Build provenance: This package is built and distributed by Astral as part of
astral-dev-toolchain. It packagescargo-distfrom tagv0.33.1at commit665cb7d48902a30386857f8f679e1b1942876f06.
dist distributes your binaries
The TL;DR is that with dist set up, just doing this:
git commit -am "release: 0.2.0"
git tag "v0.2.0"
git push
git push --tags
Will make this Github Release:
Or if you're using oranda, you'll get this website.
Plan, Build, Host, Publish, Announce
Cutting releases of your apps and distributing binaries for them has a lot of steps, and cargo-dist is quickly growing to try to cover them all!
To accomplish this, dist functionality can be broken up into two parts:
- building (planning the release; building binaries and installers)
- distributing (hosting artifacts; publishing packages; announcing releases)
The build functionality can be used on its own if you just want some tarballs and installers, but everything really comes together when you use the distribution functionality too.
Building
As a build tool, dist can do the following:
- Pick good build flags for "shippable binaries"
- Make tarballs and installers for the resulting binaries
- Generate machine-readable manifests so other tools can understand the results
That's a short list because "we make installers" is doing a lot of heavy lifting. Each installer could be (and sometimes is!) an entire standalone tool with its own documentation and ecosystem.
Distributing
As a distribution tool, dist gets to flex its biggest superpower: it generates its own CI scripts. For instance, enabling GitHub CI with dist init will generate release.yml, which implements the full pipeline of plan, build, host, publish, announce:
- Plan
- Waits for you to push a git tag for a new version (v1.0.0, my-app-v1.0.0, my-app/1.0.0, ...)
- Selects what apps in your workspace to announce new releases for based on that tag
- Generates a machine-readable manifest with changelogs and build plans
- Build
- Spins up machines for each platform you support
- Builds your binaries and tarballs
- Builds installers for your binaries
- Publish:
- Uploads to package managers
- Host + Announce:
- Creates (or edits) a GitHub Release
- Uploads build artifacts to the Release
- Adds relevant release notes from your RELEASES/CHANGELOG
Read The Book!
We've got all the docs you need over at the dist book!
Contributing
Updating Snapshots
dist's tests rely on cargo-insta for snapshot testing various
outputs. This allows us to both catch regressions and also more easily review UI/output changes. If a snapshot
test fails, you will need to use the cargo insta CLI tool to update them:
cargo install cargo-insta
Once installed, you can review and accept the changes with:
cargo insta review
If you know you like the changes, just use cargo insta accept to auto-apply all changes.
(If you introduced brand-new snapshot tests you will also have to git add them!)
NOTE: when it succeeds, cargo-dist-schema's
emittest will actually commit the results back to disk tocargo-dist-schema/cargo-dist-schema.jsonas a side-effect. This is a janky hack to make sure we have that stored and up to date at all times (the test also uses an insta snapshot but insta snapshots include an extra gunk header so it's not something we'd want to link end users). The file isn't even used for anything yet, I just want it to Exist because it seems useful and important. In the future we might properly host it and have our outputs link it via a$schemafield.
Cutting Releases
dist is self-hosting, so you just need to push a git-tag with the right format to "do" a release. Of course there's lots of other tedious tasks that come with updating a release, and we use cargo-release to handle all those mechanical details of updating versions/headings/tags. See these sections of the docs for the release workflow we use.
TL;DR:
- Update CHANGELOG.md's "Unreleased" section to include all the release notes you want
- run cargo-release as described in the docs
- ..you're done!
Note that we've wired up dist and cargo-release to understand the "Unreleased" heading so you should never edit that name, the tools will update it as needed.
If that releases succeeds, we recommend updating the bootstrap version of dist as a follow up:
- install the version of dist you just released on your system
- run
dist init --yes - commit "chore: update bootstrap dist to ..."
Note that as a consequence of the way we self-host, dist's published artifacts will always be built/generated by a previous version of itself. This can be problematic if you make breaking changes to cargo-dist-schema's format... so don't! Many things in the schema are intentionally optional to enable forward and backward compatibility, so this should hopefully work well!
