PyPI

apache-skywalking-asz-langchain is the LangChain plugin under plugins/langchain. It is in the voted source package, and PyPI is a convenience channel written after the vote, as the Homebrew tap and the apt repository are. Nothing is uploaded for a candidate, and the version uploaded is the released one, which release.sh prepare wrote into plugins/langchain/pyproject.toml.

Unlike the Homebrew and apt skills, this one opens no pull request. It uploads, and an upload cannot be undone: PyPI never accepts a file name twice, even after the file is deleted.

Ask for the version when it is not given. Then:

0. Set up the upload

The project apache-skywalking-asz-langchain is on PyPI since 0.5.0, whose upload created it. Only an owner or a maintainer of the project on PyPI can upload. A release manager who is neither asks an owner to add them.

1. A PyPI account with two-factor authentication. PyPI refuses an upload from an account without it.
2. An API token. A token scoped to a project can only be made once the project exists. So the upload that creates a project needs a token scoped to the whole account, as 0.5.0 did. Every later upload uses a token scoped to apache-skywalking-asz-langchain. After the first upload, replace the account token with a project token, and delete the account token.
3. The token in SW_PYPI_TOKEN, exported from the shell profile, such as ~/.zprofile, before Claude Code starts. When the 0.5.0 token was added to the profile during a session, the session did not see it until Claude Code was started again. Reading it out of the profile from inside the session was refused by the permission check of auto mode.

Check it without printing it. Stop and tell the user when it is not set:

[ -n "$SW_PYPI_TOKEN" ] && echo "SW_PYPI_TOKEN is set, ${#SW_PYPI_TOKEN} characters"

Never print the token, and never write it into a file.

1. Download the voted source package and verify it

The newest version is on downloads.apache.org minutes after the move. archive.apache.org holds every version, but gets a new one later: for 0.5.0 it still answered 404 fifteen minutes after the move, and 200 when checked again four hours later. So try the download site first.

v=VERSION
pkg=apache-skywalking-ai-sessionizer-$v-src.tgz
W=$(mktemp -d); cd "$W"
for f in "$pkg" "$pkg.sha512" "$pkg.asc"; do
  curl --noproxy '*' -fsSLO "https://downloads.apache.org/skywalking/ai-sessionizer/$v/$f" ||
    curl --noproxy '*' -fsSLO "https://archive.apache.org/dist/skywalking/ai-sessionizer/$v/$f"
done
curl --noproxy '*' -fsSL -o KEYS https://downloads.apache.org/skywalking/KEYS
gpg --dearmor < KEYS > keys.gpg
shasum -a 512 -c "$pkg.sha512" && gpgv --keyring "$W/keys.gpg" "$pkg.asc" "$pkg"
tar -xzf "$pkg"

gpgv reads KEYS from a file of its own, so the user's keyring is left alone. gpg --import into a scratch directory under a long path hung on macOS, waiting to start gpg-agent. A local proxy can break HTTPS to Apache hosts, which is why the commands go around it.

Stop if either check fails. Nothing is built from a package that did not verify.

2. Build from the package, not from a checkout

A checkout can hold what the vote did not.

python3 -m venv build-env && . build-env/bin/activate
pip install --quiet build twine
python -m build --outdir dist "apache-skywalking-ai-sessionizer-$v-src/plugins/langchain"
twine check dist/*

dist/ holds apache_skywalking_asz_langchain-$v.tar.gz and apache_skywalking_asz_langchain-$v-py3-none-any.whl. Check the version in the file names is $v, and that unzip -l dist/*.whl lists LICENSE and NOTICE under the .dist-info directory.

3. Install the wheel where nothing else is, and run it

asz-langchain status exits 1 while the plugin is not enabled and 0 while it is, so the checks below say which exit code they expect. enable writes only into the environment's own site directory.

python3 -m venv try-env && . try-env/bin/activate
pip install --quiet dist/*.whl
asz-langchain status && { echo "enabled before enable"; exit 1; }
asz-langchain enable && asz-langchain status || { echo "enable did not take"; exit 1; }
asz-langchain disable && ! asz-langchain status || { echo "disable did not take"; exit 1; }
deactivate

status must say "not enabled", then "enabled at ...", then "not enabled" again. Stop if a line prints its message.

4. Upload

. build-env/bin/activate
TWINE_USERNAME=__token__ TWINE_PASSWORD="${SW_PYPI_TOKEN:?SW_PYPI_TOKEN is not set}" \
  twine upload --non-interactive dist/*

--non-interactive makes a missing or refused token fail, rather than wait for a password prompt that nobody sees. To correct a version once it is uploaded, release the next version.

5. Check it landed

PyPI must hold the two files that were built, byte for byte, and they must install. Run this in the directory of the upload: a build run again from the same source gives other bytes. Measured on 0.5.0, a rebuilt wheel held the same files with the same bytes as the uploaded one, and differed only in the time recorded for the files the build writes.

curl -fsSL "https://pypi.org/pypi/apache-skywalking-asz-langchain/$v/json" |
  python3 -c 'import json, sys; [print(f["digests"]["sha256"] + "  " + f["filename"]) for f in json.load(sys.stdin)["urls"]]'
shasum -a 256 dist/*
python3 -m venv pypi-env && . pypi-env/bin/activate
pip install --quiet --no-cache-dir "apache-skywalking-asz-langchain==$v"
pip index versions apache-skywalking-asz-langchain
asz-langchain status; echo "exit $? (1: installed, not enabled)"
deactivate

Then say what was uploaded and where, and clean up $W. After an upload made with a token scoped to the whole account, remind the user to replace it with a token scoped to the project.