Re: [Distutils] virtualenv, OS X, and GUIs

2008-01-08 Thread Noah
I think a list just for virtualenv makes a lot of sense. I also think we need a wiki for virtualenv recipes. I also think Ian needs a PR firm just to follow him around all day a to promote his code:) Our local user group is going to have a small talk/ screencast on virtualenv so it would be

Re: [Distutils] zc.buildout and PYTHON_EGG_CACHE

2008-01-11 Thread Noah
+1 I want to change my grokproject egg cache. And was wondering how. On Jan 11, 2008, at 7:08 PM, "Michael Dunstan" <[EMAIL PROTECTED] > wrote: > On Jan 12, 2008 1:04 PM, Jim Fulton <[EMAIL PROTECTED]> wrote: >> >> On Jan 11, 2008, at 6:58 PM, Michael Dunstan wrote: >> >>> How about something i

Re: [Distutils] PyPI lost IPv6 support?

2014-06-10 Thread Noah Kantrowitz
Both, supporting IPv6 is not a priority and so no extra work will be done for it. This is true across the board for all PSF services. --Noah On Jun 10, 2014, at 2:40 AM, Wichert Akkerman wrote: > I just noticed that my uploads to PyPI are now using IPv4 instead of IPv6. > Looking clo

Re: [Distutils] PEP draft on PyPI/pip package signing

2014-07-28 Thread Noah Kantrowitz
ially add some security benefits, though they are way way down the long tail. Overall strong -1. --Noah On Jul 28, 2014, at 8:01 AM, Giovanni Bajo wrote: > Hello, > > on March 2013, on the now-closed catalog-sig mailing-list, I submitted a > proposal for fixing several security prob

Re: [Distutils] PEP draft on PyPI/pip package signing

2014-07-28 Thread Noah Kantrowitz
.python.org and assert that it is correct because the certificate verifies". As you might note, these are functionally equivalent. If you can break one, you can break the other. --Noah On Jul 28, 2014, at 12:26 PM, Paul Moore wrote: > On 28 July 2014 20:19, Noah Kantrowitz wrote: &g

Re: [Distutils] Immutable Files on PyPI

2014-09-28 Thread Noah Kantrowitz
still allow deleting the file > or > reuploading it if the checksums match what was there prior. > +1. Would vastly simplify the infra side! --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-S

Re: [Distutils] PyPI is a sick sick hoarder

2015-05-15 Thread Noah Kantrowitz
ir repositories or > some way to get at those old versions. Personally I think that we shouldn’t > go deleting the old versions or encouraging people to do that. +1 for this. While I appreciate why Linux distress purge old versions, it is absolutely hellish for reproducibility.

Re: [Distutils] New Design Landed in Warehouse

2015-11-20 Thread Noah Kantrowitz
t/six/ > > Useful content starts only 2/3 down the first page. The large "pip > install six" snippet probably doesn't deserve being that proeminent > (or being there at all), and is ironically redundant with the "how do > I install this?" link just belo

Re: [Distutils] [final version?] PEP 513 - A Platform Tag for Portable Linux Built Distributions

2016-02-16 Thread Noah Kantrowitz
lling the pip developers to just break this for years > (see https://pip2014.com, which, much to my chagrin, still exists); `sudo pip > install´ should just exit immediately with an error; to the extent that > packagers need it, the only i

Re: [Distutils] Don't Use `sudo pip install´ (was Re: [final version?] PEP 513…)

2016-02-16 Thread Noah Kantrowitz
> On Feb 16, 2016, at 4:27 PM, Glyph Lefkowitz wrote: > > >> On Feb 16, 2016, at 4:13 PM, Noah Kantrowitz wrote: >> >> As someone that handles the tooling side, I don't care how it works as long >> as there is an override for tooling a la Chef/Puppet.

Re: [Distutils] Don't Use `sudo pip install´ (was Re: [final version?] PEP 513…)

2016-02-16 Thread Noah Kantrowitz
> On Feb 16, 2016, at 4:46 PM, Glyph Lefkowitz wrote: > >> >> On Feb 16, 2016, at 4:33 PM, Noah Kantrowitz wrote: >> >> >>> On Feb 16, 2016, at 4:27 PM, Glyph Lefkowitz >>> wrote: >>> >>> >>>> On Feb 16, 20

Re: [Distutils] Don't Use `sudo pip install´ (was Re: [final version?] PEP 513…)

2016-02-16 Thread Noah Kantrowitz
> On Feb 16, 2016, at 6:12 PM, Glyph Lefkowitz wrote: > >> >> On Feb 16, 2016, at 5:00 PM, Noah Kantrowitz wrote: >> >> >>> On Feb 16, 2016, at 4:46 PM, Glyph Lefkowitz >>> wrote: >>> >>>> >>>> On Feb 16,

