<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jun 5, 2013, at 6:52 PM, PJ Eby <<a href="mailto:pje@telecommunity.com">pje@telecommunity.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Wed, Jun 5, 2013 at 2:47 PM, Donald Stufft <<a href="mailto:donald@stufft.io">donald@stufft.io</a>> wrote:<br><blockquote type="cite">One of the big problems with download_url is that the data in setup.py is<br>used in (and influences the content of) the final dist file. This means that<br>inside of a setup.py you won't know what the hash of the final file is. So<br>it's difficult for a setup.py based workflow with external urls to provide<br>md5 sums for the files which means that pip and friends can't verify that no<br>body modified the download in transit.<br></blockquote><br>Not if it's done in a setup.py command that runs after the<br>distributions are built, akin to the way the upload command works now.<br> If there were, say, an "uplink" command based on a modified version<br>of upload, it could call the PyPI API to pass along hashed URLs.<br><br>At some point I intend to write such a command so that my current<br>snapshot scripts (which run on the server the downloads are hosted<br>from) can update PyPI with properly hashed URLs. (But I'm not sure<br>when "some point" will be, exactly, so if someone else writes it first<br>I'll be a happy camper.)<br></blockquote></div><br><div>With static metadata ideally PyPI will be reading metadata from inside of the uploaded file and all that will be required is for publishing tools to push the file up.</div><div><br></div><div>However something like your uplink command would (assuming I understand it correctly) work fine because those "additional urls to list on the /simple/ page" are not part of the package metadata.</div><div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><br class="Apple-interchange-newline">-----------------</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">Donald Stufft</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA</div>
</div>
<br></body></html>