[Distutils] What to do about the PyPI mirrors

[Donald Stufft]

On Jul 25, 2013, at 1:38 AM, Richard Jones <r1chardj0n3s at gmail.com> wrote:

> Hi all,
> 
> I've just been contacted by someone who's set up a new public mirror
> of PyPI and would like it integrated into the mirror ecosystem.
> 
> I think it's probably time we thought about how to demote the mirrors:
> 
> - they cause problems with security (being under the python.org domain
> causes various issues including inability to use HTTPS and cookie
> issues)
> - they're no longer necessary thanks to the CDN work
> 
> So, things to do:
> 
> - links and information on PyPI itself can be removed
> - tools that use mirrors still need to be able to but mention of using
> public mirrors is probably something to demote
> 
> These are just rough thoughts that occurred to me just now.
> 
> 
>    Richard
> _______________________________________________
> Distutils-SIG maillist  -  Distutils-SIG at python.org
> http://mail.python.org/mailman/listinfo/distutils-sig

Just a quick note though to be clear. I still plan on supporting
(and even improving) the ability to mirror PyPI. I think it's an
important ability to have especially for companies, or projects
like OpenStack who use a mirror for their massive CI
infrastructure.

-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://mail.python.org/pipermail/distutils-sig/attachments/20130725/a1130f4f/attachment.pgp>