shakeout
A static, tree-shaking bundler for Python. Give it an entry script: it finds every module the
program can import, removes top-level code nothing can reach, and writes a self-contained
artifact. That can be one runnable .py, a zipapp, a pruned directory or a reproducible AWS
Lambda zip. Tracebacks from bundles name the original files and lines.
$ uvx shakeout build app/main.py -o dist # one runnable file
$ uvx shakeout build handler.py -t lambda --export handler # Lambda package
$ uvx shakeout report app/main.py # what is kept, and why
$ uvx shakeout why app/main.py pkg.core:helper # the chain that keeps a symbol
Documentation: https://revmischa.github.io/shakeout/ (sources in docs/; the
design and roadmap are in docs/project/design.md).
Guarantees
- Sound by default. Anything the analysis can't prove unused is kept: registration
decorators,
__init_subclass__and metaclass registries, modules that useglobals(),evalorsys.modules, module objects passed around as values, star imports. - Exact tracebacks without source maps. Modules keep their original file names and line
numbers, and their sources are registered with
linecache. Tracebacks,warnings,inspect.getsourceand error trackers show real files, lines, carets and code, even in Lambda. - Self-explaining failures. Reaching a removed name at runtime raises the usual exception
with a note that names the
keepsetting to add.
How it is tested
| Tier | What it checks |
|---|---|
Case catalog (tests/cases/**/*.case) |
126 multi-file programs: expected removals, behavioral equivalence of every target (stdout, exit code, traceback frames), a no-shake build, reviewed golden reports |
| Soundness oracle | runs the original under sys.monitoring; fails if any function that executed was removed |
| Differential checks | scope analysis vs. CPython's symtable, and minified vs. original bytecode, over the whole stdlib |
| Fuzzing | Hypothesis-generated multi-module programs; equivalence + soundness |
| Mutation testing | 100% of mutants in the effects rules, class analysis and shaker are killed (floor 99%) |
| Real-world corpus (nightly) | attrs, click, dateutil, idna, jinja2, packaging, rich, six, tomli |
| Self-hosting | shakeout bundles itself byte-identically and contains no dead code |
Every gate CI runs is in scripts/check.sh: ruff with all rules, strict pyright and mypy,
96% branch coverage, vulture, codespell, packaging checks, pip-audit, zizmor and actionlint, and
a strict docs build. CPython 3.10 to 3.15 are supported (scripts/matrix.sh).
Metadata
Release files for shakeout 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| shakeout-0.1.0.tar.gz | 329.1 kB | With provenance | Details for shakeout-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| shakeout-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for shakeout-0.1.0-py3-none-any.whl |
Total release size: 385.3 kB
Release files / shakeout-0.1.0.tar.gz
| Download URL | shakeout-0.1.0.tar.gz |
|---|---|
| Size | 329.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b65b8ed2ef6423815d7ddde0688215ea63868524535308ed9f880517e7e3c182
|
|
BLAKE2b-256 checksum How to use checksums |
fdfe09da0be1056fe4175dc79925cc833276d28603a124444e534439570bb011
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.
Transparency logRelease files / shakeout-0.1.0-py3-none-any.whl
| Download URL | shakeout-0.1.0-py3-none-any.whl |
|---|---|
| Size | 56.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
65bc5365836c562d8356509c8d0b13884c2234594096801e3e985b3de5f1a5b5
|
|
BLAKE2b-256 checksum How to use checksums |
d8a66fa37e9eee80607569ff548eb1350f3accf7f7223428531f79f129049c10
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.
Transparency logSecurity for shakeout 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
Both files in this release have been uploaded with provenance metadata.
Attestation for shakeout-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.