id       = "pypi"
name     = "PyPI"
homepage = "https://pypi.org"
# pypi.org's own og:description.
description = "The Python Package Index (PyPI) is a repository of software for the Python programming language."
icon     = "theSVG:pypi"
# `.pypirc` is read by the upload clients rather than by PyPI itself, so
# `detect` names the ones a user types: twine is the tool the Python Packaging
# User Guide recommends for uploading, and Flit's own doc/upload.rst has a
# "Using .pypirc" section — "You can create or edit a config file in your home
# directory, ``~/.pypirc``… This is also used by other Python tools such as
# twine."
executables   = ["twine", "flit"]

[dotfiles]

# The Python Packaging User Guide's own specification for the file
# (https://packaging.python.org/en/latest/specifications/pypirc/) puts it at
# `$HOME/.pypirc` and describes an INI file with a `[distutils]` section whose
# `index-servers` field "lists the name of all sections describing a
# repository", plus one section per repository holding `repository`, `username`
# and `password`. The repository list and URLs are worth carrying; the
# credentials are lifted out below.
paths = ["~/.pypirc"]

exclude = []

# Not a whole-file secret: without the credential lines this is still the list
# of indexes a machine uploads to.
secret = []

# The same specification is explicit that "this stores your password in plain
# text" and recommends chmod 600 for it. On PyPI today the value is an API
# token — `username = __token__` paired with a `pypi-…` string in `password` —
# and on a private index it is an account password; either way it is the
# credential. `username` stays as content, the way the `gh` entry keeps the
# account name and lifts only the token. An INI file is line-oriented, so a
# prefix rule reads it and needs no `format`.
[[dotfiles.secret_paths]]
file  = "~/.pypirc"
match = { prefix = ["password"] }