Re: [Distutils] Don't Use `sudo pip install´ (was Re: [final version?] PEP 513…)

2016-02-17 Thread Noah Kantrowitz
> On Feb 17, 2016, at 5:58 AM, Glyph Lefkowitz wrote: > > >> On Feb 16, 2016, at 6:22 PM, Noah Kantrowitz wrote: >> >> I'm not concerned with if the module is importable specifically, but I am >> concerned with where the files will live overall. When b

Re: [Distutils] Don't Use `sudo pip install´ (was Re: [final version?] PEP 513…)

2016-02-17 Thread Noah Kantrowitz
> On Feb 17, 2016, at 7:12 PM, Glyph Lefkowitz wrote: > > >> On Feb 17, 2016, at 7:08 PM, Noah Kantrowitz wrote: >> >> Saying it's a good idea and we should move towards it is fine and I agree, >> but that isn't grounds to remove the ability to do

Re: [Distutils] What's up with PyPi maintenance?

2016-03-18 Thread Noah Kantrowitz
it a patch with a cogent explanation of what was wrong I'm sure it would get fixed ASAP. Such is the eternal rallying cry of FOSS :-) --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org https://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] Two ways to download python packages - I prefer one

2016-05-02 Thread Noah Kantrowitz
The correct way to do that these days is `pip install -e .` AFAIK. Setuptools should be considered an implementation detail of installs at best, not really used directly anymore (though entry points are still used by some projects, so this isn't really a strict dichotomy). --Noah >

Re: [Distutils] If you want wheel to be successful, provide a build server.

2016-05-25 Thread Noah Kantrowitz
possible (eg. Travis, Heroku, Lambda) but it requires serious care and feeding at a scale we don't currently have the resources for. Until something in that equation changes, the best we can do it try to piggyback on an existing sandbox environment like

Re: [Distutils] If you want wheel to be successful, provide a build server.

2016-05-25 Thread Noah Kantrowitz
r: This is not a question of getting some number of people to help. If you can clone us a small army of Donalds, Nicks, and Richards then we _might_ be able to pull this off. The money isn't the problem per se, it's the human cost in upkeep for a system designed explicitly to run hosti

Re: [Distutils] Switch PyPA from IRC to Gitter or similar

2016-06-10 Thread Noah Kantrowitz
lic use from the start, but their actual chat UI/UX isn't as polished as Slack. --Noah > On Jun 10, 2016, at 6:22 AM, Jason R. Coombs wrote: > > In #pypa-dev, I raised the possibility of moving our PyPA support channels > from IRC to another hosted solution that enables persi

Re: [Distutils] Proposal: using /etc/os-release in the "platform tag" definition for wheel files

2016-06-22 Thread Noah Kantrowitz
Manylinux has mostly replaced it as that covers the platforms 99% of people worry about. The tooling for manylinux is more complex than this would have been, but sunk cost etc etc and now that we have it might as well save everyone some headache. --Noah > On Jun 22, 2016, at 8:51

Re: [Distutils] Proposal: using /etc/os-release in the "platform tag" definition for wheel files

2016-06-22 Thread Noah Kantrowitz
on, but I think they are > separately useful (and even more useful and powerful when combined). I could see an argument for maybe building support into Pip but disallowing them on PyPI until we feel comfortable with the UX. That doesn't add much over existing private index support though.

Re: [Distutils] Proposal: using /etc/os-release in the "platform tag" definition for wheel files

2016-06-22 Thread Noah Kantrowitz
on, but I think they are > separately useful (and even more useful and powerful when combined). I could see an argument for maybe building support into Pip but disallowing them on PyPI until we feel comfortable with the UX. That doesn't add much over existing private index support though.

Re: [Distutils] license for setuptools

2016-08-11 Thread Noah Kantrowitz
Hi there, this list is for the discussion of Python's core packaging tools like distutils. We have no control over the packages made or distributed with them. You would have to contact the matplotlib authors, not us. --Noah > On Aug 12, 2016, at 7:51 AM, Marinier, Claude > wrote

Re: [Distutils] PyPI is down

2013-04-05 Thread Noah Kantrowitz
ght until > they get an upstream patch which will require some downtime, but then that > should be it. The upgrade was done yesterday afternoon, it just only resulted in about 30 seconds of downtime so I didn't even both announcing it :) --Noah signature.asc Desc

Re: [Distutils] distil 0.1.1 released

2013-05-03 Thread Noah Kantrowitz
ting to ~root will clearly not work in this case unless you also run your app as root (though I know some people do that too, but not behavior that should be encouraged). This proposal is entirely non-viable for anything but 100% best-practices u

