@@ -152,13 +152,13 @@ class PackageMetadata(TypedDict, total=False):
152152 license_file : List [str ]
153153
154154 # Additional metadata
155- comment : Optional [ str ]
155+ comment : str
156156 pyversion : str
157157 filetype : str
158158 gpg_signature : Tuple [str , bytes ]
159159 attestations : str
160160 md5_digest : str
161- sha256_digest : Optional [ str ]
161+ sha256_digest : str
162162 blake2_256_digest : str
163163
164164
@@ -256,24 +256,30 @@ def metadata_dictionary(self) -> PackageMetadata:
256256 # names are computed but they can only be valid key names.
257257 data [field ] = value # type: ignore[literal-required]
258258
259- # override name with safe name
259+ # Override name with safe name.
260260 data ["name" ] = self .safe_name
261- # file content
261+
262+ # File content.
262263 data ["pyversion" ] = self .python_version
263264 data ["filetype" ] = self .filetype
264- # additional meta-data
265- data ["comment" ] = self .comment
266- data ["sha256_digest" ] = self .sha2_digest
265+
266+ # Additional meta-data: some of these fileds may not be set. Some
267+ # package repositories do not allow null values, so this only sends
268+ # non-null values. In particular, FIPS disables MD5 and Blake2, making
269+ # the digest values null. See https://github.com/pypa/twine/issues/775
270+
271+ if self .comment is not None :
272+ data ["comment" ] = self .comment
273+
274+ if self .sha2_digest is not None :
275+ data ["sha256_digest" ] = self .sha2_digest
267276
268277 if self .gpg_signature is not None :
269278 data ["gpg_signature" ] = self .gpg_signature
270279
271280 if self .attestations is not None :
272281 data ["attestations" ] = json .dumps (self .attestations )
273282
274- # FIPS disables MD5 and Blake2, making the digest values None. Some package
275- # repositories don't allow null values, so this only sends non-null values.
276- # See also: https://github.com/pypa/twine/issues/775
277283 if self .md5_digest :
278284 data ["md5_digest" ] = self .md5_digest
279285
0 commit comments