Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Donald Stufft Newsgroups: linux.debian.maint.python Subject: Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs Date: Sat, 26 Jun 2021 06:30:01 +0200 Message-ID: References: X-Original-To: Brian Thompson X-Mailbox-Line: From debian-python-request@lists.debian.org Sat Jun 26 04:21:13 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-7.2 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .stufft. - helo: .mail-qv1-xf34.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 X-Gm-Message-State: AOAM531bbtkf5eppJoqySVJpb1UlfxwQ3xO6f50TBn+au+57wTRDcf23 5u2810SUOhaPWaioLY/PHJMx5zOnfqy3WFJj X-Google-SMTP-Source: ABdhPJyJKyvBGlliKCePcEeRceIw/g/jPgFEN+SVt86P1oXqBb0CePikDHGFApGM99gPyVXu31gZNg== X-Received: by 2002:ad4:4833:: with SMTP id h19mr4282075qvy.34.1624681255765; Fri, 25 Jun 2021 21:20:55 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 (1.0) X-Mailer: iPhone Mail (18F72) X-Mailing-List: archive/latest/19241 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/B9A5AE17-037A-4273-B45D-6A35E889271E@stufft.io Approved: robomod@news.nic.it Lines: 28 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org X-Original-Date: Sat, 26 Jun 2021 00:20:54 -0400 X-Original-Message-ID: X-Original-References: Xref: csiph.com linux.debian.maint.python:13451 File names on PyPI are write once. Once a specific file name has been used i= t can never be used again (even if the entire project was deleted and recrea= ted).=20 Projects can delete uploaded files (and as mentioned they can be yanked, but= yanking is just extra metadata beside the file), but file content can never= change, only be removed.=20 Sent from my iPhone > On Jun 25, 2021, at 11:47 PM, Brian Thompson wrote: >=20 > =EF=BB=BFOn Fri, Jun 25, 2021 at 07:01:39PM -0400, Nicholas D Steeves wrot= e: >> Does PyPi provide immutable releases? >=20 > =46rom experience, I can tell you that yes, releases cannot be overwritten= , > but they can be "yanked". Pypi states that a yanked release is: >=20 > "A release that is always ignored by an installer, unless it is the > only release that matches a version specifier (using either '=3D=3D' or > '=3D=3D=3D)." >=20 > --=20 > Best regards, >=20 > Brian T