Python-announce-list

Download

python-announce-list@python.org

April 2018

24 participants
32 discussions

Mac users, upgrade to pip 9.0.3 (due to TLS deprecation)
by Sumana Harihareswara April 2, 2018

April 2, 2018

Mac users who use pip and PyPI: If you are running macOS/OS X version 10.12 or older, then you ought to upgrade to the latest pip (9.0.3) to connect to the Python Package Index securely: curl https://bootstrap.pypa.io/get-pip.py | python and we recommend you do that by April 8th. Pip 9.0.3 supports TLSv1.2 when running under system Python on macOS < 10.13. Official release notes: https://pip.pypa.io/en/stable/news/ Context: As PSF blogged last year https://pyfound.blogspot.com/2017/01/time-to-upgrade-your-python-tls-v12.ht… , on June 30, 2018, Python.org sites are going to entirely stop supporting TLS versions 1.0 and 1.1, because our CDN provider is deprecating support for those versions. We are launching the new PyPI (in beta at https://pypi.org) this month and replacing the legacy PyPI (https://pypi.python.org). Here's the beta announcement for the new PyPI: https://pyfound.blogspot.com/2018/03/warehouse-all-new-pypi-is-now-in-beta.… Warehouse, the codebase for the new PyPI, does not support TLS 1.0 or 1.1. As of late March, the Python Package Index has started doing brownouts of the deprecated TLS versions. For some portion of each hour, anyone attempting to access PyPI with TLSv1.0 or TLSv1.1 will get a 403 response with an informative error. We are ramping up the amount of time the endpoint is down for the deprecated TLS versions, and plan to make the endpoint 100% unavailable (for the deprecated TLS versions) on and after April 8th, prior to the final deadline. That gives us a few months where, someone tries to "pip install", we can give a good error message -- once June 30th hits, it will just be an uninformative OpenSSL error. More info: * https://github.com/pypa/warehouse/issues/3293 * https://github.com/pypa/warehouse/issues/3411 * https://status.python.org/incidents/btjtz01lzp88 If you have problems accessing PyPI, upgrading pip, etc., please file an issue at https://github.com/pypa/packaging-problems/issues/ and we'll help figure it out. Please publicize this. Further discussion on this can be found in the distutils-sig mailing list https://mail.python.org/mailman/listinfo/distutils-sig . Thank you. -- Sumana Harihareswara Warehouse project manager Changeset Consulting https://changeset.nyc

1 0

Re: Beta release of pip version 10
by Paul Moore April 2, 2018

April 2, 2018

Unfortunately there was an issue in one of the release files (the CA Certificate bundle contained Windows line endings instead of Unix line endings) which caused crashes on older versions of MacOS. As a result we have just released 10.0.0b2, fixing this issue. Anyone on older MacOS versions who have had problems with the 10.0.0b1 release should upgrade to 10.0.0b2. Thanks, Paul On 31 March 2018 at 12:11, Paul Moore <p.f.moore(a)gmail.com> wrote: > On behalf of the PyPA, I am pleased to announce that a beta release > 10.0.0b1 of pip has just been released for testing by the community. > We're planning on a final release in 2 weeks' time, over the weekend > of 14/15 April. > > To install pip 10.0.0.b1, you can run > > python -m pip install --upgrade --pre pip > > (obviously, you should not do this in a production environment!) > > We would be grateful for all testing that users could do, to ensure > that when pip 10 is released it's as solid as we can make it. > > Highlights of the new release: > > * Python 2.6 is no longer supported - if you need pip on Python 2.6, > you should stay on pip 9, which is the last version to support Python > 2.6. > * Support for PEP 518, which allows projects to specify what packages > they require in order to build from source. (PEP 518 support is > currently limited, with full support coming in future versions - see > the documentation for details). > * Significant improvements in Unicode handling for non-ASCII locales on Windows. > * A new "pip config" command. > * The default upgrade strategy has become "only-if-needed" > * Many bug fixes and minor improvements. > > In addition, the previously announced reorganisation of pip's > internals has now taken place. Unless you are the author of code that > imports the pip module (or a user of such code), this change will not > affect you. If you are, please report the issue to the author of the > affected code (refer them to > https://mail.python.org/pipermail/distutils-sig/2017-October/031642.html > for the details of the announcement). > > Please note that there is a minor issue with the NEWS file for this > release - the new features in 10.0.0b1 are reported as being for > "9.0.3 (2018-03-31)". > > If you discover any bugs while testing the new release, please report > them at https://github.com/pypa/pip/issues. > > Thanks to everyone who put so much effort into the new release. Many > of the contributions came from community members, whether in the form > of code, participation in design discussions, or bug reports. The pip > development team is extremely grateful to everyone in the community > for their contributions. > > Thanks, > Paul

1 0