Mailman 3 January 2017 - Distutils-SIG

PyPi not allowing duplicate filenames
by Chris Barker 20 Apr '20

20 Apr '20

Hi all, PyPi does not allow duplicate file names -- this makes lots of sense, because you really don't want people to go to PyPi one day and grab a file, and then go there another day, grab a file with exactly the same name, and have it be a different file. However.... We are all too human, and make mistakes when doing a release. All to often someone pushed a broken file up to PyPi, often realizes it pretty quickly -- before anyone has a chance to even download it (or only the dev team as, for testing...). In fact, I was in a sprint last summer, and we decided to push our package up to PyPi -- granted, we were all careless amateurish noobs, but we ended up making I think 4! minor version bumps because we had done something stupid in the sdist. Also -- the latest numpy release got caught in this, too: """ * We ran into a problem with pipy not allowing reuse of filenames and a resulting proliferation of *.*.*.postN releases. Not only were the names getting out of hand, some packages were unable to work with the postN suffix. """ So -- I propose that PyPi allow projects to replace existing files if they REALLY REALLY want to. You should have to jump through all sorts of hoops, and make it really clear that it is a BAD IDEA in the general case, but it'd be good to have it be possible. After all -- PyPi does not take on responsibility for anything else about what's in those packages, and Python itself is all about "we're all consenting adults here" I suppose we could even put in some heuristics about how long the file as been there, how many times it's been downloaded, etc. Just a thought.....I really hate systems that don't let me roll back mistakes, even when I discover them almost immediately... -CHB -- Christopher Barker, Ph.D. Oceanographer Emergency Response Division NOAA/NOS/OR&R (206) 526-6959 voice 7600 Sand Point Way NE (206) 526-6329 fax Seattle, WA 98115 (206) 526-6317 main reception Chris.Barker(a)noaa.gov

13 24

ImportError running 'test' on namespace package - other package in namespace not found
by Jason R. Coombs 17 Apr '20

17 Apr '20

I've got two projects: mynamespace.myprojectA and mynamespace.myprojectB myprojectB depends on myprojectA. I'm using setuptools 0.6c8 to manage both projects. Both projects are registered using 'setup develop'. Both projects are accessible from an interactive interpreter: PS C:\Users\me\projects> python Python 2.5.2 (r252:60911, Feb 21 2008, 13:11:45) [MSC v.1310 32 bit (Intel)] on win32 Type "help", "copyright", "credits" or "license" for more information. >>> import mynamespace.myprojectA >>> import mynamespace.myprojectB >>> from mynamespace.myprojectA import mymoduleZ However, when I run 'setup test' in myprojectB, the tests fail with File ".mymoduleZ.py", line NNN, in [some context] from mynamespace.myprojectA.mymoduleZ import MyClassC ImportError: No module named myprojectA.mymoduleZ In setup.py, the test_suite is nose.collector. I searched and couldn't find anyone else with this problem. Is this a supported configuration? Is there something I can do to make tests work with interdependent projects with the same root namespace? If there's not something obvious I should be doing differently, I'm happy to put together a minimal test case that reproduces the problem. Any suggestions are appreciated. Sincerely, Jason R. Coombs

3 6

Surviving a Compromise of PyPI - PEP 458 and 480
by Vladimir Diaz 12 Feb '20

12 Feb '20

Hello everyone, I am a research programmer at the NYU School of Engineering. My colleagues (Trishank Kuppusamy and Justin Cappos) and I are requesting community feedback on our proposal, "Surviving a Compromise of PyPI." The two-stage proposal can be reviewed online at: PEP 458 http://legacy.python.org/dev/peps/pep-0458/ PEP 480 http://legacy.python.org/dev/peps/pep-0480/ Summary of the Proposal: "Surviving a Compromise of PyPI" proposes how the Python Package Index (PyPI) can be amended to better protect end users from altered or malicious packages, and to minimize the extent of PyPI compromises against affected users. The proposed integration allows package managers such as pip to be more secure against various types of security attacks on PyPI and defend end users from attackers responding to package requests. Specifically, these PEPs describe how PyPI processes should be adapted to generate and incorporate repository metadata, which are signed text files that describe the packages and metadata available on PyPI. Package managers request (along with the packages) the metadata on PyPI to verify the authenticity of packages before they are installed. The changes to PyPI and tools will be minimal by leveraging a library, The Update Framework <https://github.com/theupdateframework/tuf>, that generates and transparently validates the relevant metadata. The first stage of the proposal (PEP 458 <http://legacy.python.org/dev/peps/pep-0458/>) uses a basic security model that supports verification of PyPI packages signed with cryptographic keys stored on PyPI, requires no action from developers and end users, and protects against malicious CDNs and public mirrors. To support continuous delivery of uploaded packages, PyPI administrators sign for uploaded packages with an online key stored on PyPI infrastructure. This level of security prevents packages from being accidentally or deliberately tampered with by a mirror or a CDN because the mirror or CDN will not have any of the keys required to sign for projects. The second stage of the proposal (PEP 480 <http://legacy.python.org/dev/peps/pep-0480/>) is an extension to the basic security model (discussed in PEP 458) that supports end-to-end verification of signed packages. End-to-end signing allows both PyPI and developers to sign for the packages that are downloaded by end users. If the PyPI infrastructure were to be compromised, attackers would be unable to serve malicious versions of these packages without access to the project's developer key. As in PEP 458, no additional action is required by end users. However, PyPI administrators will need to periodically (perhaps every few months) sign metadata with an offline key. PEP 480 also proposes an easy-to-use key management solution for developers, how to interface with a potential build farm on PyPI infrastructure, and discusses the security benefits of end-to-end signing. The second stage of the proposal simultaneously supports real-time project registration and developer signatures, and when configured to maximize security on PyPI, less than 1% of end users will be at risk even if an attacker controls PyPI and goes undetected for a month. We thank Nick Coghlan and Donald Stufft for their valuable contributions, and Giovanni Bajo and Anatoly Techtonik for their feedback. Thanks, PEP 458 & 480 authors.

7 53

Upgrading dependencies
by Charlie Moad 29 Apr '18

29 Apr '18

Is it currently possible to upgrade dependencies as well when upgrading a packages? If not, this would be a really nice feature to add to easy_install. Maybe a call like: easy_install --upgrade --upgrade-deps Package Obviously it makes sense to leave this off by default. Thanks, Charlie

2 1

Changes to --find-links and --upgrade in SVN
by Phillip J. Eby 29 Apr '18

29 Apr '18

Elvelind Grandin reported a problem with the "develop" command that turned out to be a flaw in its --find-links support. Specifically, it wasn't ever processing the links. :) In the process of fixing it, I wound up cleaning up an annoying (to me, at least) quirk of the previous workings of --find-links. It used to be that find-links would always be processed first, no matter what, even if you were doing a completely local operation. This would've been especially annoying if it carried over into "develop", so I made some changes. Now, if an item passed to --find-links is local (a filename or file: URL), or a direct link to an egg or other distribution, it is indexed immediately. Remote URLs are now only retrieved if a dependency can't be resolved locally, or if you use the -U or --upgrade options (this goes for "develop" too). Note that this is a behavior change for easy_install, which was effectively treating --find-links as though you'd specified --upgrade in certain cases. So, if you're used to getting upgrades downloaded as a result of using --find-links, please note that this will no longer happen. EasyInstall will now *only* go online if a dependency can't be resolved locally, if -U or --upgrade is used, or if you provided suitable direct URLs via an argument or --find-links, or via a link in a local .html file.

