commit 72e37c4062bfd4abbd1968d0fd42023511681960
author Alex Gaynor <alex.gaynor@gmail.com> Mon Jul 24 08:28:25 2017 -0400
committer Paul Kehrer <paul.l.kehrer@gmail.com> Mon Jul 24 15:28:25 2017 +0300
tree 397d9ecc40875850595a95d74bbcdacedb1d8fe8
parent 96ffd91956657775696bc6e260890543a5fba58b

Refs #3646 -- Don't use shell globbing in our release script (#3809)

release.py

diff --git a/release.py b/release.py
index b380179..77391e8 100644
--- a/release.py
+++ b/release.py
@@ -5,6 +5,7 @@
 from __future__ import absolute_import, division, print_function
 
 import getpass
+import glob
 import io
 import os
 import subprocess
@@ -106,10 +107,11 @@
     run("python", "setup.py", "sdist")
     run("python", "setup.py", "sdist", "bdist_wheel", cwd="vectors/")
 
-    run(
-        "twine", "upload", "-s", "dist/cryptography-{0}*".format(version),
-        "vectors/dist/cryptography_vectors-{0}*".format(version), shell=True
+    packages = (
+        glob.glob("dist/cryptography-{0}*".format(version)) +
+        glob.glob("vectors/dist/cryptography_vectors-{0}*".format(version))
     )
+    run("twine", "upload", "-s", *packages)
 
     session = requests.Session()