From b3318b60a4b9369299deb81b7e4b90a0b7f065e3 Mon Sep 17 00:00:00 2001 From: Fabian Witt Date: Sun, 30 Aug 2026 10:47:56 +0200 Subject: [PATCH 1/2] build: drop wheel, setuptools and pytest from runtime dependencies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit None of the three is imported anywhere under `src/`. `c2pa.py` and `lib.py` import only the standard library; `build.py` — the `download-artifacts` console script — imports `requests` and, lazily, `toml`. Those two stay. They are also already classified correctly elsewhere in the repo: * `[build-system] requires` already lists `setuptools>=68.0.0` and `wheel`, so the build has what it needs and the runtime entries are duplicates. * `requirements-dev.txt` lists `wheel` and `setuptools` under "# Build dependencies" and `pytest` under "# Testing dependencies". * `.github/workflows/build.yml` installs pytest explicitly (`pip install pytest`, lines 285 and 377), so CI does not rely on the runtime declaration either. Removing them is therefore a no-op for this repo's own build and test paths, and it keeps three packages out of every consumer's production environment. --- pyproject.toml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index e8945b67..af846cc6 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -22,10 +22,9 @@ maintainers = [ ] urls = {homepage = "https://contentauthenticity.org", repository = "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/contentauth/c2pa-python"} dependencies = [ - "wheel>=0.41.2", - "setuptools>=68.0.0", + # `toml` and `requests` are read at runtime by the `download-artifacts` + # console script (src/c2pa/build.py), so they stay. "toml>=0.10.2", - "pytest>=7.4.0", "cryptography>=41.0.0", "requests>=2.0.0" ] From 1267186339e0c76698471b6786a9d437c6eb4eff Mon Sep 17 00:00:00 2001 From: Fabian Witt Date: Mon, 31 Aug 2026 08:27:55 +0200 Subject: [PATCH 2/2] build: declare pytest in a PEP 735 dev dependency group MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dropping pytest from `[project.dependencies]` left it undeclared in pyproject.toml entirely, with `requirements-dev.txt` as the only manifest naming it. `[dependency-groups] dev` states it where it belongs: installed for contributors (`uv sync`, `pip install --group dev`) and, unlike `[project.optional-dependencies]`, absent from the published package metadata — which is the separation this branch is about. The bound matches requirements-dev.txt (`pytest>=8.1.0`) rather than the `>=7.4.0` the runtime entry carried; nothing installs the old one. The comment above the remaining dependencies goes with it. The rationale for keeping `toml` and `requests` belongs in the pull request, not in a manifest that has carried no comments so far. --- pyproject.toml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index af846cc6..e0ff0d54 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -22,13 +22,16 @@ maintainers = [ ] urls = {homepage = "https://contentauthenticity.org", repository = "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/contentauth/c2pa-python"} dependencies = [ - # `toml` and `requests` are read at runtime by the `download-artifacts` - # console script (src/c2pa/build.py), so they stay. "toml>=0.10.2", "cryptography>=41.0.0", "requests>=2.0.0" ] +[dependency-groups] +dev = [ + "pytest>=8.1.0" +] + [project.scripts] download-artifacts = "c2pa.build:download_artifacts"