2 1

Problems with svn in windows
by Sharky On PTNet 29 Apr '18

29 Apr '18

Hi, I´m trying to do "easy_install setuptools==dev" in a windows box but have an error with svn command. """... 'svn' is not recognized as an internal or external command, ...""" I have installed TortoiseSVN but it seems that don't have command line, is all with the Explorer. Can you tell me what client I may use in windows? Thanks for all, Helio Pereira Sharky @ PTNet

3 2

local development scenarios
by tgreenwood 29 Apr '18

29 Apr '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm new to distutils/and the egg system. I have not researched the archives as much as I should, so please excuse me if this is familiar territory... Q: Is it possible for dependency checks to work for non pipy deployed eggs? - A.egg - B.egg (setup_requires and install_requires A.egg) - email A and B eggs to friend - tell friend to : easy_install B - but B.egg does not install A...in fact, in my test case, it fails b/c it cannot find A in pipy - in this example, what happens if friend does not have net connection on target machine? how can they install from the eggs alone and get the dep checking to work? Q: How does my friend run the unittests on the egg that they have just installed? As I am developing, I frequently run the unittests and after every bdist_egg build, I also run the unit tests that way, too. How can the consumer do the same? Q: One of my apps is a command line app, say foo.py is a command line app that takes arg1, arg2,... How can the user run this app when it is encased in an egg? Q: How do I define my own pipy? While I like the idea of deploying there for the overall community, I don't want to send my half baked code into the wild. But I'd like to try the general functionality of having a deploy site for my beta customers. How can I set this up? Thanks in advance. - -Todd -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDl9Hfz6uXX4lQc/URAnY4AJ47DFHL/cpEltmqoUyGqzhsK5FjRACgt01v akc3Wh3IOXVv2jiS8TszhuE= =Rv/x -----END PGP SIGNATURE-----

5 12

Choice of dependencies?
by John J Lee 29 Apr '18

29 Apr '18

Is it possible for a package to depend on one of several packages, with the user having the option to pick? For example, my package P might depend on package A, plus either package B or package C. I know I could (ab)use extras_require, but in my case this is a real dependency rather than an optional extra. The other option I have is to just pick one of the dependencies (B or C in my example above), and thereby force people to install it even though it's not strictly required. Neither option seems particularly attractive. John

3 6

setuptools doc patch
by John J Lee 29 Apr '18

29 Apr '18

The comma removed by the patch below implies that users working from a Subversion checkout should not use EasyInstall to periodically fetch the latest version. That's not what you intended to say, I assume? http://peak.telecommunity.com/DevCenter/setuptools You should also inform your users of the need to run this command, if they -are working from a Subversion checkout, rather than using EasyInstall to +are working from a Subversion checkout rather than using EasyInstall to periodically fetch the latest version. Hmm, probably much better than the patch above: -You should also inform your users of the need to run this command, if they -are working from a Subversion checkout, rather than using EasyInstall to -periodically fetch the latest version. +If your users are working from a Subversion checkout rather than using +EasyInstall, you should also inform them of the need to run this command +to periodically fetch the latest version. John

2 2

Re: [Distutils] distutils install probs on suse 9.0
by Mats Wichmann 29 Apr '18

29 Apr '18

At 05:43 AM 5/18/2004, David Handy wrote: >On Tue, 18 May 2004, Floris van der Tak wrote: > >> my attempt to install the distutils on suse 9.0 (which provides python >> 2.3) fails: > >Why are you installing distutils on a system that already has Python 2.3 >installed? Python 2.3 normally comes with distutils as part of the Python >standard library. > >Did suse distribute a version of Python that had distutils removed? It should come from python-devel

2 1

Sample setup.py for Numeric Python
by Greg Ward 29 Apr '18

29 Apr '18

Hi again -- [cc'd to Paul Dubois: you said you weren't following the distutils sig anymore, but this directly concerns NumPy and I'd like to get your input!] here's that sample setup.py for NumPy. See below for discussion (and questions!). ------------------------------------------------------------------------ #!/usr/bin/env python # Setup script example for building the Numeric extension to Python. # This does sucessfully compile all the .dlls. Nothing happens # with the .py files currently. # Move this file to the Numerical directory of the LLNL numpy # distribution and run as: # python numpysetup.py --verbose build_ext # # created 1999/08 Perry Stoll __rcsid__ = "$Id: numpysetup.py,v 1.1 1999/09/12 20:42:48 gward Exp $" from distutils.core import setup setup (name = "numerical", version = "0.01", description = "Numerical Extension to Python", url = "http://www.python.org/sigs/matrix-sig/", ext_modules = [ ( '_numpy', { 'sources' : [ 'Src/_numpymodule.c', 'Src/arrayobject.c', 'Src/ufuncobject.c' ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/numpy.def' } ), ( 'multiarray', { 'sources' : ['Src/multiarraymodule.c'], 'include_dirs' : ['./Include'], 'def_file': 'Src/multiarray.def' } ), ( 'umath', { 'sources': ['Src/umathmodule.c'], 'include_dirs' : ['./Include'], 'def_file' : 'Src/umath.def' } ), ( 'fftpack', { 'sources': ['Src/fftpackmodule.c', 'Src/fftpack.c'], 'include_dirs' : ['./Include'], 'def_file' : 'Src/fftpack.def' } ), ( 'lapack_lite', { 'sources' : [ 'Src/lapack_litemodule.c', 'Src/dlapack_lite.c', 'Src/zlapack_lite.c', 'Src/blas_lite.c', 'Src/f2c_lite.c' ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/lapack_lite.def' } ), ( 'ranlib', { 'sources': ['Src/ranlibmodule.c', 'Src/ranlib.c', 'Src/com.c', 'Src/linpack.c', ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/ranlib.def' } ), ] ) ------------------------------------------------------------------------ First, what d'you think? Too clunky and verbose? Too much information for each extension? I kind of think so, but I'm not sure how to reduce it elegantly. Right now, the internal data structures needed to compile a module are pretty obviously exposed: is this a good thing? Or should there be some more compact form for setup.py that will be expanded later into the full glory we see above? I've already made one small step towards reducing the amount of cruft by factoring 'include_dirs' out and supplying it directly as a parameter to 'setup()'. (But that needs code not in the CVS archive yet, so I've left the sample setup.py the same for now.) The next thing I'd like to do is get that damn "def_file" out of there. To support it in MSVCCompiler, there's already an ugly hack that unnecessarily affects both the UnixCCompiler and CCompiler classes, and I want to get rid of that. (I refer to passing the 'build_info' dictionary into the compiler classes, if you're familiar with the code -- that dictionary is part of the Distutils extension-building system, and should not propagate into the more general compiler classes.) But I don't want to give these weird "def file" things standing on the order of source files, object files, libraries, etc., because they seem to me to be a bizarre artifact of one particular compiler, rather than something present in a wide range of C/C++ compilers. Based on the NumPy model, it seems like there's a not-too-kludgy way to handle this problem. Namely: if building extension "foo": if file "foo.def" found in same directory as "foo.c" add "/def:foo.def" to MSVC command line this will of course require some platform-specific code in the build_ext command class, but I figured that was coming eventually, so why put it off? ;-) To make this hack work with NumPy, one change would be necessary: rename Src/numpy.def to Src/_numpy.def to match Src/_numpy.c, which implements the _numpy module. Would this be too much to ask of NumPy? (Paul?) What about other module distributions that support MSVC++ and thus ship with "def" files? Could they be made to accomodate this scheme? Thanks for your feedback -- Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

