Path: csiph.com!aioe.org!bofh.it!news.nic.it!robomod From: Sumana Harihareswara Newsgroups: linux.debian.maint.python Subject: Re: the new PyPI, coming next month Date: Sun, 01 Apr 2018 05:50:02 +0200 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Sun Apr 1 03:48:10 2018 Old-Return-Path: X-Amavis-Spam-Status: No, score=-4.2 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, BLOGSPOT=3, FOURLA=0.1, LDO_WHITELIST=-5, PUSSY=2, RCVD_IN_DNSWL_MED=-2.3] autolearn=no autolearn_force=no X-Policyd-Weight: using cached result; rate: -7 X-Greylist: delayed 4503 seconds by postgrey-1.36 at bendel; Sun, 01 Apr 2018 03:31:03 UTC X-Me-Sender: Openpgp: preference=signencrypt Autocrypt: addr=sh@changeset.nyc; keydata= xsFNBE5DPwoBEADDmyv+TzpjFCqpfC8PFnaL+8OWaOfSJWMTSjwzSG3Q8eSEnU2Mw/n3syAy BJcPLTlu/1u8k0XWf3uDT7jIcKmWPClRJBLj4Zw1vCIxCE7P5V7bNJNVr9Dg0gjwUst3JeJP 0adaiJZ7MvGgShKvZJbT7nuJAS0R/lx4rVLg/Uphr6DzVzyvsgEZLDIuPHDj23GopLULySMi KzLEBVoeYGA9VvKE2XjlIzcrpg78QSYXNJQRRsTSj8j0qTXeQKi/zLZTrtYkezT556sKKs/f xwSOa3IJcfLXxVwlEji8Vhi08eDKHvbUAdPaFJbNmixI9vzAhEJ8i1cwOr8EKk+WcorsIJ1J IYwk6e0BnScIbiRDdNY6Wa0twKGj8GYVS+IFiJ2ePVszmC+MX66iqWUi+MZnsSGCy1eiqAW3 6B3bedKYe5Ar+bmBJcihelUZQIlk2m7AWYeXft+bDLNE6UHFk7+gS61Iu8oO4Wqz8DuoNjYq tuj/BvQerJuFB44OYOgGyBqX2zx1RwXT/eVa+dqoW5nVlGABXeEiwpQVdvvAvGAGu8vrPSUg Mg1VxL78vu3GMGzokPc9esEAPhcfmn8FhL//mtm2kbVn8wZuA4eKLYxMPMZZNRcYaFYwsrip GJByILVodFRtAsAVzCMULxecH9Gg0xN7CUuZ49xPuVsCK5J84wARAQABzT5TdW1hbmEgSGFy aWhhcmVzd2FyYSAoQ2hhbmdlc2V0IENvbnN1bHRpbmcpIDxzaEBjaGFuZ2VzZXQubnljPsLB mAQTAQIAQgIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AFCQ4NIlIWIQQWxkie4AxSSqQJ iuEkebIftX2vnAUCWkuWWAIZAQAKCRAkebIftX2vnNw4D/92QyGjA3bcly8SZm0UmGhLHBD1 9SV6eDBItfboc1fTgnvvWL4mZPvWhSpWMLkFxbfeIdTxgqqfsl1aj/fHzg7F/6wAWbCkQSaC 8P+3Z07uzCbDaRP80M1+pxmK40f6wqGeCi6f23be/cI0jFp2/NRj1tjTWXj1N8jx8viOvpsY quFC7NQLFPyzy+hEYy34LVEM/EuwvGz/+0Sncg/gxsHsOlAK36I+ekA/ddg7FVbsD2GuszeU 67LhRrMLKY0/JekcHNt3P75toGpvVjVTYMUsenOS6PwUQQkJ++LFfOsM09h+AuU24m0cRNP8 g6XRIVnWZdInRP1eQbrUx8jtFOc8/j8zcnP6yNn9pnpudHzFMyqNIW11NNE4WLSY1e4ebuQp kTVORE+XLVhweGRxb3hqzU4HDUv9r4E/hSyli7q/Q0UI/HU0huysHUjaZyGLqXkjNzxxEKA8 sACZ93rz0VvB3KERB0zL1EvB33i1TPksR4JS8EahSHbLrrFcsDKLUzMyF6aZflcl8EsM18To 6ylDUJmYEJTfxUJMH8S/vvUSlxIvpaycSRCFjaIRfc+iA/sYRYJNfhmS5ZAZajSeL7h9EhDj pFFwC6i3iZb9AWAwBXSvCQM+aYv8apMPqpW/3zpBoPTBfecrhkgO+O6UskcJ6Lnyu2PESstz CR8nyvGXb87BTQRXsPhCARAAsj2H7v6cD/e9wQIxQfsFnZRtx4htOS2a1L4gImxcpGSJ/+H7 y7yBsM3lFlFRpiSq65fCiSkwBKRCGo2fzvksx/zvDMkurjfo5DutkjuWA5awvV2MN/AfOYhO R1X7/6zzuNJLt5rLFWhwwBtd0metHklsXsjVIaUImZca8yX+n7WXvDeRxDdYi3vuRB/3fZPu YABV52+aLDNA34VreCEgByzJBe6oAEilXVkANhIDQUwU9NhIBWlXub9t1eNU9nVbWvVXRWfl Mb98WkR3Wthn/eEoWTaR0mla6Er8EdxhIgaJZ15WmpcGt/zoXIeU7quUS7UaVKQm4foFCj6H qGTkAE40Viwf1FceQUZGBgfDra6b3WbiEXtzplvU+2kCt4srvyCS5yqkYKBG86gSCn7ESlyB LR8kQxqxn5PryiqTgF4oGJHdgpXFWiJ28FoPoFjvEwaNBbF4qVl+WfXtyauIsz9FHWt2BlNk B9tEdslrbipCmCs9QRs+6HVFtKlEVsJtRgR6+JnMpWi7LvOvpu4B6iMGpcOmMqUUpw+wUXqn NKcgTFZlktpANP+WkWw5/HTA08FjUcrtuxBTTu6uu7E/CXFgSsjuDms1rihDNCtbO+GyRTF1 j1x1fO3IPZOHvvK8npM7kQB370owjID75/StgMqJjB9w3W5B40ogxI+2GZEAEQEAAcLBfAQY AQIAJgIbDBYhBBbGSJ7gDFJKpAmK4SR5sh+1fa+cBQJaS5YVBQkEn2nTAAoJECR5sh+1fa+c AckQALuHEEDf9ySkbW542thWz98ix4S9gkq+HcgzvpfzUjHGrXggXqUwlEsHvfZKiic3B4A0 nh6Y/S/k/nxHLkbwlf717Rg6Gg7XWZddP39M2peSigmp7LYjFLFVstS65paLcpJnzDgzmoyy nCaiHoEddcYgxu5wlB7UmUQ5WNLxQl2PRh2ZiRTC2idmilUNv2lDt1qx+oPZBmRkaSZmge8w NLGpQXMEf5BQIm3HXGpmKrRRD1c5NIxe09/7FmUJd2PyBNbnJiiD52qt6tIFgl2nqxz3Fsag ZeC3tWlQDgrx7ttojqqHVKJEzzlV/DSD5cRTNo7DgOfKTIalMBIdGwprT0ftSERdSMHwFw45 