Re: [Distutils] Proposal: Restrict the characters in a project name

2013-05-14 Thread Noah Kantrowitz
t; https://gist.github.com/dstufft/5581735 File me as a +1 for this change. If we absolutely must support unicode package names, we should do the URLs in PyPI in punycode and have pip show a puny-mangled name in a confirmation prompt for anything with non-ascii characters in it. Yes, that does basically remove all reason to use unicode in package names, which is why I think blocking it is a much better idea. [a-zA-Z0-9_.-] is probably the right way to go. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org http://mail.python.org/mailman/listinfo/distutils-sig

[Distutils] Good news everyone, PyPI is behind a CDN

2013-05-26 Thread Noah Kantrowitz
admins are discussing what to do about download counts long-term, but for now we all feel that the performance and availability benefits outweigh the loss. If anyone has any questions, or hears anything about issues with PyPI please don't hesitate to contact me. --Noah signatur

Re: [Distutils] PyPI Download Counts

2013-05-27 Thread Noah Kantrowitz
e do still get some indication of package activity from looking through the logs, it just no longer has a direct correlation. We will see one request hit the backend servers from each shield node per hour when that package is being requested. At some point we could recycle this into some

Re: [Distutils] changelog / CDN inconsistency (was: Re: Good news everyone, PyPI is behind a CDN)

2013-05-27 Thread Noah Kantrowitz
3, at 12:39 PM, Donald Stufft wrote: >>>> >>>>> >>>>> On May 27, 2013, at 8:08 AM, holger krekel wrote: >>>>> >>>>>> Hi Noah, Donald, (CC also Richard, Christian), >>>>>> >>>>>> i just checke

Re: [Distutils] changelog / CDN inconsistency (was: Re: Good news everyone, PyPI is behind a CDN)

2013-05-27 Thread Noah Kantrowitz
On May 27, 2013, at 1:20 PM, holger krekel wrote: > On Mon, May 27, 2013 at 12:58 -0700, Noah Kantrowitz wrote: >> On May 27, 2013, at 12:18 PM, holger krekel wrote: >> >>> On Mon, May 27, 2013 at 14:59 -0400, Donald Stufft wrote: >>>> On May 27, 20

Re: [Distutils] Good news everyone, PyPI is behind a CDN

2013-05-27 Thread Noah Kantrowitz
On May 27, 2013, at 2:21 PM, Ralf Schmitt wrote: > Noah Kantrowitz writes: > >> >> >> but seriously, at long last today it was my honor to throw the DNS >> switch to move PyPI to the Fastly caching CDN. I would like to thank >> Donald Stufft for doing m

Re: [Distutils] A process for removal of PyPi entries

2013-05-31 Thread Noah Kantrowitz
appens to ninja-upload between the setup.py register and setup.py upload, I think we can just throw an error message since chances of that happening are so amazingly low. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___

Re: [Distutils] Sooner or later, we're going to have to be more formal about how we name packages.

2013-06-01 Thread Noah Kantrowitz
an already put that in their package name if the bare version is taken, so QED this is already doable in the current system, it just looks so ugly that no one wants to do it and enforcing the ugly seems like a poor option. --Noah signature.asc Description: Message signed with OpenPGP using GP

Re: [Distutils] A process for removal of PyPi entries

2013-06-02 Thread Noah Kantrowitz
gt; active mailing list should still qualify for PyPI listing, else the > original distutils-sig would not have qualified for reserving the name > "distutils" on PyPI, before its first release. ;-) If a reasonably active project doesn't have anything to s

Re: [Distutils] Preemptive Apology for Volume of Mail

2013-06-03 Thread Noah Kantrowitz
for the day or something. The vast majority of PyPI users have only one package so asking us to derail the sending (probably resulting in having to begin again) is unhelpful. If the only cost to us all is hitting Ctrl-A Delete, I welcome progress with open arms. --Noah signature.asc Descript

Re: [Distutils] Preemptive Apology for Volume of Mail

2013-06-03 Thread Noah Kantrowitz
On Jun 3, 2013, at 11:37 PM, Chris Withers wrote: > On 04/06/2013 07:33, Noah Kantrowitz wrote: >> >> On Jun 3, 2013, at 11:29 PM, Chris Withers wrote: >> >>> Please can you do something to stop it? >>> Kill the MTA or something? >>> >>&

Re: [Distutils] Preemptive Apology for Volume of Mail

2013-06-04 Thread Noah Kantrowitz
On Jun 4, 2013, at 12:14 AM, Chris Withers wrote: > On 04/06/2013 07:45, Noah Kantrowitz wrote: >> >>>> As someone also in the top percentile of package maintainers I understand >>>> your annoyance, but just make a filter for don...@python.org for the day >