4 5

Can now compile simple extensions
by Greg Ward 29 Apr '18

29 Apr '18

Hi all -- at long last, I found the time to hack in the ability to compile extension modules to the Distutils. Mainly, this meant adding a 'build_ext' command which uses a CCompiler instance for all its dirty work. I also had to add a few methods to CCompiler (and, of course, UnixCCompiler) to make this work. And I added a new module, 'spawn', which takes care of running sub-programs more efficiently and robustly (no shell involved) than os.system. That's needed, obviously, so we can run the compiler! If you're in the mood for grubbing over raw source code, then get the latest from CVS or download a current snapshot. See http://www.python.org/sigs/distutils-sig/implementation.html for a link to the code snapshot. I'm still waiting for more subclasses of CCompiler to appear. At the very least, we're going to need MSVCCompiler to build extensions on Windows. Any takers? Also, someone who knows the Mac, and how to run compilers programmatically there, will have to figure out how to write a Mac-specific concrete CCompiler subclass. The spawn module also needs a bit of work to be portable. I suspect that _win32_spawn() (the intended analog to my _posix_spawn()) will be easy to implement, if it even needs to go in a separate function at all. It looks from the Python Library documentation for 1.5.2 that the os.spawnv() function is all we need, but it's a bit hard to figure out just what's needed. Windows wizards, please take a look at the 'spawn()' function and see if you can make it work on Windows. As for actually compiling extensions: well, if you can figure out the build_ext command, go ahead and give it a whirl. It's a bit cryptic right now, since there's no documentation and no example setup.py. (I have a working example at home, but it's not available online.) If you feel up to it, though, see if you can read the code and figure out what's going on. I'm just hoping *I'll* be able to figure out what's going on when I get back from the O'Reilly conference next week... ;-) Enjoy -- Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

2 1

Two fixes (at last)
by Greg Ward 29 Apr '18

29 Apr '18

Hi all -- at long last, I have fixed two problems that a couple people noticed a while ago: * I folded in Amos Latteier's NT patches almost verbatim -- just changed an `os.path.sep == "/"' to `os.name == "posix"' and added some comments bitching about the inadequacy of the current library installation model (I think this is Python's fault, but for now Distutils is slavishly aping the situation in Python 1.5.x) * I fixed the problem whereby running "setup.py install" without doing anything else caused a crash (because 'build' hadn't yet been run). Now, the 'install' command automatically runs 'build' before doing anything; to make this bearable, I added a 'have_run' dictionary to the Distribution class to keep track of which commands have been run. So now not only are command classes singletons, but their 'run' method can only be invoked once -- both restrictions enforced by Distribution. The code is checked into CVS, or you can download a snapshot at http://www.python.org/sigs/distutils-sig/distutils-19990607.tar.gz Hope someone (Amos?) can try the new version under NT. Any takers for Mac OS? BTW, all parties involved in the Great "Where Do We Install Stuff?" Debate should take a good, hard look at the 'set_final_options()' method of the Install class in distutils/install.py; this is where all the policy decisions about where to install files are made. Currently it apes the Python 1.5 situation as closely as I could figure it out. Obviously, this is subject to change -- I just don't know to *what* it will change! Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

2 1

Package versioning
by Timothy Docker 29 Apr '18

29 Apr '18

Hi all, I've been aware that the distutils sig has been simmerring away, but until recently it has not been directly relevant to what I do. I like the look of the proposed api, but have one question. Will this support an installed system that has multiple versions of the same package installed simultaneously? If not, then this would seem to be a significant limitation, especially when dependencies between packages are considered. Assuming it does, then how will this be achieved? I am presently managing this with a messy arrangement of symlinks. A package is installed with its version number in it's name, and a separate directory is created for an application with links from the unversioned package name to the versioned one. Then I just set the pythonpath to this directory. A sample of what the directory looks like is shown below. I'm sure there is a better solution that this, and I'm not sure that this would work under windows anyway (does windows have symlinks?). So, has this SIG considered such versioning issues yet? Cheers, Tim -------------------------------------------------------------- Tim Docker timd(a)macquarie.com.au Quantative Applications Division Macquarie Bank -------------------------------------------------------------- qad16:qad $ ls -l lib/python/ total 110 drwxr-xr-x 2 mts mts 512 Nov 11 11:23 1.1 -r--r----- 1 root mts 45172 Sep 1 1998 cdrmodule_0_7_1.so drwxr-xr-x 2 mts mts 512 Sep 1 1998 chart_1_1 drwxr-xr-x 3 mts mts 512 Sep 1 1998 Fnorb_0_7_1 dr-xr-x--- 3 mts mts 512 Nov 11 11:21 Fnorb_0_8 drwxr-xr-x 3 mts mts 1536 Mar 3 12:45 mts_1_1 dr-xr-x--- 7 mts mts 512 Nov 11 11:22 OpenGL_1_5_1 dr-xr-x--- 2 mts mts 1024 Nov 11 11:23 PIL_0_3 drwxr-xr-x 3 mts mts 512 Sep 1 1998 Pmw_0_7 dr-xr-x--- 2 mts mts 512 Nov 11 11:21 v3d_1_1 qad16:qad $ ls -l lib/python/1.1 total 30 lrwxrwxrwx 1 root other 29 Apr 10 10:43 _glumodule.so -> ../OpenGL_1_5_1/_glumodule.so lrwxrwxrwx 1 root other 30 Apr 10 10:43 _glutmodule.so -> ../OpenGL_1_5_1/_glutmodule.so lrwxrwxrwx 1 root other 22 Apr 10 10:43 _imaging.so -> ../PIL_0_3/_imaging.so lrwxrwxrwx 1 root other 36 Apr 10 10:43 _opengl_nummodule.so -> ../OpenGL_1_5_1/_opengl_nummodule.so lrwxrwxrwx 1 root other 27 Apr 10 10:43 _tkinter.so -> ../OpenGL_1_5_1/_tkinter.so lrwxrwxrwx 1 mts mts 21 Apr 10 10:43 cdrmodule.so -> ../cdrmodule_0_7_1.so lrwxrwxrwx 1 mts mts 12 Apr 10 10:43 chart -> ../chart_1_1 lrwxrwxrwx 1 root other 12 Apr 10 10:43 Fnorb -> ../Fnorb_0_8 lrwxrwxrwx 1 mts mts 12 Apr 10 10:43 mts -> ../mts_1_1 lrwxrwxrwx 1 root other 15 Apr 10 10:43 OpenGL -> ../OpenGL_1_5_1 lrwxrwxrwx 1 root other 33 Apr 10 10:43 opengltrmodule.so -> ../OpenGL_1_5_1/opengltrmodule.so lrwxrwxrwx 1 root other 33 Apr 10 10:43 openglutil_num.so -> ../OpenGL_1_5_1/openglutil_num.so lrwxrwxrwx 1 root other 10 Apr 10 10:43 PIL -> ../PIL_0_3 lrwxrwxrwx 1 mts mts 10 Apr 10 10:43 Pmw -> ../Pmw_0_7 lrwxrwxrwx 1 root other 10 Apr 10 10:43 v3d -> ../v3d_1_1

3 2

[Distutils-sig] distutils charter and interscript
by John Skaller 29 Apr '18

29 Apr '18

3 2

Versioned trove classifiers for Django
by James Bennett 06 Apr '17

06 Apr '17

Following up on some IRC discussion with other folks: There is precedent (Plone) for PyPI trove classifiers corresponding to particular versions of a framework. So I'd like to get feedback on the idea of expanding that, particularly in the case of Django. The rationale here is that the ecosystem of Django-related packages is quite large, but -- as I know all too well from a project I'm working on literally at this moment -- it can be difficult to ensure that all of one's dependencies are compatible with the version of Django one happens to be using. Adding trove classifier support at the level of individual versions of Django would, I think, greatly simplify this: tools could easily analyze which packages are compatible with an end user's chosen version, there'd be far less manual guesswork, etc., and the rate of creation of new classifiers would be relatively low (we tend to have one X.Y release/year or thereabouts, and that's the level of granularity needed). Assuming there's consensus around the idea of doing this, what would be the correct procedure for getting such classifiers set up and maintained?

