Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

release: signed standalone binaries per OS, after EV signing

Abierto
  • ¿Algo no está bien?
#233 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
18/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
github-actions, python
Área
devops, release

Línea de trabajo

Start with the release workflow in release.yml and the agentmetry-hook entry point, then time the hook's current cold start so there is a baseline for the binary. Build one frozen executable for a single OS to measure its cold start against that baseline. Done means a tagged release attaches checksummed binaries, and a clean-machine CI job runs agentmetry demo and agentmetry doctor. Signing is blocked on EV code signing, so this is not a good first contribution.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

Why

Install friction decides whether someone tries a tool. pip install agentmetry pulls a few dozen dependencies and needs a Python 3.11+ on the machine. Numbat ships one binary per OS and architecture. uvx agentmetry demo and pipx run agentmetry demo already give a zero-install first run, and the README documents them, but a security team rolling out to a fleet wants an artifact it can pin, hash and sign.

Shape

  • Build standalone executables per OS and architecture (Windows x64, Linux x64 and arm64, macOS arm64) in release.yml, from the same tag as the PyPI upload.
  • Include the hook client entry point (agentmetry-hook), since it runs on every tool call.
  • Publish them on the GitHub Release page with SHA-256 checksums.

Constraints

  • Signing first. An unsigned Windows executable trips SmartScreen and fails the first security review it meets. This belongs with EV code signing, which is already on the Enterprise trust checklist, rather than before it.
  • Hook start-up time. The hook runs in front of every tool call, and a frozen-Python binary unpacks before it starts. Measure the hook's cold start against the current one before shipping, and do not ship a binary that makes every tool call slower.
  • Keep PyPI as the primary channel. The binary is an additional artifact, not a replacement.

Done when

  • A tagged release attaches signed binaries with checksums, and a clean-machine job in CI installs one and runs agentmetry demo and agentmetry doctor.
  • The hook's cold start through the binary is measured and recorded in the PR.
Lenguaje dominante
Python
Estrellas
10
Forks
5
Merge medio
10 h 26 min
PR fusionados (30 d)
108

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de blitzcrieg1/agentmetry

Todos los issues de blitzcrieg1/agentmetry

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.