Mailman 3 - Distutils-SIG

PyPI will no longer accept compromised passwords!
by Donald Stufft June 19, 2019

June 19, 2019

I just wanted to give everyone a heads up that PyPI will no longer accept passwords that have been published in data breaches. For background you can take a look at https://github.com/pypa/warehouse/pull/4541 <https://github.com/pypa/warehouse/pull/4541>. For high level overview see https://pypi.org/help/#compromised-password <https://pypi.org/help/#compromised-password>. Finally if you have any trouble, please file an issue at https://github.com/pypa/warehouse/issues/new/choose <https://github.com/pypa/warehouse/issues/new/choose>.

2 2

new PyPI beta feature: U2F-compatible keys for 2FA
by Sumana Harihareswara June 18, 2019

June 18, 2019

To quote the blog post https://pyfound.blogspot.com/2019/06/pypi-now-supports-two-factor-login-via… : > To further increase the security of Python package downloads, we're adding a new beta feature to the Python Package Index: WebAuthn support for U2F compatible hardware security keys as a two-factor authentication (2FA) login security method. This is thanks to a grant from the Open Technology Fund, coordinated by the Packaging Working Group of the Python Software Foundation. ... > Starting today, PyPI also supports (in beta) WebAuthn (U2F compatible) security keys for a second login factor. A security key (also known as a universal second factor, or U2F compatible key) is hardware device that communicates via USB, NFC, or Bluetooth. Popular keys include Yubikey, Google Titan and Thetis. PyPI supports any FIDO U2F compatible key and follows the WebAuthn standard. Users who have set up this second factor will be prompted to use their key (usually by inserting it into a USB port and pressing a button) when logging in. (This feature requires JavaScript.) We need your help testing this while it's in beta: https://wiki.python.org/psf/WarehousePackageMaintainerTesting Later this week I'll publicize it to some more communities, and then in maybe 10 days, assuming we can quickly fix all the urgent bugs we find, we'll remove the "beta" badge. During this testing period, if things go awry, there's a chance we will need to wipe tokens from users' accounts, so if you choose to try it, please be forewarned. That's why you have to have a PyPI-verified email address on your user account before trying the feature, to make potential account recovery smoother. Thanks to the Open Technology Fund for funding this work. More progress reports at the Packaging Working Group's wiki page: https://wiki.python.org/psf/PackagingWG . (cross-posted to https://discuss.python.org/t/pypi-security-work-multifactor-auth-progress-h… ) -- Sumana Harihareswara Changeset Consulting https://changeset.nyc

1 0

Shipping a Python C extension + a library it uses as source
by Spencer Baugh June 12, 2019

June 12, 2019

Hi distutils-sig, I've developed a small C library and a much larger Python native extension that uses that library. The native extension has no dependencies other than that small C library. While the library is useful on its own, I'm thinking it would be good to include the library's source directly with my native extension's source when I upload to PyPI, so that it can be easily built for arbitrary platforms without me having to create wheels for them. Is this a known approach? Have people done this before? For reference, the C library, which currently builds with autotools, is here: https://github.com/catern/rsyscall/tree/master/c And the Python library and native extension, which currently builds with setuptools and uses cffi, is here: https://github.com/catern/rsyscall/tree/master/python Thanks for any guidance!

2 1

tiny sprint Saturday, June 8th
by Sumana Harihareswara June 6, 2019

June 6, 2019

A few folks will be getting together on Saturday and doing a short in-person sprint on some Python packaging & distribution tools, around 10am-4pm ET, at a coworking space/lounge in New York City. A few packaging/distribution folks, e.g., a Twine contributor, a pip bug fixer/triager, and a Warehouse maintainer (me), are confirmed as coming. I figure we'll review some open pull requests, triage bugs to find ones we can close as no longer reproducible, and explain stuff to each other. I think we've already run out of space for who can participate in person, but please feel free to hang out and chat with us via IRC! I'll be on Freenode IRC (#pypa-dev) as user "sumanah". And that way logs of our conversations will also be available at http://kafka.dcpython.org/channel/pypa-dev . (If you have never contributed to Python packaging/distribution tools before, and you want to start, this is probably not the best event for you; let me know, and I'll set up a more introductory event in the future.) -- Sumana Harihareswara Warehouse project manager Changeset Consulting https://changeset.nyc

2 1

Why lockbot?
by Robert Collins June 3, 2019

June 3, 2019

Seems like most of the pip bugmail I get now is lockbot messages telling me that a bug that hasn't received any discussion for a long time now can't have any more discussion. Is that really needed? The github UI shows the lock status of bugs itself... -Rob

6 6

Undesired publication of software project and personal data on PyPI
by Richard Neumann May 30, 2019