5 17

Trove classifiers for MicroPython?
by Radomir Dopieralski 13 Feb '17

13 Feb '17

Hello everyone, I'm not sure this is the right place to write to propose new trove classifiers for PyPi -- if it's not, what would be the right place? If this is it, then please read below. The MicroPython project is quickly growing and becoming more mature, and as that happens, the number of 3rd-party libraries for it grows. Many of those libraries get uploaded to PyPi, as you can check by searching for "micropython". MicroPython has even its own version of "pip", called "upip", that can be used to install those libraries. However, there is as of yet no way to mark that a library is written for that particular flavor of Python, as there are no trove classifiers for it. I would like to propose adding a number of classifiers to amend that situation: For the MicroPython itself: Programming Language :: Python :: Implementation :: MicroPython For the hardware it runs on: Operating System :: Baremetal Environment :: Microcontroller Environment :: Microcontroller :: PyBoard Environment :: Microcontroller :: ESP8266 Environment :: Microcontroller :: Micro:bit Environment :: Microcontroller :: WiPy Environment :: Microcontroller :: LoPy Environment :: Microcontroller :: OpenMV I'm not sure if the latter makes sense, but it would certainly be nice to be able to indicate in a machine-parseable way on which platforms the code works. What do you think? -- Radomir Dopieralski

2 2

install questions and help requested. ---pyautogui
by Michael Strain 01 Feb '17

01 Feb '17

I am looking for a simple short cut where I can automate a few clicks with a button via python automate the boring stuff. I go through data then I am seeking a short cut for the click inorder to be time efficient. I am having some errors. I am new to python. I am using windows. I have read that I have to run 'pip install pyautogui' I have used windows cmd. python shell and python command. I get a syntax error from python and a nothing from windows. Where should I put this? I found the pyautogui program and downloaded it and unzipped it. I try to jump straight to the import script of pyautogui like SyntaxError: multiple statements found while compiling a single statement Traceback (most recent call last): File "<pyshell#1>", line 1, in <module> import pyautogui ModuleNotFoundError: No module named 'pyautogui' >>> pip install pyautogui SyntaxError: invalid syntax Sincerely, Michael G. Strain Jr.

2 1

Re: [Distutils] latest setuptools appears to require six in a breaking way
by Donald Stufft 30 Jan '17

30 Jan '17

> On Jan 27, 2017, at 2:05 PM, Eric Brunson <brunson(a)brunson.com> wrote: > > On Wed, Jan 25, 2017 at 5:52 PM Donald Stufft <donald(a)stufft.io <mailto:donald@stufft.io>> wrote: > >> On Jan 25, 2017, at 12:27 PM, Eric Brunson <brunson(a)brunson.com <mailto:brunson@brunson.com>> wrote: >> >> It wasn't until recently the I realized how quickly releases to setuptools and pip are being made, starting back in mid Dec when much of our dependency resolution started failing. There were three releases in the past two days. Four major and 22 minor releases in the past two months. While I applaud the speed of development and the improvement in these tools, don't you feel that breaking changes should be advertised better before release or perhaps we should slow down the cadence for release? >> >> I think an expectation that every setuptools user in the community start their day by checking to see if there was a release in the past 24 hours is a little unreasonable. I've spent a dozen hours since 32.0.0 resolving breakage in my own projects and assisting other developers in my org with their setuptools issues, all the while pushing setuptools as the best practice to do development and distribution. Is this period of breaking changes a short term thing that we just have to tough out for a few more weeks? >> >> Thanks, >> e. >> > > > I don’t believe that pip is really releasing that quickly. We generally make 1-2 “major” versions a year that include breaking changes, 2-4 “minor” releases a year that add new features, and 6-10 patch releases that fix bugs. To me that feels like a pretty decent pace of balancing not breaking people and getting new changes into people’s hands and getting rid of broken or less optimal parts of the code. > > Now, setuptools is releasing faster than pip is and whether that’s a good thing or not I don’t know. That’s a question for Jason largely :) > > Hey Donald, > > Thanks for the reply. > > Doesn't pip rely heavily on setuptools? I understand they have different origins, but I thought that since pip was moved under the purview of PYPA a lot of work was being done to converge the projects. When I run a pip -e one of the last message I see is "running setuptools.py develop", which isn't really a dependency, but can certainly cause people to infer that the problem is with pip and not know setuptools. Even the release notes Matthias references mentions pip as though it might be affected. > > If pip doesn't rely on setuptools, does that mean we have two separate and possibly different dependency resolution algorithms? > > Sincerely, > e. The answer here is… complex. Pip itself does not depend on setuptools though we _do_ depend on pkg_resources, but like all of our dependencies we bundle a copy internally and use that. Our uses of pkg_resources is primarily to inspect the currently installed packages to see what versions of what have been installed. If you’re installing from a Wheel file with pip, then you do not need to have setuptools installed at all (although if the wheel depends on setuptools we will obviously install it then). If you’re installing from a sdist, *then* you need setuptools installed because we’re going to execute the ``setup.py`` that is inside of that sdist and it will use setuptools (and we do some gross hacks to ensure it *always* uses setuptools, even if the project imports distutils). We are careful to pass in to setuptools the correct arguments that disables setuptools own handling of dependencies and we implement our own resolver. In the cases setuptools is being used (besides our bundled pkg_resources) it is primarily being used as a build tool. That being said, setuptools currently handles setup_requires on it’s own so the setuptools resolver handles that (though PEP 518 provides a way that in the future pip will use so that pip can handle build requirements instead of needing setuptools to do it). There is also a little known ``—egg`` parameter to pip that tells pip to stop preventing setuptools from doing it’s own resolving… but that is deprecated and is either removed or will be removed in the next version. So yes, they do have two separate and different dependency resolution algorithms (for instance, pip won’t install pre-releases by default unless it’s all that is available while setuptools will) but when you’re using ``pip install`` the setuptools one is carefully disabled *except* for setup_requires. — Donald Stufft

2 1

latest setuptools appears to require six in a breaking way
by Chris Withers 27 Jan '17

27 Jan '17

Hi All, Anyone else seen this? |File "/home/travis/virtualenv/python2.6.9/lib/python2.6/site-packages/setuptools/__init__.py", line 10, in <module> from six.moves import filter, map ImportError: No module named six.moves| Started happening in my nightly builds on travis after the 34.0.2 release of setuptools. I've filed an issue here since I suspect it isn't just me: https://github.com/pypa/setuptools/issues/945 cheers, Chris

