Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #13451

Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs

Path csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod
From Donald Stufft <donald@stufft.io>
Newsgroups linux.debian.maint.python
Subject Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs
Date Sat, 26 Jun 2021 06:30:01 +0200
Message-ID <Cu877-Yp-1@gated-at.bofh.it> (permalink)
References <Cu7up-rq-1@gated-at.bofh.it>
X-Original-To Brian Thompson <brian@hashvault.io>
X-Mailbox-Line From debian-python-request@lists.debian.org Sat Jun 26 04:21:13 2021
Old-Return-Path <donald@stufft.io>
X-Amavis-Spam-Status No, score=-7.2 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no
X-Policyd-Weight NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .stufft. - helo: .mail-qv1-xf34.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5
X-Gm-Message-State AOAM531bbtkf5eppJoqySVJpb1UlfxwQ3xO6f50TBn+au+57wTRDcf23 5u2810SUOhaPWaioLY/PHJMx5zOnfqy3WFJj
X-Google-SMTP-Source ABdhPJyJKyvBGlliKCePcEeRceIw/g/jPgFEN+SVt86P1oXqBb0CePikDHGFApGM99gPyVXu31gZNg==
X-Received by 2002:ad4:4833:: with SMTP id h19mr4282075qvy.34.1624681255765; Fri, 25 Jun 2021 21:20:55 -0700 (PDT)
Content-Type text/plain; charset=utf-8
Content-Transfer-Encoding quoted-printable
MIME-Version 1.0 (1.0)
X-Mailer iPhone Mail (18F72)
X-Mailing-List <debian-python@lists.debian.org> archive/latest/19241
List-ID <debian-python.lists.debian.org>
List-URL <https://lists.debian.org/debian-python/>
List-Archive https://lists.debian.org/msgid-search/B9A5AE17-037A-4273-B45D-6A35E889271E@stufft.io
Approved robomod@news.nic.it
Lines 28
Organization linux.* mail to news gateway
Sender robomod@news.nic.it
X-Original-Cc debian-python@lists.debian.org
X-Original-Date Sat, 26 Jun 2021 00:20:54 -0400
X-Original-Message-ID <B9A5AE17-037A-4273-B45D-6A35E889271E@stufft.io>
X-Original-References <YNajVpDpVEUI/Us+@brians-debian>
Xref csiph.com linux.debian.maint.python:13451

Show key headers only | View raw

File names on PyPI are write once. Once a specific file name has been used it can never be used again (even if the entire project was deleted and recreated). 

Projects can delete uploaded files (and as mentioned they can be yanked, but yanking is just extra metadata beside the file), but file content can never change, only be removed. 

Sent from my iPhone

> On Jun 25, 2021, at 11:47 PM, Brian Thompson <brian@hashvault.io> wrote:
> 
> On Fri, Jun 25, 2021 at 07:01:39PM -0400, Nicholas D Steeves wrote:
>> Does PyPi provide immutable releases?
> 
> From experience, I can tell you that yes, releases cannot be overwritten,
> but they can be "yanked".  Pypi states that a yanked release is:
> 
>  "A release that is always ignored by an installer, unless it is the
>  only release that matches a version specifier (using either '==' or
>  '===)."
> 
> -- 
> Best regards,
> 
> Brian T

Back to linux.debian.maint.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-25 22:50 +0200
  Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-25 23:20 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Scott Talbert <swt@techie.net> - 2021-06-25 23:40 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-26 00:50 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-26 00:30 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-26 01:50 +0200
        Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-26 02:10 +0200
        Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Paul Wise <pabs@debian.org> - 2021-06-26 04:10 +0200
          Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-26 06:20 +0200
          Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Martin <debacle@debian.org> - 2021-06-26 11:30 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Simon McVittie <smcv@debian.org> - 2021-06-26 12:20 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Paul Wise <pabs@debian.org> - 2021-06-26 04:00 +0200
  Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Simon McVittie <smcv@debian.org> - 2021-06-26 00:10 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Nicholas D Steeves <sten@debian.org> - 2021-06-26 01:10 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-26 02:00 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Brian Thompson <brian@hashvault.io> - 2021-06-26 05:50 +0200
        Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs Donald Stufft <donald@stufft.io> - 2021-06-26 06:30 +0200
  Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Paul Wise <pabs@debian.org> - 2021-06-26 04:00 +0200
  Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Louis-Philippe Véronneau <pollo@debian.org> - 2021-06-27 01:00 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-27 02:20 +0200
    Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Emmanuel Arias <eamanu@yaerobi.com> - 2021-06-28 04:50 +0200
      Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided  upstream source tarballs Jeremy Stanley <fungi@yuggoth.org> - 2021-06-28 18:30 +0200

csiph-web