[Distutils] Deprecating/Removing OpenID/Google login support for PyPI

Joni Orponen j.orponen at 4teamwork.ch
Mon Jan 15 02:03:05 EST 2018


On Fri, Jan 12, 2018 at 9:51 PM, Donald Stufft <donald at stufft.io> wrote:

> As folks are likely aware, legacy PyPI currently supports logging in using
> OpenID and Google Auth while Warehouse does not. After much deliberation,
> I’ve decided that Warehouse will not be implementing OpenID or Google
> logins, and once we shutdown legacy PyPI, OpenID/ and Google logins to PyPI
> will no longer be possible.
>
> This decision was made for a few reasons:
>
> * Very few people actually are using OpenID or Google logins as it is. In
> one month we had ~15k logins using the web form, ~5k using basic auth, and
> 62 using Google and 7 using OpenID. This is a several orders of magnitude
> difference.
>

For reference: OpenID has never worked for me and I think content blockers
rip out the Google option for me.

* Regardless of how you log into PyPI (Password or Google/OpenID) you’re
> required to have a password added to your account to actually upload
> anything to PyPI. This negates much of the benefit of a federated
> authentication for PyPI as it stands.
>

OAuth app tokens are a possible way to achieve this as well and might suite
various release pipelines better.

* Keeping these requires ongoing maintenance to deal with any changes in
> the specification or to update as Google deprecates/changes things.
> * Adding support for them to Warehouse requires additional work that could
> better be used elsewhere, where it would have a higher impact.
>

All that said, +1 for not bothering with it.

If it ever is tackled, I'm sure this day and age will bring more, more
visible and more direct feedback on it working or not working for users
than the previous iteration.

-- 
Joni Orponen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/distutils-sig/attachments/20180115/58f022f9/attachment.html>


More information about the Distutils-SIG mailing list