6 9

Virtalenv and setuptools [was: latest setuptools appears to require six in a breaking way]
by Paul Moore 25 Jan '17

25 Jan '17

On 25 January 2017 at 17:20, Chris Withers <chris(a)simplistix.co.uk> wrote: > Right, so what's the recommended one-step way to set up a virtualenv now in > Py 2.6-3.6? This is the point I would consider most significant here. Virtualenv is deliberately built to allow use offline - pip, wheel and setuptools are bundled so that it's possible to create a virtualenv without needing Internet access. This change to setuptools will, if I understand it, break that expectation. While it's not a common scenario, I think it's something that should be considered. Going forward, I see a number of options for virtualenv: 1. Bundle all of setuptools' dependencies as well. 2. Drop the "no internet required" constraint - if we do this, it may be reasonable to only bundle pip, and get latest versions of everything else from PyPI. 3. Drop auto-installing setuptools (it's not needed unless you're installing from sdist, and it's only a "pip install setuptools" away for people who need it). 4. Document the changed behaviour by saying that no internet is required as long as you use --no-setuptools. Thoughts, anyone? Is the situation common enough to warrant anything other than (4)? It used to be for me, when pip didn't cache downloads and I had a secured proxy to deal with, but now I'd be OK with (4). Paul

3 7

Enquire for python
by ali refaee 25 Jan '17

25 Jan '17

Dear Sir/Madam I’m beginner in python, how can I get python modules? when run some function such as (import numpy as np) message ImportError: No module named numpy another ex import matplotlib.pyplot as plt ImportError: No module named matplotlib.pyplot how we install modules? where are the modules? can I get modules to run python? Sent from Windows Mail

2 1

recommended strategy for missing development tools
by Robin Becker 25 Jan '17

25 Jan '17

A reportlab user says his pip install fails to create an importable C extension. He said "The platform is Mac OS X 10.11.6, aka "El Capitan". Pip didn't complain" which is probably true since the extension is not required for reportlab's main usage. I tried to reproduce on OS X 10.10.5, but my machine has xcode installed and the extension was correctly produced. I don't have any code in setup.py to prevent compilation; is there a way to alert users to the non-build of the extension(s). -- Robin Becker

3 3

latest setuptools appears to require six in a breaking way
by Chris Withers 25 Jan '17

25 Jan '17

Hi All, Anyone else seen this? |File "/home/travis/virtualenv/python2.6.9/lib/python2.6/site-packages/setuptools/__init__.py", line 10, in <module> from six.moves import filter, map ImportError: No module named six.moves| Started happening in my nightly builds on travis after the 34.0.2 release of setuptools. I've filed an issue here since I suspect it isn't just me: https://github.com/pypa/setuptools/issues/945 cheers, Chris

1 0

Compiling and installing C executable in setup.py
by sashk 21 Jan '17

21 Jan '17

Hello, I've got a python package which requires to install C executable, which will need to go into proper place, i.e. same place where scripts would go ($VIRTUAL_ENV/bin, /usr/local/bin, etc). What would be the correct way to implement this? I found couple examples, but they work only when using pip to install the package, but fail when I try to use python setup.py install: they will build the executable, but will not install it during the "install bdist_egg" stage. Regards, -sashk

1 0

Limit package installation to a specific Python version
by Lele Gaifax 20 Jan '17

20 Jan '17

Hi all, do installers like pip and conda consult trove classifiers, or more generally is there a way to "mark" a package published on PyPI as installable only in a Python 3 environment? An user proposed[1] to change the classifiers of a package to get that result, so I tried looking at pip and setuptools sources, but didn't find evidence of that. I see both use python_requires[2] in their setup that seem closer to the goal, but again, is that actually honored by pip and/or other installers? Thanks for any hint, ciao, lele. [1] https://github.com/python-rapidjson/python-rapidjson/pull/47 [2] https://www.python.org/dev/peps/pep-0345/#requires-python -- nickname: Lele Gaifax | Quando vivrò di quello che ho pensato ieri real: Emanuele Gaifas | comincerò ad aver paura di chi mi copia. lele(a)metapensiero.it | -- Fortunato Depero, 1929.

3 3

Has anyone looked at bug 29225?
by Elvis Stansvik 20 Jan '17

20 Jan '17

Hi distutils folks, Just wanted to ask if anyone has had time to look at my http://bugs.python.org/issue29225 ? It's my first bug report _and_ first patch for Python, so it's quite possible I screwed something up. Or people are just busy :) Cheers, Elvis

2 4

Re: [Distutils] RFC 2: PEP 541 - Package Index Name Retention
by Chris Rose 17 Jan '17

17 Jan '17

(copied from an email I erroneously sent to python-ideas@) I want to address one gap in the PEP regarding reclaiming abandoned names: Version reuse. The problem with reusing names is that existing applications or installations that reference the old one, unless they pin the version name precisely. Even in that case, I foresee issues with version collision, especially if the abandoned project was well-versioned in the same model (semver or otherwise) that the new project uses. I'm deeply concerned by the idea of installer code suddenly picking up a new project... with possibly different dependencies on its own, either with old or clashing versions. I recognize it's going to be rare, but these incidents will definitely impact the repeatability of builds depending on PyPi. I think the criteria for reuse of a name must include usage limits; if the package is being downloaded on a steady basis by accounts that can't be shown to belong to known integration systems, reuse should not be allowed. -- Chris R. ====== Not to be taken literally, internally, or seriously. Twitter: http://twitter.com/offby1

5 8

How to specify dependencies in Python
by Thomas Güttler 17 Jan '17

17 Jan '17

I came across a python library which has docs, which start like this: {{{ Quickstart Include foolib in your requirements.txt file. }}} AFAIK dependencies should be specified via `install_requires` in `setup.py`. Should I talk to the maintainer of the library and create a pull-request for the docs? Regards, Thomas Güttler -- Thomas Guettler http://www.thomas-guettler.de/

6 13

Re: [Distutils] RFC: PEP 541 - Package Index Name Retention
by Nick Coghlan 16 Jan '17

16 Jan '17

On 17 Jan 2017 09:20, "Dariusz Suchojad" <dsuch(a)zato.io> wrote: On 16/01/17 23:10, Robert Collins wrote: > So, this proposition didn't really make sense to me. Folk like Linux > distros will want the source, and you don't need to upload wheels :- > setup.py could quite reasonably limit itself to software installation, vs > configuration. Plenty of pip installable packages are not entirely ready to > use after pip installation. Hi Robert, I'm not clear if this was meant in reply to my email? I'm genuinely perplexed. I just don't know how to relate it to the suggestion I made in this message: https://mail.python.org/pipermail/distutils-sig/2017-January/030015.html There are several sub-threads in this discussion and I'm not quite sure what you mean. Robert's referring to the fact that publishing a project sdist on PyPI can be quite helpful to redistributors, even if "pip install zato" just installs some helper libraries (or nothing at all) rather than a full Zato instance. Publishing at least a stub package with a README and setup.py that says "Zato is not pip installable, see <url> for details" would also provide a better experience for prospective users than a plain 404, provide the PyPI maintainers with a clear explanation of how the namespace entry is being used, and the project with download metadata that gives an indication of how often this mistake is being made, and hence whether or not it's an installation method that might be worth supporting (even if it's just a shim around a "docker pull" command). Cheers, Nick.