Re: [Distutils] Preemptive Apology for Volume of Mail

2013-06-04 Thread Noah Kantrowitz
On Jun 4, 2013, at 12:21 AM, Chris Withers wrote: > On 04/06/2013 08:16, Noah Kantrowitz wrote: >> >>> MTAs end up being blacklisted automatically by ISPs and RBLs if they >>> heuristically look like they're spewing spam. It's what companies like >>&

Re: [Distutils] option #1 plus download_url scraping

2013-06-04 Thread Noah Kantrowitz
pdate the version number in setup.py before you release? I'm a bit unsure of the reason for this. The goal is very specifically the hosting outside of PyPI is no longer encouraged. The reliability and performance of PyPI have enough of a track record now that "I want it on my own site

Re: [Distutils] b.pypi.python.org

2013-06-07 Thread Noah Kantrowitz
be great.. We should also probably remove it from the >> pypi mirror pool before we do this so it no longer gets traffic sent it's >> way. >> >> >> >> >> >> If we can get it up to date again, I think it is fine, but an out of date >

Re: [Distutils] b.pypi.python.org

2013-06-09 Thread Noah Kantrowitz
On Jun 7, 2013, at 2:34 PM, Noah Kantrowitz wrote: > > On Jun 7, 2013, at 2:27 PM, Donald Stufft wrote: > >> >> On Jun 7, 2013, at 5:26 PM, ken cochrane wrote: >> >>> >>> >>>> b.pypi.python.org is an official mirror that runs

Re: [Distutils] PyPI Download Counts

2013-06-09 Thread Noah Kantrowitz
the only way > to make everyone happy is to consider everyone who will be affected by your > actions, before you take action. There is another way, make awesome and wait for history to determine who was happy :) --Noah signature.asc Description: Message signed with OpenPGP using GPGMail __

Re: [Distutils] Fixing PyPI download stats with real-time log analysis (Was: PyPI Download Counts)

2013-06-23 Thread Noah Kantrowitz
Thank you for your interest, and stay tuned for future updates. --Noah ___ Distutils-SIG maillist - Distutils-SIG@python.org http://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] PyPI mirrors

2013-07-02 Thread Noah Kantrowitz
ortant part of the ecosystem for things like deploy caching, internal company mirrors, etc, but the federated, public mirror network concept is being retired. Several of the public mirrors have already shut down and just point back at PyPI, but others are still available if you want to use them.

Re: [Distutils] Current status of PEP 439 (pip boostrapping)

2013-07-12 Thread Noah Kantrowitz
w use cases, it is vastly more valuable to me that we focus on the user experience of the majority of Python developers and deployments, and this is somewhere that Ruby and Node are getting it right in having the package tool simply be there by default. Bundling also addresses th

Re: [Distutils] Expectations on how pip needs to change for Python 3.4

2013-07-13 Thread Noah Kantrowitz
> versions can't do this (I believe 2.6 and older can't for packages) but at > least in the situation we are discussing here of bundling pip it's not an > issue. No, this is not how any user ever will expect unix programs to work. I know that python -m is very cu

Re: [Distutils] Current status of PEP 439 (pip boostrapping)

2013-07-13 Thread Noah Kantrowitz
.4 that pip will come installed > with Python unless you build from source negates the need for the bootstrap > script beyond just saying ``curl https://pypi.python.org/get-pip.py | > python`` if pip isn't found. This is highly unhelpful for dealing with systems automation. For the

Re: [Distutils] Expectations on how pip needs to change for Python 3.4

2013-07-13 Thread Noah Kantrowitz
is the defined command line interface, because pip is a CLI tool. Independently of this discussion I've already been talking to the PyPA team about what they want to consider a stable API, but that is a discussion to be had over in pip-land,

Re: [Distutils] Expectations on how pip needs to change for Python 3.4

2013-07-14 Thread Noah Kantrowitz
ines get blurry since several people move back and forth between CPython and PyPA (and distutils and PyPI, etc) hats, so I think this must be stated clearly up front that what the CPython team thinks is "reasonable" for an API policy will be nothin

Re: [Distutils] Executable wrappers and upgrading pip (Was: Current status of PEP 439 (pip boostrapping))

2013-07-14 Thread Noah Kantrowitz
to never change. > > So unless the exe wrapper is changing with each version, I think the best way > of handling this is to not force them to be replaced when they have not > changed. The usual way to do this is just move the existing executable to pip.exe.deleteme or something, and then write out the new one. Then on every startup (or maybe some level of special case for just pip upgrades?) try to unlink *.deleteme. Not the simplest system ever, but it gets the job done. --Noah ___ Distutils-SIG maillist - Distutils-SIG@python.org http://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] Executable wrappers and upgrading pip (Was: Current status of PEP 439 (pip boostrapping))

