Refs pyca#3646 -- Don't use shell globbing in our release script (pyc…

…a#3809)
i-stam · Jul 24, 2017 · 72e37c4 · 72e37c4
1 parent 96ffd91
commit 72e37c4
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/release.py b/release.py
@@ -5,6 +5,7 @@
 from __future__ import absolute_import, division, print_function
 
 import getpass
+import glob
 import io
 import os
 import subprocess
@@ -106,10 +107,11 @@ def release(version):
     run("python", "setup.py", "sdist")
     run("python", "setup.py", "sdist", "bdist_wheel", cwd="vectors/")
 
-    run(
-        "twine", "upload", "-s", "dist/cryptography-{0}*".format(version),
-        "vectors/dist/cryptography_vectors-{0}*".format(version), shell=True
+    packages = (
+        glob.glob("dist/cryptography-{0}*".format(version)) +
+        glob.glob("vectors/dist/cryptography_vectors-{0}*".format(version))
     )
+    run("twine", "upload", "-s", *packages)
 
     session = requests.Session()