Unable to publish pipenv release to pypi
I am hoping this group can help us -- we are unable to publish pipenv releases to pypi. Attempt: https://github.com/pypa/pipenv/actions/runs/9409404185/job/25919264679 The output indicates techalchemy who has not been active in the project does not have an active pypi email address: Uploading distributions to https://upload.pypi.org/legacy/ Uploading pipenv-3000.0.0-py3-none-any.whl 25l 0% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.0/3.2 MB • --:-- • ? 3% ━╺━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.1/3.2 MB • 00:01 • 60.5 MB/s 45% ━━━━━━━━━━━━━━━━━╸━━━━━━━━━━━━━━━━━━━━━━ 1.4/3.2 MB • 00:01 • 12.7 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 25hWARNING Error during upload. Retry with the --verbose option for more details. ERROR HTTPError: 400 Bad Request from https://upload.pypi.org/legacy/ User 'techalchemy' does not have a verified primary email address. Please add a verified primary email before attempting to upload to PyPI. See https://pypi.org/help/#verified-email for more information. Any suggestions? --Matt Davis
Sorry, I should have added that I only have read only "view" access to pipenv in pypi.org, and not "manage" access. On Thu, Jun 6, 2024 at 8:06 PM Matt Davis <matteius@gmail.com> wrote:
I am hoping this group can help us -- we are unable to publish pipenv releases to pypi.
Attempt: https://github.com/pypa/pipenv/actions/runs/9409404185/job/25919264679
The output indicates techalchemy who has not been active in the project does not have an active pypi email address:
Uploading distributions to https://upload.pypi.org/legacy/ Uploading pipenv-3000.0.0-py3-none-any.whl 25l 0% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.0/3.2 MB • --:-- • ? 3% ━╺━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.1/3.2 MB • 00:01 • 60.5 MB/s 45% ━━━━━━━━━━━━━━━━━╸━━━━━━━━━━━━━━━━━━━━━━ 1.4/3.2 MB • 00:01 • 12.7 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 25hWARNING Error during upload. Retry with the --verbose option for more details. ERROR HTTPError: 400 Bad Request from https://upload.pypi.org/legacy/ User 'techalchemy' does not have a verified primary email address. Please add a verified primary email before attempting to upload to PyPI. See https://pypi.org/help/#verified-email for more information.
Any suggestions?
--Matt Davis
It looks like neither tech alchemy or jet black pope have 2fa on their account and neither has been involved with the project for some time. I’ve removed them both from owner access until they add 2fa to their accounts. I’ll ping them both directly if they’re not monitoring this email list. We should probably move the release workflow to use trusted publishers if possible. You should be able to republish. If there are still issues feel free to ping me directly so we’re not hitting such a broad list. Best, Nate On Thu, Jun 6, 2024 at 17:09 Matt Davis <matteius@gmail.com> wrote:
Sorry, I should have added that I only have read only "view" access to pipenv in pypi.org, and not "manage" access.
On Thu, Jun 6, 2024 at 8:06 PM Matt Davis <matteius@gmail.com> wrote:
I am hoping this group can help us -- we are unable to publish pipenv releases to pypi.
Attempt: https://github.com/pypa/pipenv/actions/runs/9409404185/job/25919264679
The output indicates techalchemy who has not been active in the project does not have an active pypi email address:
Uploading distributions to https://upload.pypi.org/legacy/ Uploading pipenv-3000.0.0-py3-none-any.whl 25l 0% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.0/3.2 MB • --:-- • ? 3% ━╺━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.1/3.2 MB • 00:01 • 60.5 MB/s 45% ━━━━━━━━━━━━━━━━━╸━━━━━━━━━━━━━━━━━━━━━━ 1.4/3.2 MB • 00:01 • 12.7 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 25hWARNING Error during upload. Retry with the --verbose option for more details. ERROR HTTPError: 400 Bad Request from https://upload.pypi.org/legacy/ User 'techalchemy' does not have a verified primary email address. Please add a verified primary email before attempting to upload to PyPI. See https://pypi.org/help/#verified-email for more information.
Any suggestions?
--Matt Davis
_______________________________________________ PyPA-Committers mailing list -- pypa-committers@python.org To unsubscribe send an email to pypa-committers-leave@python.org https://mail.python.org/mailman3/lists/pypa-committers.python.org/ Member address: nate.prewitt@gmail.com
Hey Nate -- Thanks for the fast response! I just re-ran the workflow and got the same failure note. Would be good if we could switch over to the trusted publishers -- that is also what Dustin Ingram just suggested. What do we need to do to make that happen? -Matt On Thu, Jun 6, 2024 at 8:15 PM Nate Prewitt <nate.prewitt@gmail.com> wrote:
It looks like neither tech alchemy or jet black pope have 2fa on their account and neither has been involved with the project for some time.