2013-07-14 Thread Noah Kantrowitz
On Jul 14, 2013, at 10:31 AM, Ian Cordasco wrote: > On Sun, Jul 14, 2013 at 1:12 PM, Noah Kantrowitz wrote: >> >> On Jul 14, 2013, at 9:45 AM, Steve Dower wrote: >> >>> From: Paul Moore >>>> On 13 July 2013 10:05, Paul Moore wrote: >>>> H

Re: [Distutils] Executable wrappers and upgrading pip (Was: Current status of PEP 439 (pip boostrapping))

2013-07-14 Thread Noah Kantrowitz
On Jul 14, 2013, at 10:39 AM, Noah Kantrowitz wrote: > > On Jul 14, 2013, at 10:31 AM, Ian Cordasco wrote: > >> On Sun, Jul 14, 2013 at 1:12 PM, Noah Kantrowitz wrote: >>> >>> On Jul 14, 2013, at 9:45 AM, Steve Dower wrote: >>> >>>> Fr

Re: [Distutils] Executable wrappers and upgrading pip (Was: Current status of PEP 439 (pip boostrapping))

2013-07-14 Thread Noah Kantrowitz
On Jul 14, 2013, at 10:43 AM, Noah Kantrowitz wrote: > > On Jul 14, 2013, at 10:39 AM, Noah Kantrowitz wrote: > >> >> On Jul 14, 2013, at 10:31 AM, Ian Cordasco wrote: >> >>> On Sun, Jul 14, 2013 at 1:12 PM, Noah Kantrowitz >>> wrote: >&g

Re: [Distutils] Executable wrappers and upgrading pip (Was: Current status of PEP 439 (pip boostrapping))

2013-07-14 Thread Noah Kantrowitz
gt; stdlib makes sense (especially in the context of a pip bundling PEP). > > Another option we may want to consider is an actual msi installer for pip > (I'm not sure that would actually help, but it's worth looking into), as well > as inves

Re: [Distutils] API for registering/managing URLs for a package

2013-07-18 Thread Noah Kantrowitz
isables "unsafe" external URLs, and all external URLs will follow soon. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org http://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] API for registering/managing URLs for a package

2013-07-18 Thread Noah Kantrowitz
On Jul 18, 2013, at 8:06 AM, Noah Kantrowitz wrote: > > On Jul 18, 2013, at 7:10 AM, M.-A. Lemburg wrote: > >> I would like to write a script to automatically register release URLs >> for PyPI packages. >> >> Is the REST API documented somewhere, or

[Distutils] Worry about lack of focus

2013-07-18 Thread Noah Kantrowitz
ke sure we can get everything done without anyone going crazy(er) and that we keep sight of whats going on. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org http://ma

Re: [Distutils] What to do about the PyPI mirrors

2013-07-24 Thread Noah Kantrowitz
etire the [a-z].pypi.python.org names. Anyone with an existing mirror should be encouraged to continue maintaining it, but it will be for their own use (or the use of their company/internal network). --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___

Re: [Distutils] a plea for backward-compatibility / smooth transitions

2013-07-29 Thread Noah Kantrowitz
gt; someone > who thinks security issues are normal bugs. AFAIK there is no plan to switch > to > OpenBSD. This is news to me, we specifically run Ubuntu LTS because Canonical's security response team has a proven track record of handling issues. If you mean that Linus doesn'

Re: [Distutils] a plea for backward-compatibility / smooth transitions

2013-07-29 Thread Noah Kantrowitz
On Jul 29, 2013, at 11:19 PM, Antoine Pitrou wrote: > Noah Kantrowitz coderanger.net> writes: >>> The whole python.org infrastructure is built on an OS kernel written by > someone >>> who thinks security issues are normal bugs. AFAIK there is no plan to > switch

Re: [Distutils] a plea for backward-compatibility / smooth transitions

2013-07-30 Thread Noah Kantrowitz
exploits into the wild" is some kind of heroic, altruistic act, but I think > few > people would agree. No, this is the standard for security researchers. If the vendor ignores the reported exploit for long enough, they go public and try to make sure users understand the risks and ho

Re: [Distutils] What to do about the PyPI mirrors

2013-08-04 Thread Noah Kantrowitz
October 1st 2013, the [a-g].pypi.python.org DNS names will all be redirected to front.python.org and another two months beyond that (2013-12-01) they will all be deleted (along with last.pypi.python.org). That seems like a very generous deprecation schedule, especially given that all the needs to

