Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #83373

PyPI files should not change their payload (was: Announce: PyPrimes 0.2.1a)

Show key headers only | View raw

Steven D'Aprano <steve+comp.lang.python@pearwood.info> writes:

> I screwed up the upload to PyPI, and it won't allow you to upload the
> same version twice. (At least, I don't know of any way to do so.) So I
> had to bump the version number to re-upload.

There is currently a hack that can be done (I won't say what it is) to
upload a different payload with the same filename. Please don't do it.

This is widely regarded, and I agree, as a bug: once PyPI has a file of
a particular name (including the package version), that filename should
only ever refer to that same content and never anything else.

Over at ‘distutils-sig’, way back in 2014-09, a discussion reached the
consensus that the current undocumented ability to change the payload of
an existing file from PyPI is an oversight that needs to be closed
<URL:https://mail.python.org/pipermail/distutils-sig/2014-September/024890.html>,
with the Python Packaging Authority making its position known at
<URL:https://mail.python.org/pipermail/distutils-sig/2014-September/024921.html>:

    Silently changing released artefacts is actively user hostile. It
    breaks mirroring, it breaks redistribution, it breaks security
    audits, and it can even break installation for security conscious
    users that are using peep rather than pip.
    […]

    I am thoroughly *against* retaining a general capability to silently
    substitute the contents of previously released files with a
    different payload solely to handle the case of packaging errors that
    aren't otherwise severe enough to warrant bumping the version number
    […].
    
So, it seems you did the right thing in uploading different package
source content with a later version string.

The issue of remembering to update the Changelog document is another
matter, which I'll address in a different message.

-- 
 \     “Capitalism has destroyed our belief in any effective power but |
  `\      that of self interest backed by force.” —George Bernard Shaw |
_o__)                                                                  |
Ben Finney

Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Announce: PyPrimes 0.2.1a Steven D'Aprano <steve@pearwood.info> - 2015-01-08 04:35 +0000
  Re: Announce: PyPrimes 0.2.1a Ben Finney <ben+python@benfinney.id.au> - 2015-01-08 18:12 +1100
    Re: Announce: PyPrimes 0.2.1a Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-01-08 22:16 +1100
      Re: Announce: PyPrimes 0.2.1a Irmen de Jong <irmen.NOSPAM@xs4all.nl> - 2015-01-08 23:32 +0100
        Re: Announce: PyPrimes 0.2.1a Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-01-09 11:41 +1100
          Re: Announce: PyPrimes 0.2.1a Chris Angelico <rosuav@gmail.com> - 2015-01-09 11:50 +1100
            Re: Announce: PyPrimes 0.2.1a alister <alister.nospam.ware@ntlworld.com> - 2015-01-09 09:05 +0000
              Re: Announce: PyPrimes 0.2.1a Ben Finney <ben+python@benfinney.id.au> - 2015-01-09 22:01 +1100
                Re: Announce: PyPrimes 0.2.1a alister <alister.nospam.ware@ntlworld.com> - 2015-01-09 11:42 +0000
          Where to learn current best Python packaging practices (was: Announce: PyPrimes 0.2.1a) Ben Finney <ben+python@benfinney.id.au> - 2015-01-09 12:11 +1100
            Re: Where to learn current best Python packaging practices (was: Announce: PyPrimes 0.2.1a) Rustom Mody <rustompmody@gmail.com> - 2015-01-08 17:39 -0800
            Re: Where to learn current best Python packaging practices (was: Announce: PyPrimes 0.2.1a) Rick Johnson <rantingrickjohnson@gmail.com> - 2015-01-08 17:42 -0800
              Re: Where to learn current best Python packaging practices Ben Finney <ben+python@benfinney.id.au> - 2015-01-09 13:37 +1100
      PyPI files should not change their payload (was: Announce: PyPrimes 0.2.1a) Ben Finney <ben+python@benfinney.id.au> - 2015-01-09 10:55 +1100
        Re: PyPI files should not change their payload (was: Announce: PyPrimes 0.2.1a) Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-01-09 11:38 +1100
      Using a ChangeLog as a canonical source of package metadata (was: Announce: PyPrimes 0.2.1a) Ben Finney <ben+python@benfinney.id.au> - 2015-01-09 11:06 +1100
        Re: Using a ChangeLog as a canonical source of package metadata (was: Announce: PyPrimes 0.2.1a) Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-01-12 05:17 +1100
          Re: Using a ChangeLog as a canonical source of package metadata Ben Finney <ben+python@benfinney.id.au> - 2015-01-12 07:21 +1100
            Re: Using a ChangeLog as a canonical source of package metadata wxjmfauth@gmail.com - 2015-01-11 12:37 -0800
              Re: Using a ChangeLog as a canonical source of package metadata Steven D'Aprano <steve@pearwood.info> - 2015-01-12 05:44 +0000
                Re: Using a ChangeLog as a canonical source of package metadata wxjmfauth@gmail.com - 2015-01-12 05:24 -0800
                Re: Using a ChangeLog as a canonical source of package metadata Steven D'Aprano <steve@pearwood.info> - 2015-01-13 06:59 +0000
                Re: Using a ChangeLog as a canonical source of package metadata wxjmfauth@gmail.com - 2015-01-13 00:09 -0800
                Re: Using a ChangeLog as a canonical source of package metadata Steven D'Aprano <steve@pearwood.info> - 2015-01-13 08:22 +0000
          Re: Using a ChangeLog as a canonical source of package metadata Ben Finney <ben+python@benfinney.id.au> - 2015-01-14 21:59 +1100
      Re: Using a ChangeLog as a canonical source of package metadata (was: Announce: PyPrimes 0.2.1a) Chris Angelico <rosuav@gmail.com> - 2015-01-09 11:16 +1100
  Re: Announce: PyPrimes 0.2.1a Christian Gollwitzer <auriocus@gmx.de> - 2015-01-08 08:27 +0100
    Re: Announce: PyPrimes 0.2.1a Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-01-08 22:20 +1100

csiph-web