Python Packaging Vision and Strategy

Hello, My name is Shamika and I am the Packaging Project Manager at the PSF. This is my first post here. As part of this role, I am planning to initiate an exercise to define the Python Packaging Vision and Strategy. I have created this document to identify objectives, stakeholders and expected timeline for this initiative- https://docs.google.com/document/d/1T4IYZT7iFTlJm3N8wh8RC58noOFG2JbBI-8DYxYz... As PyPA maintainers are one of the key stakeholders, I wanted to reach out and see what the maintainers would like to get out of this exercise. I also wanted to ensure I have identified all possible objectives. Please can you review the document and let me know if you have suggestions around the objectives, possible themes and anything else that you would find useful or would improve the results. Please forward this email to anyone who should be included in this discussion. Shamika

On 19. Apr 2022, at 20:45, Brett Cannon <brett@python.org> wrote:
Does this include talking to the conda side of things? If not then does one of the objectives cover potentially trying to bridge the gap between PyPA and conda packaging?
With my conda maintainer hat on: I’d be happy to help answer these questions. Off the top of my head my general goals are: - identifying opportunities for collaboration between the conda project and PyPA - enabling conda to be a great environment to use PyPA tools with (e.g. pip, poetry etc) - follow Python packaging/PyPA specs as closely as possible to help Python users optionally profit from conda’s full-stack approach I’m not sure in how much detail you want to have those items in the document, but count me in for the workshops. Thanks, Jannis/jezdez

Apologies if these are a bit unorganized thoughts. We see more and more supply chain attacks. I'd love to have some thoughts around this: - reproducible build by default - how could pip prevent installation of potentially squatting/similar spelling packages ? Maybe a download threshold could be configured system wide and a "are you sure" prompt. Package installation by non-programmer (who don't use the CLI) is becoming more and more common/difficult. Could we have a pip API to allow simpler creation of packaging GUI ? -- M On Tue, 19 Apr 2022 at 20:59, Jannis Leidel <jannis.leidel@pyfound.org> wrote:

On Wed, 20 Apr 2022 at 10:25, Matthias Bussonnier <bussonniermatthias@gmail.com> wrote:
I'd agree with this but reframe it as "how do we encourage/support the development and adoption of a library (or libraries) that provides a programmatic API for the installation tasks that pip currently does?" If we decouple this work from the pip project, we're more likely to find a way to develop and maintain this sustainably. But yes, this would be a good topic to consider (and we should defer worrying about details for now). Paul

Yes, that was vaguely worded. I don't have anything against a set of libraries that would not require pip, but my impression is that any such effort would likely use pip in some form needs a minimal set of changes or stabilisation guarantees that need to be made in pip. As conda is also in this thread, if this goes only to a RFC/PEP that pip/conda agrees on for interoperability, that would be a huge step forward. It's not yet time to dive into details, but thinking about error messages, and downloading progress/user feedback in non-terminal applications might lead to quite some discussions. -- M On Wed, 20 Apr 2022 at 12:25, Paul Moore <p.f.moore@gmail.com> wrote:

Thank you for the excellent suggestions. The specifics will be hashed out in the workshop/survey. If there are other high-level suggestions, please feel free to share them. Regards, Shamika On Wed, Apr 20, 2022 at 3:59 PM Matthias Bussonnier < bussonniermatthias@gmail.com> wrote:

Dear All, I have created this doc that lists the survey questions- https://docs.google.com/document/d/1kKMJmQccitzZnyUqYx4C5zTnb02RSyv2qwOnful7... Please share your feedback and let me know if I should add any other questions. Regards. Shamika On Thu, Apr 21, 2022 at 5:56 PM Shamika Mohanan <shamika.mohanan@pyfound.org> wrote:

On 19. Apr 2022, at 20:45, Brett Cannon <brett@python.org> wrote:
Does this include talking to the conda side of things? If not then does one of the objectives cover potentially trying to bridge the gap between PyPA and conda packaging?
With my conda maintainer hat on: I’d be happy to help answer these questions. Off the top of my head my general goals are: - identifying opportunities for collaboration between the conda project and PyPA - enabling conda to be a great environment to use PyPA tools with (e.g. pip, poetry etc) - follow Python packaging/PyPA specs as closely as possible to help Python users optionally profit from conda’s full-stack approach I’m not sure in how much detail you want to have those items in the document, but count me in for the workshops. Thanks, Jannis/jezdez

Apologies if these are a bit unorganized thoughts. We see more and more supply chain attacks. I'd love to have some thoughts around this: - reproducible build by default - how could pip prevent installation of potentially squatting/similar spelling packages ? Maybe a download threshold could be configured system wide and a "are you sure" prompt. Package installation by non-programmer (who don't use the CLI) is becoming more and more common/difficult. Could we have a pip API to allow simpler creation of packaging GUI ? -- M On Tue, 19 Apr 2022 at 20:59, Jannis Leidel <jannis.leidel@pyfound.org> wrote:

On Wed, 20 Apr 2022 at 10:25, Matthias Bussonnier <bussonniermatthias@gmail.com> wrote:
I'd agree with this but reframe it as "how do we encourage/support the development and adoption of a library (or libraries) that provides a programmatic API for the installation tasks that pip currently does?" If we decouple this work from the pip project, we're more likely to find a way to develop and maintain this sustainably. But yes, this would be a good topic to consider (and we should defer worrying about details for now). Paul

Yes, that was vaguely worded. I don't have anything against a set of libraries that would not require pip, but my impression is that any such effort would likely use pip in some form needs a minimal set of changes or stabilisation guarantees that need to be made in pip. As conda is also in this thread, if this goes only to a RFC/PEP that pip/conda agrees on for interoperability, that would be a huge step forward. It's not yet time to dive into details, but thinking about error messages, and downloading progress/user feedback in non-terminal applications might lead to quite some discussions. -- M On Wed, 20 Apr 2022 at 12:25, Paul Moore <p.f.moore@gmail.com> wrote:

Thank you for the excellent suggestions. The specifics will be hashed out in the workshop/survey. If there are other high-level suggestions, please feel free to share them. Regards, Shamika On Wed, Apr 20, 2022 at 3:59 PM Matthias Bussonnier < bussonniermatthias@gmail.com> wrote:

Dear All, I have created this doc that lists the survey questions- https://docs.google.com/document/d/1kKMJmQccitzZnyUqYx4C5zTnb02RSyv2qwOnful7... Please share your feedback and let me know if I should add any other questions. Regards. Shamika On Thu, Apr 21, 2022 at 5:56 PM Shamika Mohanan <shamika.mohanan@pyfound.org> wrote:
participants (6)
-
Brett Cannon
-
Jannis Leidel
-
Matthias Bussonnier
-
Paul Moore
-
Shamika Mohanan
-
shamika.mohanan@pyfound.org