Re: [Distutils] What to do about the PyPI mirrors

2013-08-05 Thread Noah Kantrowitz
companies using them being very reputable. At the end of the day, there is not currently any cryptographic mechanism preventing Fastly from doing bad things. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils

Re: [Distutils] What to do about the PyPI mirrors

2013-08-05 Thread Noah Kantrowitz
ing redirects to non-PSF servers. Very very +1 on the easier bandersnatch-ing though, I really would love to see more mirrors out there, I just don't want them associated with PyPI or python.org, and I don't want pip to be trying to auto-discover them. I am also hoping that pypi-mirrors.org will continue to operate as a community project (side note, I would be happy to assist with hosting for it if Ken reads this list and if thats a concern of his) and that the mirror operators can develop policies for things like this. I defer to Nick and Ken if they would like distutils-sig to be involved in that process, but as it stands Ken can apply whatever rules he wants to his mirror list. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org http://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] What to do about the PyPI mirrors

2013-08-06 Thread Noah Kantrowitz
On Aug 5, 2013, at 11:56 PM, holger krekel wrote: > On Mon, Aug 05, 2013 at 23:31 -0700, Noah Kantrowitz wrote: >> On Aug 5, 2013, at 11:11 PM, Christian Theune wrote: >> >>> Two more things: >>> >>> why is the CDN not suffering from the security

Re: [Distutils] What to do about the PyPI mirrors

2013-08-06 Thread Noah Kantrowitz
Also, CPAN, like Linux distro trees, can be mirrored with rsync rather > than needing a custom client. It's much easier to maintain backwards > compatibility when the only required server API is the ability to > serve static files. >

Re: [Distutils] What to do about the PyPI mirrors

2013-08-06 Thread Noah Kantrowitz
On Aug 6, 2013, at 12:10 AM, holger krekel wrote: > On Mon, Aug 05, 2013 at 23:49 -0700, Noah Kantrowitz wrote: >> On Aug 5, 2013, at 11:09 PM, Christian Theune wrote: >> (...) >> Between now and the first DNS change, I would absolutely recommend any >> current publi

Re: [Distutils] What to do about the PyPI mirrors

2013-08-06 Thread Noah Kantrowitz
ers, and it is better to just break the system and force them to notice they need to fix things (since one reason for doing this is current system is unsafe and allowing that to exist for another year is not really on my list). --Noah signature.asc Description: Message signed with OpenPGP

Re: [Distutils] Retiring mirror g.pypi.python.org

2013-08-30 Thread Noah Kantrowitz
DNS and LB config have been updated and should take effect over the next day or so. --Noah On Aug 30, 2013, at 11:01 AM, Ralph Bean wrote: > The admins at g.pypi.python.org/mirror.rit.edu have decided they no > longer have the resources to maintain their mirror. They've already &

Re: [Distutils] pypissh

2013-09-04 Thread Noah Kantrowitz
ttps://mail.python.org/mailman/listinfo/distutils-sig > > I believe MvL owns PyPISSH and it has an issue tracker under his account > on bitbucket.org. Obligatory reminder that we (I) have no intention of supporting pypissh as we move into the Era of Warehouse. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org https://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] pypissh

2013-09-04 Thread Noah Kantrowitz
On Sep 4, 2013, at 11:33 AM, Antoine Pitrou wrote: > Noah Kantrowitz coderanger.net> writes: >> >> Obligatory reminder that we (I) have no intention of supporting pypissh as > we move into the Era of Warehouse. > > Really? So what will be the options to upload fi

Re: [Distutils] pypissh

2013-09-04 Thread Noah Kantrowitz
ng opensshd with some authorized_keys trickery is what the infra team is declining to support long term. Something built around Twisted's SSH server impl (for example) could be a suitable replacement since that would be secure by default as opposed to the current system where any failure on our pa

[Distutils] Decommissioning last.pypi.python.org

2013-09-05 Thread Noah Kantrowitz
to be redirected. If you are doing something outside of pip using the autodiscovery protocol, now would be the time to fix it. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@pytho

Re: [Distutils] Remove the "Mirror Authenticity" API

2013-09-28 Thread Noah Kantrowitz
+1 --Noah On Sep 28, 2013, at 8:05 PM, Donald Stufft wrote: > I believe we should remove the /serverkey and /serversig/* API's from PyPI. > > * I am not aware of *any* implementation that actually verifies packages > against this API > > * In the light of PEP44

Re: [Distutils] Deprecate and Block requires/provides

2013-10-17 Thread Noah Kantrowitz
ever we decide, not that it should actually be an ill-defined time period) it becomes a fatal error. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org https://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] Deprecate and Block requires/provides