I’ve removed them both from owner access until they add 2fa to their accounts. I’ll ping them both directly if they’re not monitoring this email list.
We should probably move the release workflow to use trusted publishers if possible. You should be able to republish. If there are still issues feel free to ping me directly so we’re not hitting such a broad list.
Best, Nate
On Thu, Jun 6, 2024 at 17:09 Matt Davis <matteius@gmail.com> wrote:
Sorry, I should have added that I only have read only "view" access to pipenv in pypi.org, and not "manage" access.
On Thu, Jun 6, 2024 at 8:06 PM Matt Davis <matteius@gmail.com> wrote:
I am hoping this group can help us -- we are unable to publish pipenv releases to pypi.
Attempt: https://github.com/pypa/pipenv/actions/runs/9409404185/job/25919264679
The output indicates techalchemy who has not been active in the project does not have an active pypi email address:
Uploading distributions to https://upload.pypi.org/legacy/ Uploading pipenv-3000.0.0-py3-none-any.whl 25l 0% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.0/3.2 MB • --:-- • ? 3% ━╺━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.1/3.2 MB • 00:01 • 60.5 MB/s 45% ━━━━━━━━━━━━━━━━━╸━━━━━━━━━━━━━━━━━━━━━━ 1.4/3.2 MB • 00:01 • 12.7 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 25hWARNING Error during upload. Retry with the --verbose option for more details. ERROR HTTPError: 400 Bad Request from https://upload.pypi.org/legacy/ User 'techalchemy' does not have a verified primary email address. Please add a verified primary email before attempting to upload to PyPI. See https://pypi.org/help/#verified-email for more information.
Any suggestions?
--Matt Davis
_______________________________________________ PyPA-Committers mailing list -- pypa-committers@python.org To unsubscribe send an email to pypa-committers-leave@python.org https://mail.python.org/mailman3/lists/pypa-committers.python.org/ Member address: nate.prewitt@gmail.com
Hi all, sorry about that -- I had to reconfirm my pypi email for some reason. I suspect you would have the same problem in other release pipelines as well where this is still in use. If you need access to any of those projects on pypi, let me know. I had setting up 2fa on my todo list since last year already but I did that too. Let me know if you need anything! -Dan On Thu, Jun 6, 2024, at 8:22 PM, Matt Davis wrote:
Hey Nate --
Thanks for the fast response! I just re-ran the workflow and got the same failure note. Would be good if we could switch over to the trusted publishers -- that is also what Dustin Ingram just suggested.
What do we need to do to make that happen?
-Matt
On Thu, Jun 6, 2024 at 8:15 PM Nate Prewitt <nate.prewitt@gmail.com> wrote:
It looks like neither tech alchemy or jet black pope have 2fa on their account and neither has been involved with the project for some time.
I’ve removed them both from owner access until they add 2fa to their accounts. I’ll ping them both directly if they’re not monitoring this email list.
We should probably move the release workflow to use trusted publishers if possible. You should be able to republish. If there are still issues feel free to ping me directly so we’re not hitting such a broad list.
Best, Nate
On Thu, Jun 6, 2024 at 17:09 Matt Davis <matteius@gmail.com> wrote:
Sorry, I should have added that I only have read only "view" access to pipenv in pypi.org, and not "manage" access.
On Thu, Jun 6, 2024 at 8:06 PM Matt Davis <matteius@gmail.com> wrote:
I am hoping this group can help us -- we are unable to publish pipenv releases to pypi.
Attempt: https://github.com/pypa/pipenv/actions/runs/9409404185/job/25919264679
The output indicates techalchemy who has not been active in the project does not have an active pypi email address:
Uploading distributions to https://upload.pypi.org/legacy/
Uploading pipenv-3000.0.0-py3-none-any.whl
25l
0% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.0/3.2 MB • --:-- • ?
3% ━╺━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.1/3.2 MB • 00:01 • 60.5 MB/s
45% ━━━━━━━━━━━━━━━━━╸━━━━━━━━━━━━━━━━━━━━━━ 1.4/3.2 MB • 00:01 • 12.7 MB/s
100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s
100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s
25hWARNING Error during upload. Retry with the --verbose option for more details.
