rust_audit-0.2.3 → rust_audit-0.2.4/scripts/rust_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rust-audit
-Version: 0.2.3
+Version: 0.2.4
 Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
 Author-email: Antonio Cantallops Alba <contact@exyonq.org>
 License-Expression: Apache-2.0
@@ -44,9 +44,11 @@ pipx install rust-audit      # or: pip install rust-audit
 rust-audit selftest          # prints `selftest PASS`
 ```
 
-From PyPI as **`rust-audit`**; the one-word alias **`rustaudit`** is the same
-package under a name that resolves to it, and both `rust-audit` and `rustaudit`
-run from either install. Nothing is fetched or executed at install time, and
+From PyPI as **`rust-audit`**, whose wheel installs both commands: `rust-audit`
+and `rustaudit` run the same module. There is no separate one-word project on
+PyPI — it answers "This project name is too similar to an existing project" —
+so the spelling is served by this package's own entry point.
+Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
@@ -56,7 +58,7 @@ verify-before-use chain below still applies to the script you download.
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.3 ./rust_audit.py
+scripts/verify_release.sh v0.2.4 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.3 → rust_audit-0.2.4}/scripts/rust_audit.py

@@ -48,7 +48,7 @@ import urllib.request
 from dataclasses import dataclass, field
 from pathlib import Path
 
-VERSION = "0.2.3"
+VERSION = "0.2.4"
 TOOL_NAME = "Rust Audit"
 
 SEVERITY_RANK = {"critical": 4, "high": 3, "medium": 2, "low": 1, "info": 0}

{rust_audit-0.2.3 → rust_audit-0.2.4}/tests/test_packaging.py

@@ -16,7 +16,7 @@ from pathlib import Path
 REPO = Path(__file__).resolve().parent.parent
 TOOL = REPO / "scripts" / "rust_audit.py"
 PYPROJECT = REPO / "pyproject.toml"
-ALIAS = REPO / "packaging" / "rustaudit-alias" / "pyproject.toml"
+PUBLISH_WORKFLOW = REPO / ".github" / "workflows" / "publish.yml"
 
 
 def load_module(path=TOOL, name="rust_audit_probe"):
@@ -54,16 +54,22 @@ def test_both_commands_run_the_same_entry_point():
         "the entry point names a function the module does not define")
 
 
-def test_alias_reserves_the_one_word_name():
-    alias = tomllib.loads(ALIAS.read_text())
-    version = tool_version()
-    assert alias["project"]["name"] == "rustaudit"
-    assert alias["project"]["version"] == version
-    assert alias["project"]["dependencies"] == [f"rust-audit>={version}"]
-    assert alias["tool"]["setuptools"]["packages"] == []
-    assert "scripts" not in alias["project"], (
-        "the alias must install no commands of its own, or it could shadow the "
-        "real package's entry points")
+def test_only_one_distribution_is_published():
+    """`rustaudit` cannot be a PyPI project next to `rust-audit`.
+
+    PyPI answers a pending publisher for the one-word name with "This project
+    name is too similar to an existing project" (checked against the live API
+    on 2026-10-20), so a second distribution would fail on every release. The
+    one-word command ships from this wheel's own entry points instead; the
+    workflow must not build or upload a second project.
+    """
+    workflow = PUBLISH_WORKFLOW.read_text()
+    assert "python -m build --outdir dist/main" in workflow
+    assert "packaging/" not in workflow, (
+        "the workflow builds a second distribution, which PyPI refuses as "
+        "too similar to rust-audit")
+    assert not (REPO / "packaging").exists(), (
+        "an alias distribution reappeared under packaging/")
 
 
 def test_declared_data_files_exist():

{rust_audit-0.2.3 → rust_audit-0.2.4}/tests/test_verify_release.py

@@ -515,12 +515,6 @@ def make_cut_repo(path, keytype, keydata):
         "```bash\nscripts/verify_release.sh v0.2.0 ./rust_audit.py\n```\n")
     (path / "SKILL.md").write_text(
         "scripts/verify_release.sh v0.2.0 ./rust_audit.py\n")
-    # --cut cuts both PyPI distributions, so the alias metadata is part of its
-    # surface: without it here the version bump has nothing to edit.
-    (path / "packaging" / "rustaudit-alias").mkdir(parents=True)
-    (path / "packaging" / "rustaudit-alias" / "pyproject.toml").write_text(
-        '[project]\nname = "rustaudit"\nversion = "0.2.0"\n'
-        'dependencies = ["rust-audit>=0.2.0"]\n')
     (path / "SECURITY.md").write_text(
         f'release@rust-audit namespaces="file" {keytype} {keydata}\n')
     cmd("git", "init", "-q", path)
@@ -547,11 +541,6 @@ def test_cut_releases_in_one_command(release, tmp_path):
                     RA_REPO_ROOT=str(repo))
     assert r.returncode == 0, r.stdout + r.stderr
     assert 'VERSION = "9.9.9"' in (repo / "scripts" / "rust_audit.py").read_text()
-    alias = (repo / "packaging" / "rustaudit-alias" / "pyproject.toml").read_text()
-    assert 'version = "9.9.9"' in alias
-    assert 'rust-audit>=9.9.9' in alias, (
-        "the alias dependency floor must follow the tag, or pip installs an "
-        "older rust-audit behind the alias")
     for doc in ("README.md", "SKILL.md"):
         assert "verify_release.sh v9.9.9" in (repo / doc).read_text()
     assert cmd("git", "-C", origin, "rev-parse", "v9.9.9").returncode == 0