<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">
<div class="">Hello All!</div>
<div class=""><br class="">
</div>
<div class="">I'd like to discuss the idea of moving PyPI to having immutable files. This</div>
<div class="">would mean that once you publish a particular file you can never reupload that</div>
<div class="">file again with different contents. This would still allow deleting the file or</div>
<div class="">reuploading it if the checksums match what was there prior.</div>
<div class=""><br class="">
</div>
<div class="">This would be good for a few reasons:</div>
<div class=""><br class="">
</div>
<div class="">* It represents "best practices" for version numbers. Ideally if two people</div>
<div class=""> have version "2.1" of a project, they'll have the same code, however as it</div>
<div class=""> stands two people installing at two different times could have two very</div>
<div class=""> different versions.</div>
<div class=""><br class="">
</div>
<div class="">* This will make improving the PyPI infrastructure easier, in particular it</div>
<div class=""> will make it simpler to move away from using a glusterfs storage array and</div>
<div class=""> switch to a redudant set of cloud object stores.</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">In the past this was brought up and a few points were brought against it, those</div>
<div class="">were:</div>
<div class=""><br class="">
</div>
<div class="">1. That authors could simply change files that were hosted on not PyPI anyways</div>
<div class=""> so it didn't really do much.</div>
<div class=""><br class="">
</div>
<div class="">2. That it was too hard to test a release prior to uploading it due to the</div>
<div class=""> nature of distutils requiring you to build the release in the same command</div>
<div class=""> as the upload.</div>
<div class=""><br class="">
</div>
<div class="">With the fact that pip no longer hits external URLs by default, I believe that</div>
<div class="">the first item is no longer that large of a factor. People can do whatever they</div>
<div class="">want on external URLs of course, however if something is coming from PyPI as</div>
<div class="">end users should now be aware of, they can know it is immutable.</div>
<div class=""><br class="">
</div>
<div class="">Now that there is twine, which allows uploading already created packages, I</div>
<div class="">also believe that the second item is no longer a concern. People can easily</div>
<div class="">create a distribution using ``setup.py sdist``, test it, and then upload that</div>
<div class="">exact thing they tested using ``twine upload <path to sdist>``.</div>
</div>
<br class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">---</div>
<div class="">Donald Stufft</div>
<div class="">PGP: 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA</div>
</div>
</div>
</div>
<br class="">
</body>
</html>