I recently built a Python library for the first time in a while, and to make it available in PyPI I followed the official Python packaging guide. But it turns out there’s some rough edges in the suggested tools.
Namely, the build backend hatch puts all the files in the project directory into the built sdist, except from some files it chooses to exclude, which led to a gitignored file as well as VCS metadata getting packaged and uploaded to PyPI. This really surprised me, and I think most Python users new to packaging would be better served by choosing a conservative build backend like uv_build, which puts only the Python source modules and some specific project-level files into the sdist.
Thank you. That seems quite problematic. I would expect the build backend only to include what I tell it to. IIRC pyproject has a field to tell which packages exist in the project and I’d expect only that to be included + what was specified e.g resources like images.
the article doesn’t mention the many ways you can define what (not) to include that hatch offers.
The problem is the default. It’s seemingly opt-out, not opt-in. That leads to experiences like these.