[Distutils] Deprecating/Removing OpenID/Google login support for PyPI

Barry Warsaw barry at python.org
Thu Jan 18 14:20:02 EST 2018


Donald Stufft wrote:
> 
> * Very few people actually are using OpenID or Google logins as it is. In one month we had ~15k logins using the web form, ~5k using basic auth, and 62 using Google and 7 using OpenID. This is a several orders of magnitude difference.
> * Regardless of how you log into PyPI (Password or Google/OpenID) you’re required to have a password added to your account to actually upload anything to PyPI. This negates much of the benefit of a federated authentication for PyPI as it stands.
> * Keeping these requires ongoing maintenance to deal with any changes in the specification or to update as Google deprecates/changes things.
> * Adding support for them to Warehouse requires additional work that could better be used elsewhere, where it would have a higher impact.

I'm one of those 7, but I really can't argue for you to keep supporting
it just for *me* :).  Have you considered allowing developers to use
their GitHub, GitLab, Bitbucket logins?  Those three probably cover a
large majority of package authors on PyPI.  I don't know how hard that
would be to support though.

-Barry




More information about the Distutils-SIG mailing list