Metadata
Release files for astral-dev-toolchain-cargo-dist 0.33.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distributions (wheels)
Total release size: 51.0 MB
Release files / astral_dev_toolchain_cargo_dist-0.33.1-py3-none-win_arm64.whl
| Download URL | astral_dev_toolchain_cargo_dist-0.33.1-py3-none-win_arm64.whl |
|---|---|
| Size | 7.8 MB |
| Tags | Python 3 Windows ARM64 |
|
SHA-256 checksum How to use checksums |
516ea4daf80993aef10ab2cb96d9e945deca7c072f8cffd5cb98b4b696bcd556
|
|
BLAKE2b-256 checksum How to use checksums |
6f36c4f2a19ee9c3e7167899af9067376664f5c4209baf44527fc7314b00a830
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.
Transparency logRelease files / astral_dev_toolchain_cargo_dist-0.33.1-py3-none-win_amd64.whl
| Download URL | astral_dev_toolchain_cargo_dist-0.33.1-py3-none-win_amd64.whl |
|---|---|
| Size | 8.3 MB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
a0397c930505f096972812f2cd60d465147111b7fd57939bc22c1b88c241816b
|
|
BLAKE2b-256 checksum How to use checksums |
6bd2980f3ec3425cd2445fcc8723f7137ca140c5bba6e70ffbbc3302734d7ae1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.
Transparency logRelease files / astral_dev_toolchain_cargo_dist-0.33.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
| Download URL | astral_dev_toolchain_cargo_dist-0.33.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
|---|---|
| Size | 8.7 MB |
| Tags | Linux glibc 2.17+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
9fefb3ad14ae8035cbe6f2ceb5c6ff9e4c39f90eab3bec9064e98a7025ead437
|
|
BLAKE2b-256 checksum How to use checksums |
b6bb330439112f6f539ffa5f11d6e8a148a62b976ce7ba0226369e18f480537a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.
Transparency logRelease files / astral_dev_toolchain_cargo_dist-0.33.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
| Download URL | astral_dev_toolchain_cargo_dist-0.33.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl |
|---|---|
| Size | 8.1 MB |
| Tags | Linux glibc 2.17+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
add6fe1834cc11a5431d5b592663aeb22085d883e7b9d02d51342d705a19525e
|
|
BLAKE2b-256 checksum How to use checksums |
bb1c06f83d9f17be3e07005cd7e3f8eb4d61e684fdbfb45c390caf4325fc5d15
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.
Transparency logRelease files / astral_dev_toolchain_cargo_dist-0.33.1-py3-none-macosx_11_0_arm64.whl
| Download URL | astral_dev_toolchain_cargo_dist-0.33.1-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 8.8 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
741fefd851c701f7a7b708d8ee17b8eb413af1a324395e5e1d0016cde78ba27f
|
|
BLAKE2b-256 checksum How to use checksums |
96de81a943720062b9db1fd79646ebffa38e86bc010136fe8df480a4e97e3904
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.
Transparency logRelease files / astral_dev_toolchain_cargo_dist-0.33.1-py3-none-macosx_10_12_x86_64.whl
| Download URL | astral_dev_toolchain_cargo_dist-0.33.1-py3-none-macosx_10_12_x86_64.whl |
|---|---|
| Size | 9.2 MB |
| Tags | Python 3 macOS 10.12+ x86-64 |
|
SHA-256 checksum How to use checksums |
56d1d1b4c14fa0f3fd380bc22b04b68acfc56f03bdc5815a2d9d9013872ce466
|
|
BLAKE2b-256 checksum How to use checksums |
8625cdeccef939c7c408f4d50eecfca19c6d10c9663afca35e407edeb493aabd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.
Transparency logSecurity for astral-dev-toolchain-cargo-dist 0.33.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 6 files in this release have been uploaded with provenance metadata.
Attestation for astral_dev_toolchain_cargo_dist-0.33.1-py3-none-win_arm64.whl
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
