Skip to main content

shakeout

A static, tree-shaking bundler for Python. Give it an entry script: it finds every module the program can import, removes top-level code nothing can reach, and writes a self-contained artifact. That can be one runnable .py, a zipapp, a pruned directory or a reproducible AWS Lambda zip. Tracebacks from bundles name the original files and lines.

$ uvx shakeout build app/main.py -o dist                       # one runnable file
$ uvx shakeout build handler.py -t lambda --export handler     # Lambda package
$ uvx shakeout report app/main.py                              # what is kept, and why
$ uvx shakeout why app/main.py pkg.core:helper                 # the chain that keeps a symbol

Documentation: https://revmischa.github.io/shakeout/ (sources in docs/; the design and roadmap are in docs/project/design.md).

Guarantees

  • Sound by default. Anything the analysis can't prove unused is kept: registration decorators, __init_subclass__ and metaclass registries, modules that use globals(), eval or sys.modules, module objects passed around as values, star imports.
  • Exact tracebacks without source maps. Modules keep their original file names and line numbers, and their sources are registered with linecache. Tracebacks, warnings, inspect.getsource and error trackers show real files, lines, carets and code, even in Lambda.
  • Self-explaining failures. Reaching a removed name at runtime raises the usual exception with a note that names the keep setting to add.

How it is tested

Tier What it checks
Case catalog (tests/cases/**/*.case) 126 multi-file programs: expected removals, behavioral equivalence of every target (stdout, exit code, traceback frames), a no-shake build, reviewed golden reports
Soundness oracle runs the original under sys.monitoring; fails if any function that executed was removed
Differential checks scope analysis vs. CPython's symtable, and minified vs. original bytecode, over the whole stdlib
Fuzzing Hypothesis-generated multi-module programs; equivalence + soundness
Mutation testing 100% of mutants in the effects rules, class analysis and shaker are killed (floor 99%)
Real-world corpus (nightly) attrs, click, dateutil, idna, jinja2, packaging, rich, six, tomli
Self-hosting shakeout bundles itself byte-identically and contains no dead code

Every gate CI runs is in scripts/check.sh: ruff with all rules, strict pyright and mypy, 96% branch coverage, vulture, codespell, packaging checks, pip-audit, zizmor and actionlint, and a strict docs build. CPython 3.10 to 3.15 are supported (scripts/matrix.sh).

Metadata

Release files for shakeout 0.1.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for shakeout 0.1.1
File Size Uploaded Provenance Actions
shakeout-0.1.1.tar.gz 332.2 kB With provenance Details for shakeout-0.1.1.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for shakeout 0.1.1
File Interpreter ABI Platform Actions
shakeout-0.1.1-py3-none-any.whl Python 3 none any Details for shakeout-0.1.1-py3-none-any.whl

Total release size: 390.3 kB

Release files / shakeout-0.1.1.tar.gz

Download URL shakeout-0.1.1.tar.gz
Size 332.2 kB
Tags Source
SHA-256 checksum
How to use checksums
f1a0b2d227970d9cd3686b2120d9fedb301c3346eb7cd678ec6f163e59758f0c
BLAKE2b-256 checksum
How to use checksums
3db630bb44090b0782d435d346c19ba1236843785fe9b8631a6b2d67a1aea7f4
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 11, 2026.

Transparency log

Release files / shakeout-0.1.1-py3-none-any.whl

Download URL shakeout-0.1.1-py3-none-any.whl
Size 58.1 kB
Tags Python 3
SHA-256 checksum
How to use checksums
d7c03894550329d930274afd7e124d8c3f62ca67f9ee82c3481aa9fc11603404
BLAKE2b-256 checksum
How to use checksums
778c0ea34e0902fee002fdf228ca24036dbce24896be4ccd5f295917b56d835c
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 11, 2026.

Transparency log

Security for shakeout 0.1.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

Both files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for shakeout-0.1.1.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 11, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1.1 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page