[Distutils] changelog / CDN inconsistency (was: Re: Good news everyone, PyPI is behind a CDN)

[Christian Theune]

Hi,


On 27. May2013, at 10:41 PM, Donald Stufft <donald at stufft.io> wrote:
> Just to assure folks. I do consider Mirroring a first class citizen and an important feature.

Thanks for that acknowledgement. Lets sort out what to do now - this is becoming urgent for me as the author of the currently recommended mirroring tool for public mirrors and as an operator of a mirror that is being relied upon.

I agree with Holgers points.

I don't think the mirroring is completely backwards right now. I agree there's been an incomplete PEP that's been hanging around too long. 

My current client implementation is pretty simple and has had reliable semantics until now.

A couple of things I noticed in the discussion that I'd like to point out:

- We mirror simple pages because the PEP requires us to - this is part of the existing validation approach. I can drop that to get mirrors not to rely on simple pages from the CDN but then authentication of the simple pages will be broken.

- Release files are replaced all the time.

The semantics that I like to keep with the mirrors is this:

When I get a changelog for serial X and I start copying simple pages and files then I (as a mirror) promise my clients that I have incorporated *at least* all changes up until serial X  (but maybe also partial changes from X+n).

I'm afraid that the mirrors data are now inconsistent - we can repair that once we have a stable mirroring approach again, but until then people will start getting annoyed again. 

I'm also concerned that I don't really have time to follow up on what's happening with TUF regarding mirroring on top of what happened regarding the CDN. My feeling is that will result in more fire fighting.

So - what's the next step that can happen ASAP?

Christian

-- 
Christian Theune · ct at gocept.com
gocept gmbh & co. kg · Forsterstraße 29 · 06112 Halle (Saale) · Germany
http://gocept.com · Tel +49 345 1229889-7
Python, Pyramid, Plone, Zope · consulting, development, hosting, operations

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 535 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://mail.python.org/pipermail/distutils-sig/attachments/20130528/99c585a7/attachment.pgp>