Kipferl 0.7: packages with evidence

A complete project workflow

CLI, API, and interactive starters now include project configuration, editor support, tests, and a README. Local modules and resources travel with your application, and project commands use the same configuration during development, testing, and packaging.

kipferl new hello --template cli
cd hello
kipferl run
kipferl test
kipferl build
./dist/hello --help

The quick start walks through this workflow. The tested recipes show complete applications and their standalone builds.

PyPI dependencies with explicit compatibility checks

The new package manager resolves dependencies, verifies wheel contents, and compiles their Python sources before publishing an installation. It checks an offline catalog of evidence for the exact wheel, runtime, and platform. The lock records those identities for reproducible restoration.

kipferl deps catalog
kipferl add 'tzdata==2025.2'
kipferl deps check
kipferl sync --locked --offline

Each of the four release CLIs includes a fresh, reviewed positive record for tzdata 2025.2. Its test covers version constants and four representative TZif resource headers. This establishes resource loading for those checks; it does not provide zoneinfo or establish timezone conversion behavior. Offline restoration needs the wheels already present in the project cache.

Pure Python wheels are supported. Native extensions, source builds, extras, and environment markers remain unsupported. Missing runtime APIs and untested application paths can still prevent a library from working. --allow-unverified lets you evaluate packages without matching positive evidence; it cannot bypass a demonstrated incompatibility. The package guide explains these decisions and their recovery steps.

More Python package syntax

Native dotted imports now initialize parent packages, bind roots and aliases correctly, and handle circular imports and failed-import retries. Relative from-imports work, along with trailing commas in parenthesized imports and parameter lists and adjacent plain string and bytes literals.

import http.client
import urllib.parse as urls

print(urls.quote("hello world"))

These changes address frequent blockers in our pinned 1,000-package screen. Dotted imports moved all 170 affected first failures forward: four packages completed compilation, while 166 exposed later blockers. Across the full screen, 44 releases completed compilation, including 24 containing Python source. Compilation is only one compatibility check; those numbers are not a count of working libraries.

The searchable audit retains its original package versions and recorded runtime hash. Fresh per-platform release catalogs provide separate evidence for the binaries in this release.

Two upgrade changes to review

• Dynamic imports return the root by default. __import__("http.client") now returns http. To keep a child-module alias, use import http.client as http, or pass a nonempty positional fromlist to the dynamic import. Nonzero dynamic import levels, namespace packages, and custom import finders remain unsupported.
• Locks belong to an exact runtime and platform. After changing runtimes, rerun kipferl add for your declared requirements, review the resulting lock, run your tests, and commit the configuration and lock together. Do not edit hashes to bypass a mismatch. Repeat --allow-unverified only for dependencies you intentionally accept and test.

Follow the upgrade notes before updating an existing application.

Testing the binaries you download

CI and the release pipeline passed on macOS Apple Silicon, macOS Intel, Linux ARM64, and Linux x86_64. The pipeline verifies exact component versions and checksums, generates runtime-specific catalog evidence, and tests online installation, locked offline restoration, and standalone execution after deleting the project and caches. macOS offline checks deny network access through sandbox-exec; Linux exercises the CLI’s offline mode on disposable runners.

The stable release compatibility run passed 1,725 available checks, with 22 explicit dependency skips. The published stable Apple Silicon download also passed checksum verification and a fresh package-install, offline-restore, and detached-executable smoke test.

The GitHub release includes executables and checksums, per-platform catalogs and package smoke reports, plus compatibility, Vision, and vendor-patch verification reports. See the stable release workflow for the build and validation logs.

Download v0.7.0

Use the installation guide for checksum commands and upgrade instructions. Try the release with your project and report reproducible problems through GitHub issues, including the version, platform, and smallest example that fails.