[Distutils] PyPI download issues from Rackspace Cloud

2013-11-23 Thread Marius Gedminas
I recently spin up a Windows VM on Rackspace Cloud. I'm seeing a very weird problem: downloads from PyPI fail with checksum errors, nondeterministically. Sometimes it's a md5 hash mismatch error from pip[1]. Sometimes the error is a CRC error deep in the gzip module. It's not only pip -- I've

Re: [Distutils] PyPI download issues from Rackspace Cloud

2013-11-23 Thread Donald Stufft
Can you try with 1.5rc1? We switched to requests in that version and perhaps it side steps the issue? On Nov 23, 2013, at 5:05 AM, Marius Gedminas mar...@pov.lt wrote: I recently spin up a Windows VM on Rackspace Cloud. I'm seeing a very weird problem: downloads from PyPI fail with checksum

Re: [Distutils] PEP 458: Surviving a Compromise of PyPI: Round 1

2013-11-23 Thread Justin Cappos
These are not design - these are implementation details. What's the idea about that metadata? I don't get it. I already spent 15 minutes reading here and there and still can't see any short concept description. Only vague end-to-end security best practices buzzwords. I'm confused by your

Re: [Distutils] PEP 458: Surviving a Compromise of PyPI: Round 1

2013-11-23 Thread Paul Moore
On 22 November 2013 17:06, Justin Cappos jcap...@nyu.edu wrote: unclaimed project. What's this? What is the process of claiming a project? Is there a better terminology? This reads like picking abandoned project or project without authorship. Yes, it is essentially a project where the owner

Re: [Distutils] PEP 458: Surviving a Compromise of PyPI: Round 1

2013-11-23 Thread Nick Coghlan
On 24 Nov 2013 00:58, Paul Moore p.f.mo...@gmail.com wrote: On 22 November 2013 17:06, Justin Cappos jcap...@nyu.edu wrote: unclaimed project. What's this? What is the process of claiming a project? Is there a better terminology? This reads like picking abandoned project or project without

Re: [Distutils] PEP 458: Surviving a Compromise of PyPI: Round 1

2013-11-23 Thread Donald Stufft
They are signed. Just not by an author key. On Nov 23, 2013, at 9:58 AM, Paul Moore p.f.mo...@gmail.com wrote: Unsigned is accurate and specific - unclaimed sounds like I don't care about my project. ___ Distutils-SIG maillist -

Re: [Distutils] PyPI v2 (Was: PyPI pull request #7)

2013-11-23 Thread anatoly techtonik
On Sat, Nov 16, 2013 at 8:00 AM, Donald Stufft don...@stufft.io wrote: If people don’t like the requirements of Apache License 2.0 that’s fine they don’t need to contribute. Perhaps there might be a contributor or two lost to that but I’m not too worried about it. License is a bike shed