From b3318b60a4b9369299deb81b7e4b90a0b7f065e3 Mon Sep 17 00:00:00 2001
From: Fabian Witt <f.witt@reverce.io>
Date: Sun, 30 Aug 2026 10:47:56 +0200
Subject: [PATCH 1/3] build: drop wheel, setuptools and pytest from runtime
 dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

None of the three is imported anywhere under `src/`. `c2pa.py` and `lib.py`
import only the standard library; `build.py` — the `download-artifacts` console
script — imports `requests` and, lazily, `toml`. Those two stay.

They are also already classified correctly elsewhere in the repo:

* `[build-system] requires` already lists `setuptools>=68.0.0` and `wheel`, so
  the build has what it needs and the runtime entries are duplicates.
* `requirements-dev.txt` lists `wheel` and `setuptools` under
  "# Build dependencies" and `pytest` under "# Testing dependencies".
* `.github/workflows/build.yml` installs pytest explicitly (`pip install
  pytest`, lines 285 and 377), so CI does not rely on the runtime declaration
  either.

Removing them is therefore a no-op for this repo's own build and test paths,
and it keeps three packages out of every consumer's production environment.
---
 pyproject.toml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index e8945b67..af846cc6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -22,10 +22,9 @@ maintainers = [
 ]
 urls = {homepage = "https://contentauthenticity.org", repository = "https://github.com/contentauth/c2pa-python"}
 dependencies = [
-    "wheel>=0.41.2",
-    "setuptools>=68.0.0",
+    # `toml` and `requests` are read at runtime by the `download-artifacts`
+    # console script (src/c2pa/build.py), so they stay.
     "toml>=0.10.2",
-    "pytest>=7.4.0",
     "cryptography>=41.0.0",
     "requests>=2.0.0"
 ]

From 1267186339e0c76698471b6786a9d437c6eb4eff Mon Sep 17 00:00:00 2001
From: Fabian Witt <f.witt@reverce.io>
Date: Mon, 31 Aug 2026 08:27:55 +0200
Subject: [PATCH 2/3] build: declare pytest in a PEP 735 dev dependency group
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dropping pytest from `[project.dependencies]` left it undeclared in
pyproject.toml entirely, with `requirements-dev.txt` as the only manifest
naming it. `[dependency-groups] dev` states it where it belongs: installed
for contributors (`uv sync`, `pip install --group dev`) and, unlike
`[project.optional-dependencies]`, absent from the published package
metadata — which is the separation this branch is about.

The bound matches requirements-dev.txt (`pytest>=8.1.0`) rather than the
`>=7.4.0` the runtime entry carried; nothing installs the old one.

The comment above the remaining dependencies goes with it. The rationale
for keeping `toml` and `requests` belongs in the pull request, not in a
manifest that has carried no comments so far.
---
 pyproject.toml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index af846cc6..e0ff0d54 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -22,13 +22,16 @@ maintainers = [
 ]
 urls = {homepage = "https://contentauthenticity.org", repository = "https://github.com/contentauth/c2pa-python"}
 dependencies = [
-    # `toml` and `requests` are read at runtime by the `download-artifacts`
-    # console script (src/c2pa/build.py), so they stay.
     "toml>=0.10.2",
     "cryptography>=41.0.0",
     "requests>=2.0.0"
 ]
 
+[dependency-groups]
+dev = [
+    "pytest>=8.1.0"
+]
+
 [project.scripts]
 download-artifacts = "c2pa.build:download_artifacts"
 

From b8b5c3c2977b2ea3e7053a9fdc30240fb7f82474 Mon Sep 17 00:00:00 2001
From: Fabian Witt <f.witt@reverce.io>
Date: Wed, 2 Sep 2026 10:16:29 +0200
Subject: [PATCH 3/3] build: keep pytest declared in requirements-dev.txt only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review feedback: the PEP 735 group restated a bound that
`requirements-dev.txt` already carries, so the two could drift — which is
what this branch set out to stop, not to reproduce one line further down.

Nothing in the repo would have read the group. The Makefile's `install-deps`
and every workflow that installs dependencies do so with `pip install -r
requirements-dev.txt` (`build.yml` lines 52, 90/93, 164/167, 490/492), and
the wheel test jobs install pytest by name. The group was a declaration with
no consumer.

The published metadata — the point of this branch — is unaffected either
way, and the diff is now purely subtractive.
---
 pyproject.toml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index e0ff0d54..f7fb6395 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -27,11 +27,6 @@ dependencies = [
     "requests>=2.0.0"
 ]
 
-[dependency-groups]
-dev = [
-    "pytest>=8.1.0"
-]
-
 [project.scripts]
 download-artifacts = "c2pa.build:download_artifacts"