9bcVIdLk8mA5USROdVwnhuuGN+FLGm2uFpU6p4RqGa25RZhT5puqrBF6BSyzInZTr1xpG5Pj uF5lB0Uq150zwnrcHifAYOKLrRJRNt4oNh9NvKcLTFb3let3M5oVei7M7IGTDHAGaurGsnQN ZaV0f/MY3D34OL/ENiwb2Om643RKd8PAgMH5n3JvuROKiDE5hkKHZ/NeN4W4uKscIVOSLQ79 GzA5jPGu98lDR3JBu3XdJC2mTG74NB52Wlw/ZF1O3qIqC8y446kVFbqfP0OFCMBXLf5kCchF qi7wj/Rp3wGR0C9bW6TlEcpYg4WlHj0E681uvxKJ User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Mailing-List: archive/latest/15762 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/32b80520-7823-7e2c-d3d0-d0b4bb854ead@changeset.nyc Approved: robomod@news.nic.it Lines: 146 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sat, 31 Mar 2018 23:30:58 -0400 X-Original-Message-ID: <32b80520-7823-7e2c-d3d0-d0b4bb854ead@changeset.nyc> X-Original-References: Xref: csiph.com linux.debian.maint.python:10362 Scott, Thanks for your reply. I wrote about this at a little more length in https://mail.python.org/pipermail/python-list/2018-March/732329.html in response to a related question. But for more discussion on this particular point, the people you want to talk with are in the Python distribution/packaging SIG list, https://mail.python.org/mailman/listinfo/distutils-sig . Sorry to be pushing you to yet another list, but the in-depth answers you want, you're more likely to get there. thanks, Sumana Harihareswara -- Sumana Harihareswara Warehouse project manager Changeset Consulting https://changeset.nyc On 03/31/2018 11:23 PM, Scott Kitterman wrote: > What replaces gpg for ensuring integrity of the uploaded code? > > Scott K > > On April 1, 2018 2:15:54 AM UTC, Sumana Harihareswara wrote: >> Debian-Python experts, >> >> I'm writing to you in hopes you will forward this to the right places, >> and file relevant bugs against uscan/watch, which I don't quite >> understand enough to do myself. And if you want to follow up on >> https://github.com/pypa/warehouse/issues/358#issuecomment-337233792 and >> file a new issue asking for us to support your redirector more cleanly, >> I'd welcome that. >> >> I'm the project manager for the new Python Package Index (Warehouse), >> which is currently in beta at http://pypi.org/ . On the Warehouse >> roadmap[1], it looks like the full switch will happen sometime >> in April, so here's a heads-up about why we're switching, what's >> changed, and what to expect. (Much of it won't be directly important to >> you, but I figure you might want to know anyway!) >> >> The legacy PyPI site at https://pypi.python.org started in the early >> 2000s. In recent years, users faced outages, malicious packages, and >> spam attacks, and the legacy codebase made it hard to maintain and even >> harder to develop new features. >> >> The new PyPI has a far more modern look, and is up-to-date under the >> hood as well; a proper web framework (Pyramid), 100% backend test >> coverage, and a Docker-based development environment, make it easier >> for >> current and new developers to maintain it and add features. >> >> Thanks to Mozilla's Open Source Support funding[2], developers have >> added many new features, overhauled infrastructure, and made steady >> progress towards redirecting traffic to the new site and shutting down >> the old one. As of the middle of last year, package releases must go >> through the new PyPI, and as of late February, new user account >> registration is only available on the new site. The full switch will >> include redirecting browser and pip install traffic from the old site; >> then, sometime in late April or early May, the legacy site will be >> entirely shut down. >> >> Thanks to redirects, you may not have to change anything immediately. >> Here's a migration guide.