pyproject.toml

[build-system]
requires = ["setuptools>=77"]
build-backend = "setuptools.build_meta"

[project]
name = "coderifts-verifier"
version = "0.2.0"
description = "Offline verifier for CodeRifts chain receipts and DSSE/in-toto envelopes. Ed25519, no network."
readme = "README.md"
license = "MIT"
license-files = ["LICENSE"]
requires-python = ">=3.10"
# A real dependency is correct here: this package verifies signatures. It is a
# different artifact from the coderifts SDK, which is deliberately crypto-free
# and talks to the API over `requests`.
dependencies = ["cryptography>=41"]

[project.urls]
Homepage = "https://github.com/coderifts/receipt-verifier"

[tool.setuptools]
packages = ["coderifts_verifier"]
# P-2 -- the vendored key snapshot must ship WITH the wheel, or the offline default has nothing
# to read: the package would install, the CLI would run, and the no-flag path would fail at
# verify time on an end user's machine rather than in our tests.
#
# WARNING -- BACKEND-SPECIFIC, AND THE FIRST ATTEMPT WAS WRONG. A
# `[tool.hatch.build.targets.wheel.force-include]` block was written here first and was INERT:
# this project builds with SETUPTOOLS (see [build-system] above), so a hatch table is config for
# a backend that never runs. An inert build setting is worse than a missing one, because the
# repository looks as though the question was handled. `tests/test_vendored_keys.py` asserts the
# declaration is the setuptools one.
include-package-data = true

[tool.setuptools.package-data]
coderifts_verifier = ["keys/*.json", "keys/*.sha256"]