ERROR HTTPError: 400 Bad Request from https://upload.pypi.org/legacy/
User 'techalchemy' does not have a verified primary email address.
Please add a verified primary email before attempting to upload to
PyPI. See https://pypi.org/help/#verified-email for more information.
Any suggestions?
--Matt Davis
PyPA-Committers mailing list -- pypa-committers@python.org To unsubscribe send an email to pypa-committers-leave@python.org https://mail.python.org/mailman3/lists/pypa-committers.python.org/ Member address: nate.prewitt@gmail.com
PyPA-Committers mailing list -- pypa-committers@python.org To unsubscribe send an email to pypa-committers-leave@python.org https://mail.python.org/mailman3/lists/pypa-committers.python.org/ Member address: dan@danryan.co
Hey Dan and Matt, On Fri, Jun 7, 2024 at 2:45 AM Dan Ryan <dan@danryan.co> wrote:
Hi all, sorry about that -- I had to reconfirm my pypi email for some reason. I suspect you would have the same problem in other release pipelines as well where this is still in use. If you need access to any of those projects on pypi, let me know.
I had setting up 2fa on my todo list since last year already but I did that too. Let me know if you need anything!
-Dan
On Thu, Jun 6, 2024, at 8:22 PM, Matt Davis wrote:
Hey Nate --
Thanks for the fast response! I just re-ran the workflow and got the same failure note. Would be good if we could switch over to the trusted publishers -- that is also what Dustin Ingram just suggested.
What do we need to do to make that happen?
-Matt
FYI, as Dustin suggested, it is possible to avoid such problems in the future by switching over to Trusted Publishing. Check out my guide on setting it up at [1]. Note that the PyPI side trust needs to be configured by somebody with Owner privileges to the project, but once it's done, the configuration is linked to the project entity, not to any specific user accounts. [1]: https://packaging.python.org/en/latest/guides/publishing-package-distributio.... -- Warm regards, Sviatoslav Sydorenko Software Hacker @ Ansible Core --- https://useplaintext.email/ () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments ---
Looks like the workflow is configured <https://github.com/pypa/pipenv/blob/a84ecd351d1bd558ffdd4c023bcf79e5f4d4d348...> to publish with an API token owned by techalchemy. You'll need to either configure Trusted Publishing <https://docs.pypi.org/trusted-publishers/> for the project (recommended, does not require any new API tokens to be configured) or create a new API token for publishing and replace the PYPI_TOKEN secret for the GitHub repo. If you don't have "manage" access, you'll need to get someone else to configure Trusted Publishing. On Thu, Jun 6, 2024 at 8:09 PM Matt Davis <matteius@gmail.com> wrote:
Sorry, I should have added that I only have read only "view" access to pipenv in pypi.org, and not "manage" access.
On Thu, Jun 6, 2024 at 8:06 PM Matt Davis <matteius@gmail.com> wrote:
I am hoping this group can help us -- we are unable to publish pipenv releases to pypi.
Attempt: https://github.com/pypa/pipenv/actions/runs/9409404185/job/25919264679
The output indicates techalchemy who has not been active in the project does not have an active pypi email address:
Uploading distributions to https://upload.pypi.org/legacy/ Uploading pipenv-3000.0.0-py3-none-any.whl 25l 0% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.0/3.2 MB • --:-- • ? 3% ━╺━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.1/3.2 MB • 00:01 • 60.5 MB/s 45% ━━━━━━━━━━━━━━━━━╸━━━━━━━━━━━━━━━━━━━━━━ 1.4/3.2 MB • 00:01 • 12.7 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.2/3.2 MB • 00:00 • 22.2 MB/s 25hWARNING Error during upload. Retry with the --verbose option for more details. ERROR HTTPError: 400 Bad Request from https://upload.pypi.org/legacy/ User 'techalchemy' does not have a verified primary email address. Please add a verified primary email before attempting to upload to PyPI. See https://pypi.org/help/#verified-email for more information.
Any suggestions?
--Matt Davis
_______________________________________________ PyPA-Committers mailing list -- pypa-committers@python.org To unsubscribe send an email to pypa-committers-leave@python.org https://mail.python.org/mailman3/lists/pypa-committers.python.org/ Member address: di@python.org
participants (5)
-
Dan Ryan -
Dustin Ingram -
Matt Davis -
Nate Prewitt -
Sviatoslav Sydorenko