2 1

RFC: PEP 541 - Package Index Name Retention
by Lukasz Langa 16 Jan '17

16 Jan '17

Hello distutils-sig, I'd like to get some comments on this. I was asked by Donald to work on it. It removes ambiguity from some of the situations that crop up increasingly often with regards to package names on the PyPI. Looking forward to hearing what you have to say! - Ł PEP: 541 Title: Package Index Name Retention Version: $Revision$ Last-Modified: $Date$ Author: Łukasz Langa <lukasz(a)langa.pl> Status: Draft Type: Process Content-Type: text/x-rst Created: 12-January-2017 Abstract ======== This PEP proposes an extension to the Terms of Use [1]_ of the Package Index [2]_, clarifying expectations of package owners regarding ownership of a package name on the Package Index, specifically with regards to conflict resolution. Existing package repositories such as CPAN [3]_, NPM [4]_, and GitHub [5]_ will be investigated as prior art in this field. Rationale ========= Given that package names on the Index are sharing a single flat namespace, a unique name is a finite resource. The growing age of the Package Index causes a constant rise of situations of conflict between the current use of the name and a different suggested use of the same name. This document aims to provide general guidelines for solving the most typical cases of such conflicts. Specification ============= The main idea behind this document is that the Package Index serves the community. Every user is invited to upload content to the Package Index under the Terms of Use, understanding that it is at the sole risk of the user. While the Package Index is not a backup service, the maintainers of the Package Index do their best to keep that content accessible indefinitely in its published form. However, in certain edge cases the greater community's needs might overweigh the individual's expectation of ownership of a package name. The use cases covered by this document are: * Abandoned projects: * continued maintenance by a different set of users; or * removal from the Index for use with a different project. * Active projects: * resolving disputes over a name. * Invalid projects. Implementation ============== Reachability ------------ The user of the Package Index is solely responsible for being reachable by the Package Index maintainers for matters concerning projects that the user owns. In every case where contacting the user is necessary, the maintainers will try to do so at least three times, using the following means of contact: * the e-mail address on file in the user's profile on the Package Index; * the e-mail address listed in the Author field for a given project uploaded to the Index; and * any e-mail addresses found in the given project's documentation on the Index or on the listed Home Page. The maintainers stop trying to reach the user after six weeks. Abandoned projects ------------------ A project is considered *abandoned* when ALL of the following are met: * owner not reachable (see Reachability above); * no releases within the past twelve months; and * no activity from the owner on the project's home page (or no home page listed). All other projects are considered *active*. Continued maintenance of an abandoned project --------------------------------------------- If a candidate appears willing to continue maintenance on an *abandoned* project, ownership of the name is transferred when ALL of the following are met: * the project has been determined *abandoned* by the rules described above; * the candidate is able to demonstrate own failed attempts to contact the existing owner; * the candidate is able to demonstrate skin in the game (improvements made on the candidate's own fork of the project); * the candidate is able to demonstrate why a fork under a different name is not an acceptable workaround; and * the maintainers of the Package Index don't have any additional reservations. Under no circumstances will a name be reassigned against the wishes of a reachable owner. Removal of an abandoned project ------------------------------- Projects are never removed from the Package Index solely on the basis of abandonment. Artifacts uploaded to the Package Index hold inherent historical value. An *abandoned* project can be transferred to a new owner for purposes of reusing the name when ALL of the following are met: * the project has been determined *abandoned* by the rules described above; * the candidate is able to demonstrate own failed attempts to contact the existing owner; * the candidate is able to demonstrate skin in the game (the other project suggested to reuse the name already exists and meets notability requirements); * the candidate is able to demonstrate why a fork under a different name is not an acceptable workaround; * download statistics on the Package Index for the existing package indicate project is not being used; and * the maintainers of the Package Index don't have any additional reservations. Name conflict resolution for active projects -------------------------------------------- The maintainers of the Package Index are not arbiters in disputes around *active* projects. There are many possible scenarios here, a non-exclusive list describing some real-world examples is presented below. None of the following qualify for package name ownership transfer: 1. User A and User B share project X. After some time they part ways and each of them wants to continue the project under name X. 2. User A owns a project X outside the Package Index. User B creates a package under the name X on the Index. After some time, User A wants to publish project X on the Index but realizes name is taken. This is true even if User A's project X gains notability and the User B's project X is not notable. 3. User A publishes project X to the Package Index. After some time User B proposes bug fixes to the project but no new release is published by User A. This is true even if User A agrees to publish a new version and later doesn't, even if User B's changes are merged to the source code repository for project X. Again, the list above is not exclusive. The maintainers of the Package Index recommend users to get in touch with each other and solve the issue by respectful communication (see the PSF Code of Conduct [6]_). Invalid projects ---------------- A project published on the Package Index meeting ANY of the following is considered invalid and will be removed from the Index: * project does not conform to Terms of Use; * project is malware (designed to exploit or harm systems or users); * project contains illegal content; * project violates copyright or licenses; * project is name squatting (package has no functionality or is empty); * project name, description, or content violates the Code of Conduct; or * project is abusing the Package Index for purposes it was not intended. If you find a project that might be considered invalid, create a support request [7]_. Prior art ========= NPM contains a separate section linked from the front page called `Package Name Disputes <https://www.npmjs.com/policies/disputes>`_. It is described as a "living document", as of January 2017 its contents might be summarized as follows: * package name squatting is prohibited; * users wanting to reuse a project name are required to contact the existing author, with cc to support(a)npmjs.com; * all contact must conform to the NPM Code of Conduct; * in case of no resolution after a few weeks, npm inc. holds the right to the final decision in the matter. CPAN lets any user upload modules with the same name. PAUSE, a related index, only lists modules uploaded by the primary maintainer or listed co-maintainers. CPAN documentation doesn't address disputes otherwise. GitHub's terms of service contain an exhaustive list of behavior not meeting general conditions of use. While not codified anywhere, GitHub does agree for users to reclaim abandoned account names by archiving the abandoned account and letting the other user or organization rename their account. This is done on a case-by-case basis. Rejected Proposals ================== The original approach was to hope for the best and solve issues as they arise without written policy. This is not sustainable. The lack of generally available guidelines in writing on package name conflict resolution is causing unnecessary tensions. From the perspective of users, decisions made by the Package Index maintainers without written guidelines may appear arbitrary. From the perspective of the Package Index maintainers, solving name conflicts is a stressful task due to risk of unintentional harm due to lack of defined policy. References ========== .. [1] Terms of Use of the Python Package Index (https://pypi.org/policy/terms-of-use/) .. [2] The Python Package Index (https://pypi.python.org/) .. [3] The Comprehensive Perl Archive Network (http://www.cpan.org/) .. [4] Node Package Manager (https://www.npmjs.com/package/left-pad) .. [5] GitHub (https://github.com/) .. [6] Python Community Code of Conduct (https://www.python.org/psf/codeofconduct/) .. [7] PyPI Support Requests (https://sourceforge.net/p/pypi/support-requests/) Copyright ========= This document has been placed in the public domain. Acknowledgements ================ The many participants of the Distutils and Catalog SIGs for their ideas over the years. .. Local Variables: mode: indented-text indent-tabs-mode: nil sentence-end-double-space: t fill-column: 70 End:

10 16

Setuptools moving away from self install - testing needed
by Jason R. Coombs 16 Jan '17

