Dependencies, Builds & Publishing
A track of P35 · Packaging, Tooling & Automation.
From a declared range to a published artifact: evaluate SemVer constraints by hand, prove a lockfile makes a build reproducible, and read the wheel and sdist a registry expects - real upload stays prose.
A pyproject.toml asks for ranges (click>=8.1); the world you actually install
is exact. This track lives in that gap — dependency resolution, lockfiles, and
the built artifacts a registry expects — and you build the tools by hand rather
than trusting them as black boxes.
You start by evaluating a version constraint from scratch (semantic versioning is
just major.minor.patch compared field by field), then use it to prove a
lockfile still satisfies a project's constraints — the check that makes a build
reproducible. Then you turn to the output: a wheel is a ZIP you open and
read (its dist-info/METADATA, its manifest, its compatibility-tagged filename),
and an sdist is the source a machine builds from. Real build and publish
stay prose; you build the inspector and reason about the registry contract —
immutable versions, SemVer as a promise to your users.