May 30, 2019

Hello everybody, my name is Richard Neumann. I started and maintain, amongst other projects, "mcipc" ( https://github.com/conqp/mcipc). Now, some user named wangzhizhou (https://pypi.org/user/wangzhizhou/) published this project without consulting me first on PyPI. Since mcipc is Free Software, I do not really have a problem with the publication itself, but that I am linked on the PyPI project page ( https://pypi.org/project/mcipc/) as "Author" and "Maintainer" with my company's email address, that is neither part of the respective repo nor of my GitHub account (I assume that they googled my name and got it from my company's website). I do not wish to have my private software projects liked to my company's email account, but have no means on contacting the publisher on PyPI nor uploading an updated version of the package's metadata since I am not the owner of the PyPI project. Is it possible for an administrator to at least change my email address on PyPI to my private one? Best regards, Richard

2 3

enscons 0.7.0 released with PEP517 support
by Daniel Holth May 21, 2019

May 21, 2019

And now for something completely different I've implemented PEP517 support for the SCons-powered build system "enscons", quite possibly the most different pip build backend available. It should be able to build itself and rsalette (another enscons-using package) using pep517. Note the newly required env.Default() that enscons needs to return the target filename to pip. Due to SCons limitations enscons may not be able to build .tar.gz sdists on Windows. enscons is an experimental Python build system that runs on top of SCons, a Makefile replacement. It is able to build C. It should be much easier to customize than a setuptools-based system. I originally wrote it so that I could experiment with the wheel format without having to hack on setuptools. It might be useful to you if you have a package that has a complex dependency tree of generated code between the source and whatever ends up in the wheel, if you want to build more than one wheel from a single source tree, or if you have other needs that just don't fit into setuptools. enscons also has a setup.py emulation that supports "setup.py develop". The pep517 package is pretty cool. Thanks! I would call these pep517 powered builds "pluggable". Daniel Holth

2 2

question about claiming potentially abandoned namespaces on PyPI
by Emma Tosch May 20, 2019

May 20, 2019

Hi all, Apologies if this is not the proper channel for the following question. I have a project that I would like to post on PyPI that clashes with an existing project that I believe may be abandoned (https://pypi.org/project/toybox/#description). According to this PEP (https://www.python.org/dev/peps/pep-0541/) it appears that the appropriate course of action is to attempt to contact the owner of this namespace and find out if they will transfer ownership to me. In the section of the PEP that discusses prior art, there is a reference to cc'ing folks from npm when analogous issues arise over in JS land. It isn't clear to me from this PEP or its resolution what the proper procedure for pursuing ownership of a claimed, but possibly abandoned namespace is for PyPI. Is there an email address I should cc when contacting the namespace owner? How does one initiate an official request for an abandoned namespace? Thanks! Emma -- Emma Tosch PhD Candidate, College of Information & Computer Sciences University of Massachusetts Amherst etosch(a)cs.umass.edu http://cs.umass.edu/~etosch

4 4

ANN: distlib 0.2.9 released on PyPI
by Vinay Sajip May 14, 2019

May 14, 2019

I've recently released version 0.2.9 of distlib on PyPI [1]. For newcomers,distlib is a library of packaging functionality which is intended to beusable as the basis for third-party packaging tools. The main changes in this release are as follows: * Updated default PyPI URL to https://pypi.org/pypi. * Relaxed metadata format checks to ignore 'Provides'. * Fixed #33, #34: simplified script template. * Fixed #115: Relaxed check for '..' in wheel archive entries by not checking filename parts, only directory segments. * Fixed #116: Corrected parsing of credentials from URLs. * Fixed #122: Skipped entries in archive entries ending with '/' (directories) when verifying or installing. * Commented out Disqus comment section in documentation. A more detailed change log is available at [2]. Please try it out, and if you find any problems or have any suggestions for improvements,please give some feedback using the issue tracker! [3] Regards, Vinay Sajip [1] https://pypi.org/project/distlib/0.2.9/[2] https://distlib.readthedocs.io/en/latest/overview.html#change-log-for-distl… https://bitbucket.org/pypa/distlib/issues/new

1 0

PEP 592 Title: Adding "Yank" Support to the Simple API
by Donald Stufft May 10, 2019

May 10, 2019

Just mentioning this here incase anyone is not following along on discuss.python.org <http://discuss.python.org/>: I’ve written a PEP that is going to add support for “yanking” files in the simple api. This will act as a softer form of file deletion that solves a lot of the breakages that happen when you do delete a file. I’m not going to go into full details here, but I wanted to give everyone a heads up, and if you have any comments or concerns, please follow up on the discuss.p.o thread. More information: https://discuss.python.org/t/pep-592-support-for-yanked-files-in-the-simple… <https://discuss.python.org/t/pep-592-support-for-yanked-files-in-the-simple…> Thanks!

1 0