16 Jan '17

In [setuptools 581](https://github.com/pypa/setuptools/issues/581), I’ve drafted a version of setuptools that essentially drops support for self installation, relying on pip install as the only supported mechanism for installing setuptools, both in the ez_setup.py bootstrap (for which there’s a minimally compatible shim for replacement) and in the codebase itself. I invite everyone to install the pre-release linked in the ticket and provide feedback there. I’ll give it at least a week before I cut an official release. If you need more time, just let me know. Regards, Jason

1 0

RFC 2: PEP 541 - Package Index Name Retention
by Łukasz Langa 14 Jan '17

14 Jan '17

Hello distutils-sig, Second version for review. As per Nick’s comments, I imagine after this PEP gets accepted, the Board will have to publish a Resolution to finalize it. I don’t think this part of the process needs to be mentioned. Simply put, the PSF is the implementor of the accepted change. As with any other implementations, that might trigger some minor changes to an otherwise accepted PEP. Changes from RFC 1: - specified where the document goes on the PyPI website - removed slang - covered legal matters, specifically the role of the PSF, pre-emptive invalidation of certain names, and mentioned trademark and patent violations Full change log: https://github.com/python/peps/commits/master/pep-0541.txt I decided to not otherwise touch on: - name squatting. The maintainers review every case reported by a user and are careful not to make any sudden moves. This makes me confident I won’t be stripped from a name registered yesterday on the basis of somebody reporting it tomorrow. On the other hand, legitimizing certain forms of squatting is asking for trouble as it can be abused. - suggesting anybody can escalate to the PSF Board if they are unhappy with a decision. Yes, this is always an option but we should not advertise it as effectively a “second chance”. I feel this is asking for trouble and undermines the rest of the document. - reachability by a bug tracker. The maintainers may decide to reach out on the project’s bug tracker to get attention. But ultimately they are seeking contact with the owner, not with the users. - reachability attempts schedule. The maintainers should be free to decide on the most reasonable schedule that works with their calendar. - somebody suggested a part of this PEP should be sending out an announcement about this policy to existing package owners. It’s funny because it’s a chicken and egg problem. The ones that we won’t be able to reach with an announcement might be the ones hit by the policy change ;-) Alright, I think that’s it. Full body below. Thanks for thoughtful and timely review! - Ł PEP: 541 Title: Package Index Name Retention Version: $Revision$ Last-Modified: $Date$ Author: Łukasz Langa <lukasz(a)langa.pl> Status: Draft Type: Process Content-Type: text/x-rst Created: 12-January-2017 Abstract ======== This PEP proposes an extension to the Terms of Use [1]_ of the Package Index [2]_, clarifying expectations of package owners regarding ownership of a package name on the Package Index, specifically with regards to conflict resolution. Existing package repositories such as CPAN [3]_, NPM [4]_, and GitHub [5]_ will be investigated as prior art in this field. Rationale ========= Given that package names on the Index are sharing a single flat namespace, a unique name is a finite resource. The growing age of the Package Index causes a constant rise of situations of conflict between the current use of the name and a different suggested use of the same name. This document aims to provide general guidelines for solving the most typical cases of such conflicts. Specification ============= The main idea behind this document is that the Package Index serves the community. Every user is invited to upload content to the Package Index under the Terms of Use, understanding that it is at the sole risk of the user. While the Package Index is not a backup service, the maintainers of the Package Index do their best to keep that content accessible indefinitely in its published form. However, in certain edge cases the greater community's needs might overweigh the individual's expectation of ownership of a package name. The use cases covered by this document are: * Abandoned projects: * continued maintenance by a different set of users; or * removal from the Index for use with a different project. * Active projects: * resolving disputes over a name. * Invalid projects. The proposed extension to the Terms of Use, as expressed in the Implementation section, will be published as a separate document on the Package Index, linked next to existing Terms of Use in the front page footer. Implementation ============== Reachability ------------ The user of the Package Index is solely responsible for being reachable by the Package Index maintainers for matters concerning projects that the user owns. In every case where contacting the user is necessary, the maintainers will try to do so at least three times, using the following means of contact: * the e-mail address on file in the user's profile on the Package Index; * the e-mail address listed in the Author field for a given project uploaded to the Index; and * any e-mail addresses found in the given project's documentation on the Index or on the listed Home Page. The maintainers stop trying to reach the user after six weeks. Abandoned projects ------------------ A project is considered *abandoned* when ALL of the following are met: * owner not reachable (see Reachability above); * no releases within the past twelve months; and * no activity from the owner on the project's home page (or no home page listed). All other projects are considered *active*. Continued maintenance of an abandoned project --------------------------------------------- If a candidate appears willing to continue maintenance on an *abandoned* project, ownership of the name is transferred when ALL of the following are met: * the project has been determined *abandoned* by the rules described above; * the candidate is able to demonstrate own failed attempts to contact the existing owner; * the candidate is able to demonstrate improvements made on the candidate's own fork of the project; * the candidate is able to demonstrate why a fork under a different name is not an acceptable workaround; and * the maintainers of the Package Index don't have any additional reservations. Under no circumstances will a name be reassigned against the wishes of a reachable owner. Removal of an abandoned project ------------------------------- Projects are never removed from the Package Index solely on the basis of abandonment. Artifacts uploaded to the Package Index hold inherent historical value. An *abandoned* project can be transferred to a new owner for purposes of reusing the name when ALL of the following are met: * the project has been determined *abandoned* by the rules described above; * the candidate is able to demonstrate own failed attempts to contact the existing owner; * the candidate is able to demonstrate that the project suggested to reuse the name already exists and meets notability requirements; * the candidate is able to demonstrate why a fork under a different name is not an acceptable workaround; * download statistics on the Package Index for the existing package indicate project is not being used; and * the maintainers of the Package Index don't have any additional reservations. Name conflict resolution for active projects -------------------------------------------- The maintainers of the Package Index are not arbiters in disputes around *active* projects. There are many possible scenarios here, a non-exclusive list describing some real-world examples is presented below. None of the following qualify for package name ownership transfer: 1. User A and User B share project X. After some time they part ways and each of them wants to continue the project under name X. 2. User A owns a project X outside the Package Index. User B creates a package under the name X on the Index. After some time, User A wants to publish project X on the Index but realizes name is taken. This is true even if User A's project X gains notability and the User B's project X is not notable. 3. User A publishes project X to the Package Index. After some time User B proposes bug fixes to the project but no new release is published by User A. This is true even if User A agrees to publish a new version and later doesn't, even if User B's changes are merged to the source code repository for project X. Again, the list above is not exclusive. The maintainers of the Package Index recommend users to get in touch with each other and solve the issue by respectful communication (see the PSF Code of Conduct [6]_). Invalid projects ---------------- A project published on the Package Index meeting ANY of the following is considered invalid and will be removed from the Index: * project does not conform to Terms of Use; * project is malware (designed to exploit or harm systems or users); * project contains illegal content; * project violates copyright, trademarks, patents, or licenses; * project is name squatting (package has no functionality or is empty); * project name, description, or content violates the Code of Conduct; or * project is abusing the Package Index for purposes it was not intended. The Package Index maintainers pre-emptively declare certain package names as unavailable for security reasons. If you find a project that you think might be considered invalid, create a support request [7]_. Maintainers of the Package Index will review the case. The role of the Python Software Foundation ------------------------------------------ The Python Software Foundation [8]_ is the non-profit legal entity that provides the Package Index as a community service. The Package Index maintainers can escalate issues covered by this document for resolution by the PSF Board if the matter is not clear enough. Some decisions *require* additional judgement by the Board, especially in cases of Code of Conduct violations or legal claims. Decisions made by the Board are published as Resolutions [9]_. The Board has the final say in any disputes covered by this document and can decide to reassign or remove a project from the Package Index after careful consideration even when not all requirements listed here are met. Prior art ========= NPM contains a separate section linked from the front page called `Package Name Disputes <https://www.npmjs.com/policies/disputes>`_. It is described as a "living document", as of January 2017 its contents might be summarized as follows: * package name squatting is prohibited; * users wanting to reuse a project name are required to contact the existing author, with cc to support(a)npmjs.com; * all contact must conform to the NPM Code of Conduct; * in case of no resolution after a few weeks, npm inc. holds the right to the final decision in the matter. CPAN lets any user upload modules with the same name. PAUSE, a related index, only lists modules uploaded by the primary maintainer or listed co-maintainers. CPAN documentation doesn't address disputes otherwise. GitHub's terms of service contain an exhaustive list of behavior not meeting general conditions of use. While not codified anywhere, GitHub does agree for users to reclaim abandoned account names by archiving the abandoned account and letting the other user or organization rename their account. This is done on a case-by-case basis. Rejected Proposals ================== The original approach was to hope for the best and solve issues as they arise without written policy. This is not sustainable. The lack of generally available guidelines in writing on package name conflict resolution is causing unnecessary tensions. From the perspective of users, decisions made by the Package Index maintainers without written guidelines may appear arbitrary. From the perspective of the Package Index maintainers, solving name conflicts is a stressful task due to risk of unintentional harm due to lack of defined policy. References ========== .. [1] Terms of Use of the Python Package Index (https://pypi.org/policy/terms-of-use/) .. [2] The Python Package Index (https://pypi.python.org/) .. [3] The Comprehensive Perl Archive Network (http://www.cpan.org/) .. [4] Node Package Manager (https://www.npmjs.com/package/left-pad) .. [5] GitHub (https://github.com/) .. [6] Python Community Code of Conduct (https://www.python.org/psf/codeofconduct/) .. [7] PyPI Support Requests (https://sourceforge.net/p/pypi/support-requests/) .. [8] Python Software Foundation (https://www.python.org/psf/) .. [9] PSF Board Resolutions (https://www.python.org/psf/records/board/resolutions/) Copyright ========= This document has been placed in the public domain. Acknowledgements ================ The many participants of the Distutils and Catalog SIGs for their ideas over the years. .. Local Variables: mode: indented-text indent-tabs-mode: nil sentence-end-double-space: t fill-column: 70 End:

1 0

Announcement: TLSv1.2 will become mandatory in the future
by Donald Stufft 12 Jan '17

12 Jan '17

Fastly has announced plans to disable TLSv1.0 and TLSv1.1 on their CDN endpoints which will include PyPI (as well as other Python properties). You can see their timeline at https://www.fastly.com/blog/phase-two-our-tls-10-and-11-deprecation-plan. There are two hard cut off dates to remember: * April 30, 2017, which is when any Python.org site you see that does *not* have an EV certificate that is hosted by Fastly will no longer support TLSv1.0 and TLSv1.1 (testpypi.python.org, test.pypi.org, files.pythonhosted.org, etc). This will affect Warehouse since that uses files.pythonhosted.org to serve files. * June 30, 2018, which is when any Python.org site you see that has an EV certificate that is hosted by Fastly will no longer support TSLv1.0 and TLSv1.1 (pypi.python.org, pypi.org, etc). I am going to see about possibly organizing some scheduled "brown outs" of TLSv1.0 and TLSv1.1 prior to the cut off dates to try and help folks find places that will need updates. Any scheduled brownouts will be posted to status.python.org prior to happening. Looking at the download numbers, the absolute largest driver of TLSv1.0 and TLSv1.1 traffic to PyPI are old versions of pip or other clients where I cannot tell the OS that they are being run on. Past that, macOS is going to be the largest casualty since their system Python does not support TLSv1.2 yet in any version of their OS. If you have a Python and you want to check to see if it supports TLSv1.2 or not, the easiest way to do that is by running: python2 -c "import urllib2,json; print(json.loads(urllib2.urlopen('https://www.howsmyssl.com/a/check').read())['tls_version'])" OR python3 -c "import urllib.request,json; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read())['tls_version'])" If you get something other than TLS 1.2, then I suggest making plans to deal with the inevitable breakage which may start occurring on or before April 30, 2017. — Donald Stufft

10 21

Python 3.6 new warnings
by Robin Becker 06 Jan '17

06 Jan '17

After the recent 3.6 release I started to build reportlab wheels for the new release on windows amd_x64 etc etc. A new warning which I haven't seen before is > C:\ux\XB33\py36_x86\lib\site-packages\wheel\pep425tags.py:77: RuntimeWarning: Config variable 'Py_DEBUG' is unset, Python ABI tag may be incorrect > warn=(impl == 'cp')): > C:\ux\XB33\py36_x86\lib\site-packages\wheel\pep425tags.py:81: RuntimeWarning: Config variable 'WITH_PYMALLOC' is unset, > Python ABI tag may be incorrect > warn=(impl == 'cp')): the windows wheels come out named like this > reportlab-3.3.26-cp27-none-win32.whl > reportlab-3.3.26-cp27-none-win_amd64.whl > reportlab-3.3.26-cp33-none-win32.whl > reportlab-3.3.26-cp33-none-win_amd64.whl > reportlab-3.3.26-cp34-none-win32.whl > reportlab-3.3.26-cp34-none-win_amd64.whl > reportlab-3.3.26-cp35-none-win32.whl > reportlab-3.3.26-cp35-none-win_amd64.whl > reportlab-3.3.26-cp36-cp36m-win32.whl > reportlab-3.3.26-cp36-cp36m-win_amd64.whl so 1) should I be attempting to make the none's correct using code in setup.py 2) is the tagging correct for cp36? Looking at pep 425 I don't see any definitions of the suffices other than d being debug. -- Robin Becker

2 2

Can't upload sdist: "File already exists"
by Nick Timkovich 06 Jan '17

06 Jan '17

I have a little package "huffman" where I build an sdist and wheel (python setup.py sdist bdist_wheel) and both seem to get built and can install fine. I can't seem to upload both to PyPI because the "File already exists": $ twine upload dist/* Uploading distributions to https://upload.pypi.org/legacy/ Uploading huffman-0.1.2-py2.py3-none-any.whl Uploading huffman-0.1.2.tar.gz HTTPError: 400 Client Error: File already exists. for url: https://upload.pypi.org/legacy/ Subsequent call to upload *just* the tarball fails the same way. I can't see an sdist anywhere, and uploading it via the website or twine just tells me it's already there...somehow. Asking pip to try to give it to me fails though (the binary works, however): $ pip download --no-cache-dir --only-binary :all: huffman==0.1.2 Collecting huffman==0.1.2 Downloading huffman-0.1.2-py2.py3-none-any.whl Saved ./huffman-0.1.2-py2.py3-none-any.whl Successfully downloaded huffman $ pip download --no-cache-dir --no-binary :all: huffman==0.1.2 Collecting huffman==0.1.2 Could not find a version that satisfies the requirement huffman==0.1.2 (from versions: ) No matching distribution found for huffman==0.1.2 Am I missing something? I am as sure as I can be that I didn't upload it twice; I bumped my version up one because I figured that may have been it. "twine register" that some guides mention just gets shot down with an HTTP "410 [...] simply upload the file" Cheers, Nick

8 15