Skip to main content

shakeout

A static, tree-shaking bundler for Python. Give it an entry script: it finds every module the program can import, removes top-level code nothing can reach, and writes a self-contained artifact. That can be one runnable .py, a zipapp, a pruned directory or a reproducible AWS Lambda zip. Tracebacks from bundles name the original files and lines.

$ uvx shakeout build app/main.py -o dist                       # one runnable file
$ uvx shakeout build handler.py -t lambda --export handler     # Lambda package
$ uvx shakeout report app/main.py                              # what is kept, and why
$ uvx shakeout why app/main.py pkg.core:helper                 # the chain that keeps a symbol

Documentation: https://revmischa.github.io/shakeout/ (sources in docs/; the design and roadmap are in docs/project/design.md).

Guarantees

  • Sound by default. Anything the analysis can't prove unused is kept: registration decorators, __init_subclass__ and metaclass registries, modules that use globals(), eval or sys.modules, module objects passed around as values, star imports.
  • Exact tracebacks without source maps. Modules keep their original file names and line numbers, and their sources are registered with linecache. Tracebacks, warnings, inspect.getsource and error trackers show real files, lines, carets and code, even in Lambda.
  • Self-explaining failures. Reaching a removed name at runtime raises the usual exception with a note that names the keep setting to add.

How it is tested

Tier What it checks
Case catalog (tests/cases/**/*.case) 126 multi-file programs: expected removals, behavioral equivalence of every target (stdout, exit code, traceback frames), a no-shake build, reviewed golden reports
Soundness oracle runs the original under sys.monitoring; fails if any function that executed was removed
Differential checks scope analysis vs. CPython's symtable, and minified vs. original bytecode, over the whole stdlib
Fuzzing Hypothesis-generated multi-module programs; equivalence + soundness
Mutation testing 100% of mutants in the effects rules, class analysis and shaker are killed (floor 99%)
Real-world corpus (nightly) attrs, click, dateutil, idna, jinja2, packaging, rich, six, tomli
Self-hosting shakeout bundles itself byte-identically and contains no dead code

Every gate CI runs is in scripts/check.sh: ruff with all rules, strict pyright and mypy, 96% branch coverage, vulture, codespell, packaging checks, pip-audit, zizmor and actionlint, and a strict docs build. CPython 3.10 to 3.15 are supported (scripts/matrix.sh).

Metadata

Release files for shakeout 0.1.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for shakeout 0.1.0
File Size Uploaded Provenance Actions
shakeout-0.1.0.tar.gz 329.1 kB With provenance Details for shakeout-0.1.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for shakeout 0.1.0
File Interpreter ABI Platform Actions
shakeout-0.1.0-py3-none-any.whl Python 3 none any Details for shakeout-0.1.0-py3-none-any.whl

Total release size: 385.3 kB

Release files / shakeout-0.1.0.tar.gz

Download URL shakeout-0.1.0.tar.gz
Size 329.1 kB
Tags Source
SHA-256 checksum
How to use checksums
b65b8ed2ef6423815d7ddde0688215ea63868524535308ed9f880517e7e3c182
BLAKE2b-256 checksum
How to use checksums
fdfe09da0be1056fe4175dc79925cc833276d28603a124444e534439570bb011
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.

Transparency log

Release files / shakeout-0.1.0-py3-none-any.whl

Download URL shakeout-0.1.0-py3-none-any.whl
Size 56.3 kB
Tags Python 3
SHA-256 checksum
How to use checksums
65bc5365836c562d8356509c8d0b13884c2234594096801e3e985b3de5f1a5b5
BLAKE2b-256 checksum
How to use checksums
d8a66fa37e9eee80607569ff548eb1350f3accf7f7223428531f79f129049c10
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.

Transparency log

Security for shakeout 0.1.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

Both files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for shakeout-0.1.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1.0 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page