[3] >> >> >> Some new PyPI features: >> * mobile-responsive UI >> * chronological release history for each project (example[4]) >> * easy-to-read project activity journal for project maintainers >> * better search and filtering >> * support for multiple project URLs (e.g., for a homepage and a >> repo[5]) >> * user-visible Gravatars and email addresses for maintainers >> * no need to "register" a project before initial upload >> * far better backend infrastructure, reducing the frequency of outages >> >> >> Things that are going away, or already have (sometimes for policy or >> spam-fighting reasons), include: >> * pythonhosted.com documentation hosting (pypa/warehouse#582[6]) >> * download counts visible in the API[7] (instead, use the Google >> BigQuery service[8]) >> * GPG/PGP signatures for packages (still visible in the Simple Project >> API[9] per PEP 503[10], but no longer visible in the web UI >> * key management: PyPI no longer has a UI for users to manage their GPG >> or SSH public keys >> * package maintainers being able to upload a new release via the web UI >> (instead, the recommended command-line tool is Twine[11]) >> * package maintainers being able to log in and update release >> descriptions via the web UI (to update release metadata, they need to >> upload a new release; see distutils-sig discussion[12]) >> * OpenID and Google auth login[13] >> * users being able to upload a package without verifying their email >> address with PyPI first >> * HTTP access to APIs; now it's HTTPS-only[14] >> >> >> And in the works: >> * PEP 541[15] will enable more timely package takeovers, as people get >> package names transferred to them after conflict resolution >> * Now that PEP 566 has been approved, developers are working to get >> Markdown supported for README files on PyPI[16] >> >> >> For future updates, please sign up for the low-traffic PyPI >> announcements email list[17]. >> >> Thank you for integrating with PyPI, and please let us know[18] if you >> have any questions or problems with the new site! >> -- >> Sumana Harihareswara >> Changeset Consulting >> https://changeset.nyc >> >> >> Links: >> >> 1. https://wiki.python.org/psf/WarehouseRoadmap >> 2. >> https://pyfound.blogspot.com/2017/11/the-psf-awarded-moss-grant-pypi.html >> 3. >> https://warehouse.readthedocs.io/api-reference/integration-guide/#migrating-to-the-new-pypi >> 4. https://pypi.org/project/pip/#history >> 5. >> https://packaging.python.org/tutorials/distributing-packages/#project-urls >> 6. https://github.com/pypa/warehouse/issues/582 >> 7. >> https://warehouse.readthedocs.io/api-reference/xml-rpc/#changes-to-legacy-api >> 8. >> https://packaging.python.org/guides/analyzing-pypi-package-downloads/ >> 9. >> https://warehouse.readthedocs.io/api-reference/legacy/#simple-project-api >> 10. https://www.python.org/dev/peps/pep-0503/ >> 11. http://twine.readthedocs.io/ >> 12. >> https://mail.python.org/pipermail/distutils-sig/2017-December/031826.html >> 13. >> https://mail.python.org/pipermail/distutils-sig/2018-January/031855.html >> 14. >> https://mail.python.org/pipermail/distutils-sig/2017-October/031712.html >> 15. https://www.python.org/dev/peps/pep-0541/ >> 16. https://github.com/pypa/warehouse/issues/869#issuecomment-340928703 >> 17. >> https://mail.python.org/mm3/mailman3/lists/pypi-announce.python.org/ >> 18. https://github.com/pypa/warehouse/issues/new