2013-10-17 Thread Noah Kantrowitz
On Oct 17, 2013, at 3:50 PM, Nick Coghlan wrote: > > On 18 Oct 2013 04:48, "Donald Stufft" wrote: > > > > On Oct 17, 2013, at 2:33 PM, Noah Kantrowitz wrote: > > > > > > > > On Oct 17, 2013, at 9:26 AM, Michael Foord wrote: > > >

Re: [Distutils] PyPI pull request

2013-10-27 Thread Noah Kantrowitz
Warehouse is the internal project name, and will be just one software component of the service collectively known as PyPI. That said, Donald started it so by law of the jungle he can call it whatever he wants as long as I don't get phone calls from the FBI. --Noah On Oct 27, 2013, at 10:

Re: [Distutils] PyPI pull request #7

2013-10-30 Thread Noah Kantrowitz
Please stop submitting pull requests. Development on the existing codebase is halted except for critical fixes or security issues. You are making extra work for people on this list and it will not be tolerated. Please consider this your final warning. --Noah On Oct 30, 2013, at 1:07 PM

Re: [Distutils] PyPI pull request #7

2013-10-31 Thread Noah Kantrowitz
On Oct 31, 2013, at 4:32 AM, anatoly techtonik wrote: > On Wed, Oct 30, 2013 at 11:11 PM, Noah Kantrowitz wrote: >> Please stop submitting pull requests. Development on the existing codebase >> is halted except for critical fixes or security issues. You are making extra >&g

Re: [Distutils] pip on windows experience

2014-01-23 Thread Noah Kantrowitz
unds very similar to the issues with Linux binary wheels and varying system ABIs. Should probably keep in mind for any solution that might apply to both. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org https://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] wheels on sys.path clarification (reboot)

2014-01-29 Thread Noah Kantrowitz
ld not depend on it. Under no circumstance should we document this as "well it works right now" without guidance about the fact that it isn't part of the spec and is _not_ a candidate for future design decisions. If someone would like to propose amending the spec that can

Re: [Distutils] PEP 427

2014-01-29 Thread Noah Kantrowitz
ate the necessary sys.path > basing on the wheel requirements.txt and then my program wheel should have an > entry point like __main__.py > > As Nick pointed out the wheel is a superset of the egg - so I assume wheels > can be executable, correct? How do i achieve that? Wheel is a pack

Re: [Distutils] wheels on sys.path clarification (reboot)

2014-01-29 Thread Noah Kantrowitz
On Jan 29, 2014, at 8:50 PM, Tres Seaver wrote: > Signed PGP part > On 01/29/2014 06:55 PM, Noah Kantrowitz wrote: > > > If you are going to document this, and it is not going to be > > explicitly supported by the spec (it isn't), the _only_ logical thing >

Re: [Distutils] Using Wheel with zipimport

2014-01-30 Thread Noah Kantrowitz
he next text you can find it at http://www.python.org/dev/peps/pep-0427/#is-it-possible-to-import-python-code-directly-from-a-wheel-file I hope we can discuss further changes as a group before they are pushed live. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail _

Re: [Distutils] PEX at Twitter (re: PEX - Twitter's multi-platform executable archive format for Python)

2014-02-01 Thread Noah Kantrowitz
good reason) *.pth files actually have > a legitimate use case in allowing API compatible versions of packages > to be shared between multiple virtual environments - you can trade > reduced isolation for easier upgrades on systems containing multiple > virtual environments by adding a

Re: [Distutils] PEX at Twitter (re: PEX - Twitter's multi-platform executable archive format for Python)

2014-02-01 Thread Noah Kantrowitz
On Feb 1, 2014, at 1:36 AM, Vinay Sajip wrote: > On Sat, 1/2/14, Noah Kantrowitz wrote: > >> In all but a tiny number of cases, you could use a symlink for this. >> Much less magic :-) > > That's "POSIX is all there is" myopia, right there. While rec

Re: [Distutils] PyPI Rate Limiting

2014-02-08 Thread Noah Kantrowitz
API servers aim for response times in the > single to low 10's of ms digits... What is the 95% percentile for PyPI > to answer these problematic APIs ? > If you are making lots of sequential requests, you should be putting a sleep in there. "as fast as possible" isn't a

Re: [Distutils] PyPI Rate Limiting

2014-02-09 Thread Noah Kantrowitz
On Feb 9, 2014, at 1:13 AM, Robert Collins wrote: > On 9 February 2014 19:28, Noah Kantrowitz wrote: >> >> On Feb 8, 2014, at 6:25 PM, Robert Collins wrote: >> > >>> 5/s sounds really low - if the RPC's take less than 200ms to answer >>&g

