Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Brian Thompson Newsgroups: linux.debian.maint.python Subject: Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs Date: Sat, 26 Jun 2021 05:50:02 +0200 Message-ID: References: X-Original-To: debian-python@lists.debian.org X-Mailbox-Line: From debian-python-request@lists.debian.org Sat Jun 26 03:47:52 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-12.2 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, LDO_WHITELIST=-5, PGPSIGNATURE=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -3.5 X-Gm-Message-State: AOAM5317LdW/KN70DFIfrWiCLCmX4MbVqsEusEM5bUH8JAUz6JmMLhp6 RXk8Ax8yZJpmnl4rkiImh7FMeiDXYt8F6tRe X-Google-SMTP-Source: ABdhPJwFqK+ecjgHrkoT6AofK+CiELN+LN8YL2aaHGFQcagbZvyFoOKQPCw0wwGkT9SirI5uJE8hag== X-Received: by 2002:a92:7f04:: with SMTP id a4mr9677483ild.156.1624679257350; Fri, 25 Jun 2021 20:47:37 -0700 (PDT) MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="30tBJylNCu8eQVme" Content-Disposition: inline X-Mailing-List: archive/latest/19239 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/YNajVpDpVEUI/Us+@brians-debian Approved: robomod@news.nic.it Lines: 42 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Fri, 25 Jun 2021 22:47:34 -0500 X-Original-Message-ID: X-Original-References: <877dihvfp9.fsf@DigitalMercury.dynalias.net> <871r8pczvw.fsf@DigitalMercury.dynalias.net> Xref: csiph.com linux.debian.maint.python:13449 --30tBJylNCu8eQVme Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jun 25, 2021 at 07:01:39PM -0400, Nicholas D Steeves wrote: > Does PyPi provide immutable releases? =46rom experience, I can tell you that yes, releases cannot be overwritten, but they can be "yanked". Pypi states that a yanked release is: "A release that is always ignored by an installer, unless it is the only release that matches a version specifier (using either '=3D=3D' or '=3D=3D=3D)." --=20 Best regards, Brian T --30tBJylNCu8eQVme Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEg2s9vY2mGY7y4pi9hN+ATWfRmqIFAmDWo1IACgkQhN+ATWfR mqJCUQ//SDfBAmeHCcn58WpMb4eDMg+of+8tRzWJaaY/5QEbMmN97r85gK8sblHZ mZ9gCp9w6RmrPER0Q69cWt/k8cteCq/kPmKE3y3EZyHwDBYpqvgIHGKgMAC1lE72 pAFSejjClK3wh9S7Z9/lwulVC6tc0bSTudrWzPaD2HA+LMZJ+9Jdw0gbBdd5SmXb JdQaxlNdiZoeDododzTyuarQwo8lN8aXFDeGgtB7SsFO+8WbleSWXyhybS4Yin1Z kmrJhyXB3z1EEom0KCGeZTGIwRgdJL071uJ8ymc2K++CeoaUoDQWq1lPzDOagcMD +MJsQ0PE0z/62u8uuvvLDWe/kgq3bOIfi3RWeldF6f557QwADktv9OwzwW9cQbm5 0RQ/RBwq6pMeBttTJx1OGVoAEChE7oyPqqUrg6lxI/l8Bp6J2ADT5uSW52lAUXP5 fFVD3s+4E/QOOXZNvN7uR/09ykCRgEQ23fC04Eywe99yQVh2OvEbIx/yGePjp7Jb GU/91kRQVjNI0t6b44HAZKnlD9zLvp0cBaQeP3SG7YYSxQCXGK/xp+cZju0t0SLT fu3yGk8W8P8Z09StRFc3UfHvZAQO3QA8CPG1AW/fh/MUdnFrcnxkcvbcWXssCLNP EX/4WPXoA8FTNAikb0DTD0hYH6HwG9R1P0/mJxs4GA4DajFL6/I= =G/HO -----END PGP SIGNATURE----- --30tBJylNCu8eQVme--