<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Sep 28, 2014, at 5:36 PM, M.-A. Lemburg <<a href="mailto:mal@egenix.com" class="">mal@egenix.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">On 28.09.2014 21:31, Donald Stufft wrote:<br class="">
<blockquote type="cite" class="">Hello All!<br class="">
<br class="">
I'd like to discuss the idea of moving PyPI to having immutable files. This<br class="">
would mean that once you publish a particular file you can never reupload that<br class="">
file again with different contents. This would still allow deleting the file or<br class="">
reuploading it if the checksums match what was there prior.<br class="">
<br class="">
This would be good for a few reasons:<br class="">
<br class="">
* It represents "best practices" for version numbers. Ideally if two people<br class="">
have version "2.1" of a project, they'll have the same code, however as it<br class="">
stands two people installing at two different times could have two very<br class="">
different versions.<br class="">
<br class="">
* This will make improving the PyPI infrastructure easier, in particular it<br class="">
will make it simpler to move away from using a glusterfs storage array and<br class="">
switch to a redudant set of cloud object stores.<br class="">
<br class="">
<br class="">
In the past this was brought up and a few points were brought against it, those<br class="">
were:<br class="">
<br class="">
1. That authors could simply change files that were hosted on not PyPI anyways<br class="">
so it didn't really do much.<br class="">
<br class="">
2. That it was too hard to test a release prior to uploading it due to the<br class="">
nature of distutils requiring you to build the release in the same command<br class="">
as the upload.<br class="">
<br class="">
With the fact that pip no longer hits external URLs by default, I believe that<br class="">
the first item is no longer that large of a factor. People can do whatever they<br class="">
want on external URLs of course, however if something is coming from PyPI as<br class="">
end users should now be aware of, they can know it is immutable.<br class="">
<br class="">
Now that there is twine, which allows uploading already created packages, I<br class="">
also believe that the second item is no longer a concern. People can easily<br class="">
create a distribution using ``setup.py sdist``, test it, and then upload that<br class="">
exact thing they tested using ``twine upload <path to sdist>``.<br class="">
</blockquote>
<br class="">
-1.<br class="">
<br class="">
It does happen that files need to be reuploaded because of a bug<br class="">
in the release process and how people manage their code is really<br class="">
*their* business, not that of PyPI.<br class="">
<br class="">
FWIW, I am getting increasingly annoyed how PyPI and pip try to dictate<br class="">
the way package authors are supposed to build, manage and host their<br class="">
Python packages and release process. Can we please stop this ?<br class="">
<br class="">
</div>
</blockquote>
<br class="">
</div>
<div>I forgot to mention, there is also <a href="http://testpypi.python.org" class="">
testpypi.python.org</a> which can be used to test</div>
<div>builds prior to publishing them to PyPI. There is also devpi which I believe has</div>
<div>the option to push from one of the devpi indexes straight to PyPI as well (I could</div>
<div>be wrong about that though?).</div>
<div><br class="">
</div>
<div>In general the tooling has gotten *a lot* better at making it possible to test things</div>
<div>thoroughly before uploading them to PyPI, where uploading them to PyPI is the</div>
<div>very last piece in the puzzle.</div>
<br class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">---</div>
<div class="">Donald Stufft</div>
<div class="">PGP: 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA</div>
</div>
</div>
</div>
<br class="">
</body>
</html>