Re: [Distutils] PyPI Rate Limiting

2014-02-10 Thread Noah Kantrowitz
On Feb 10, 2014, at 1:48 AM, Chris Jerdonek wrote: > On Sun, Feb 9, 2014 at 12:16 PM, Noah Kantrowitz wrote: >> >> On Feb 9, 2014, at 1:13 AM, Robert Collins wrote: >> >>> On 9 February 2014 19:28, Noah Kantrowitz wrote: >>>> >>>> O

Re: [Distutils] Pycon

2014-03-28 Thread Noah Kantrowitz
On Mar 28, 2014, at 12:06 PM, Daniel Holth wrote: > Who is going to pycon? I will be there. Attending and presenting a talk that can tl;dr'd as a summary of the last 18 months of this list. --Noah signature.asc Description: Message signed with OpenPGP using

Re: [Distutils] "pip install -e ." vs. "python setup.py develop"

2014-04-06 Thread Noah Kantrowitz
You should recommend using pip for it, mostly because as you said that will work even with packages that don't use setuptools :-) It also is required when doing a develop install with extras, though that requires a slightly more verbose syntax due to a bug in pip. --Noah On Apr 6, 2014,

Re: [Distutils] setup.py should use if __name__ == '__main__', right?

2014-04-06 Thread Noah Kantrowitz
setup.py is not intended to be importable, so it has no "import time". Pretty sure I've never seen this patten used in a setup.py, nor would I think it has much semantic utility. --Noah On Apr 6, 2014, at 8:04 PM, Asheesh Laroia wrote: > Hi nice distutils/PyPA people, >

Re: [Distutils] "pip install -e ." vs. "python setup.py develop"

2014-04-13 Thread Noah Kantrowitz
On Apr 11, 2014, at 1:29 PM, Chris Withers wrote: > On 07/04/2014 04:05, Noah Kantrowitz wrote: >> You should recommend using pip for it, mostly because as you said that will >> work even with packages that don't use setuptools :-) It also is required >> when do

Re: [Distutils] Need for respect (was: PEP 438, pip and --allow-external)

2014-05-14 Thread Noah Kantrowitz
e far far far in the minority of people that think this is what PyPI is. It was this at one point, but few old-timers are still around to remember those days and new users have very different expectations driven by the cites linux package servers/systems as well as tools like rubygems a

Re: [Distutils] Need for respect (was: PEP 438, pip and --allow-external)

2014-05-14 Thread Noah Kantrowitz
On May 14, 2014, at 1:26 PM, "M.-A. Lemburg" wrote: > On 14.05.2014 21:48, Noah Kantrowitz wrote: >> >> On May 14, 2014, at 12:44 PM, "M.-A. Lemburg" wrote: >> >>> PyPI is still mainly the Python registry for mapping package >>> nam

Re: [Distutils] Support for multiple PyPI publishing identities is rather convoluted

2014-06-01 Thread Noah Kantrowitz
y. You can use a single account, and for the community project just grant multiple people access. --Noah signature.asc Description: Message signed with OpenPGP using GPGMail ___ Distutils-SIG maillist - Distutils-SIG@python.org https://mail.python.org/mailman/listinfo/distutils-sig

Re: [Distutils] Support for multiple PyPI publishing identities is rather convoluted

2014-06-01 Thread Noah Kantrowitz
On Jun 1, 2014, at 12:30 PM, Paul Sokolovsky wrote: > Hello, > > On Sun, 1 Jun 2014 12:10:01 -0700 > Noah Kantrowitz wrote: > >> >> On Jun 1, 2014, at 8:02 AM, Paul Sokolovsky wrote: >> >>> Hello, >>> >>> My usecase is: I work

Re: [Distutils] pypi suggestion

2014-06-02 Thread Noah Kantrowitz
Step one, define "popular" in numeric terms. --Noah On Jun 2, 2014, at 2:37 PM, John Smith wrote: > pypi really needs a way to sort packages by popularity. Sorting by other > factors, such as author, code size, pure python/compiled, etc would be a > bonus, But so

Re: [Distutils] Looking for a presentation on Egg

2007-07-04 Thread Noah Gift
That is a good presentation! I found this too: http://us.pycon.org/TX2007/PythonEggsCreation . I remember going to the egg talk at PyCon this year, but I don't remember if there were slides or not? On 7/4/07, Andreas Jung <[EMAIL PROTECTED]> wrote: --On 2. Juli 2007 09:45:00 -0500 Ian Bick

Re: [Distutils] Prototype setuptools-specific PyPI index.

2007-07-23 Thread Noah Gift
uld be the final straw for some new programmer to Python! Noah Gift ___ Distutils-SIG maillist - Distutils-SIG@python.org http://mail.python.org/mailman/listinfo/distutils-sig

  1   2   >