Hello Dear infrastructure team and tooling, I would like to let you know that yesterday, finally, after about 2 years of back-and-forth and PEP-772 changing how the Packaging Team accepts PEPs, the new council finally accepted "PEP-752 Implicit namespaces for package repositories," which I co-authored.
https://github.com/python/peps/pull/5009 *What does this mean for the ASF and PMCs ?* There is a reference implementation of it for PyPI, so it is likely now, after the PEP is accepted, it will be implemented in months rather than years. And once implemented, the ASF will be able to claim the "apache-" ownership for PyPI packages. This means that the ASF's expectation that Python Packages are named with "apache-" prefix will be not only practical, but also enforceable (nobody else will be able to publish packages with "apache-" prefix. It will make our lives easier to remove anyone who has already done this. We will only have to prove **ONCE** that our organisation - managed by Infra - has the right to use the "apache-" prefix. Then, all cases where someone already uses an "apache-" package will be much faster - almost automatic—to process following PEP-541 (https://peps.python.org/pep-0541/). Currently, it currently takes months to remove someone who is using a name we would like to use. Recent example https://github.com/pypi/support/issues/10716 *What does it mean for Infra and Tooling?* For now - just awareness. If Infra prioritizes it, action will likely be needed in a few months, once the implementation is completed and released in PyPI. We should start the process of; a) Requesting the Infra-managed organization to get "apache-" prefix exclusivity b) Moving all ASF projects that use PyPI to the new organisation c) Starting a process to "boot" all non-apache projects using the "apache-" prefix, requiring them to use other names and allowing us to take over management of the existing projects (basically disabling them) d) That will also allow connecting Apache Trusted Releases with Trusted Publishing for the organization and enable all our Python projects to use trusted publishing. For incubator - it means that the "apache-" rule will finally be enforceable and we will always be able to choose the right package name and make sure it will not be taken by others - either maliciously or accidentally - for any new projects we incubate. I am happy to help in my volunteer capacity with all of these efforts, including leading the move of moving all 200+ Airflow projects to the new organization. This all depends on Infra and Tooling priorities, so I am letting you know early so you can decide on priorities and plan accordingly. Happy to answer any questions there. J.
