The Life Starter
0 of 6 complete0%
Course Library · Lesson 3 of 6
Digital · Guided lesson

Package only declared release files

About 29 minutes · 7 reading + 22 practice and checks
Time includes reading, practice, and questions. Extra videos or further study are optional.
See this course’s project requirements

A local Python release script that validates source, runs tests, packages only allowlisted files, writes checksums and stops on a failing stage.

Keep your working files in your own notebook or software. Save a private description, checklist, and work link in My Proof.

What to include

  • Create an ordered stage/gate map with explicit failure branches.
  • Document the exact child command, working directory, timeout, and failure interpretation.
  • Create and inspect an actual archive whose member list exactly matches the release allowlist.
  • Recompute the delivered archive digest and explain integrity versus correctness/provenance.
  • Demonstrate failed-test stop and byte-preserving overwrite refusal in isolated copies.
  • Deliver one declared local release with stage, package, checksum, failure, and operational-limit evidence.

Review and revise

Use these criteria to check your work and choose what to improve.

  • The implementation or declared simulation follows the supplied contract and retains inspectable original inputs.
  • Normal, boundary and rejected cases are recorded with expected versus observed results.
  • The changed case has a correct explanation and does not rely on hidden state.
  • The project includes source, outputs, instructions and honest tool, privacy and verification limits.
Open the full course project
Want more background?
Before you begin

The idea in everyday life

Original local greeting project: greeting.py, test-greeting.py, usage.txt, release.py and test-pipeline.py. Its release archive may contain only greeting.py and usage.txt. No external CI account, deployment, or package installation is required.

The idea

An allowlist defines the archive contents. Source-folder presence is not permission to include secrets, caches, fixtures, or unrelated learner work.

Follow along

Package only declared release files — original worked practice

An allowlist defines the archive contents. Source-folder presence is not permission to include secrets, caches, fixtures, or unrelated learner work.

Original local greeting project: greeting.py, test-greeting.py, usage.txt, release.py and test-pipeline.py. Its release archive may contain only greeting.py and usage.txt. No external CI account, deployment, or package installation is required.

  1. 1. Step 1

    Read ALLOW containing greeting.py and usage.txt.

    You should see: Only two names are selected for the archive.

    An allowlist defines the archive contents. Source-folder presence is not permission to include secrets, caches, fixtures, or unrelated learner work.

  2. 2. Step 2

    Run python3 release.py --output release-one in a fresh practice folder.

    You should see: The successful pipeline creates the archive and manifest.

    An allowlist defines the archive contents. Source-folder presence is not permission to include secrets, caches, fixtures, or unrelated learner work.

  3. 3. Step 3

    Inspect the ZIP member list with a file viewer or the supplied test.

    You should see: The members exactly match the two selected names.

    An allowlist defines the archive contents. Source-folder presence is not permission to include secrets, caches, fixtures, or unrelated learner work.

  4. 4. Step 4

    Record why test files and __pycache__ are omitted from this small distributable.

    You should see: An exact packaging inventory.

    An allowlist defines the archive contents. Source-folder presence is not permission to include secrets, caches, fixtures, or unrelated learner work.

Now change one thing

A file personal-notes.txt is beside release.py but not in ALLOW. How many copies of it belong in this archive?

Your work

What to finish

Create and inspect an actual archive whose member list exactly matches the release allowlist.

Common mistake

Watch for this

Archiving an entire working folder and accidentally including caches or unrelated notes.

How can I tell I understand it?

Demonstrate the rule: An allowlist defines the archive contents. Source-folder presence is not permission to include secrets, caches, fixtures, or unrelated learner work. Use the supplied variant to distinguish a changed result from a broken implementation.

Try 3 questions

Quick knowledge check

Answer all 3 questions. Get at least 2 right and the lesson completes automatically.

Not yet passed

You’ll get an explanation for each answer. Signed in? Your results save to your account.

1Which file belongs in the supplied release ZIP?
2Why inspect the actual ZIP rather than only ALLOW source text?
3What should happen if an unrelated notes file appears in the archive?
0 of 3 answeredApply the lesson to a short question, then review the explanation.
3
Finish this lesson

Pass the check. We’ll save the progress.

Answer all 3 questions above and get at least 2 right. You can review the explanations and try again.

Go to the knowledge check
Tools, templates, and lesson sources

Tools and templates

Tools open in a new tab so you can keep your place here.

Sources and further reading

Explore the references behind this lesson.

docs.python.org — zipfile.html
Source & access notes · checked 2026-10-01

Relevant documented module/API behavior inspected during expansion authoring; actual execution evidence is recorded separately. No grant eligibility is established.

Access: Official page retrieved with the web reader on 2026-10-01. Documentation reading does not certify execution in every native tool or browser.

Reuse: Original local practice files, fictional data, worked examples and questions. Concepts paraphrased and linked; source exercises are not copied.

Report a problem with this lesson

Tell us what went wrong. Please leave out personal information and private project contents.

No sign-in needed.