[tuna-general] TUNA PyPI Simple JSON API 部分包文件 (如 pystray) 元数据缺少 upload-time 字段

Fri, 05 Jun 2026 23:27:41 -0700 

您好,
在使用 PyPI 镜像时, 发现 `pystray` 缺少 upload-time 字段, 影响依赖解析工具中依赖上传时间的功能. 例如我的 `uv` 启用 `exclude-newer` 后, 需要根据每个发行文件的上传时间判断文件是否早于配置的截止时间. 当响应缺少 `upload-time`, uv 认为包不可用, 进而无法正确解析. 

```text
pystray-0.19.5-py2.py3-none-any.whl is missing an upload date
Because pystray==0.19.5 has no publish time ...
```

```bash
curl -sS \
   -H 'Accept: application/vnd.pypi.simple.v1+json' \
   https://pypi.tuna.tsinghua.edu.cn/simple/pystray/ \

   | jq '.files[] | 
select(.filename=="pystray-0.19.5-py2.py3-none-any.whl")'

```

得到结果为:

```json
{
   "filename": "pystray-0.19.5-py2.py3-none-any.whl",
   "hashes": {

     "sha256": 
"a0c2229d02cf87207297c22d86ffc57c86c227517b038c0d3c59df79295ac617"

   },
   "requires-python": null,

   "url": 
"../../packages/5c/64/927a4b9024196a4799eba0180e0ca31568426f258a4a5c90f87a97f51d28/pystray-0.19.5-py2.py3-none-any.whl",

   "yanked": false
}
```

而上游 PyPI.org 结果为

```json
{
   "core-metadata": {

     "sha256": 
"073b0620fe49a47061d336d7110779e6ca808e8294b0aa5cd9d437b1979d8fb1"

   },
   "data-dist-info-metadata": {

     "sha256": 
"073b0620fe49a47061d336d7110779e6ca808e8294b0aa5cd9d437b1979d8fb1"

   },
   "filename": "pystray-0.19.5-py2.py3-none-any.whl",
   "hashes": {

     "sha256": 
"a0c2229d02cf87207297c22d86ffc57c86c227517b038c0d3c59df79295ac617"

   },
   "provenance": null,
   "requires-python": null,
   "size": 49068,
   "upload-time": "2023-09-17T13:44:26.872081Z",

   "url": 
"https://files.pythonhosted.org/packages/5c/64/927a4b9024196a4799eba0180e0ca31568426f258a4a5c90f87a97f51d28/pystray-0.19.5-py2.py3-none-any.whl";,

   "yanked": false
}
```

且, 并非所有包都缺少上传时间:

```bash
curl -sS \
   -H 'Accept: application/vnd.pypi.simple.v1+json' \
   https://pypi.tuna.tsinghua.edu.cn/simple/requests/ \
   | jq '.files[0]'
```

```json
{
   "filename": "requests-0.10.0.tar.gz",
   "hashes": {

     "sha256": 
"210a82e678c45d433a4ad1f105974b3102a8ab5198872dc0a3238a8750d4c65e"

   },
   "requires-python": null,
   "size": 62046,
   "upload-time": "2012-01-22T05:08:17.091441Z",

   "url": 
"../../packages/62/35/0230421b8c4efad6624518028163329ad0c2df9e58e6b3bee013427bf8f6/requests-0.10.0.tar.gz",

   "yanked": false
}
```


近期供应链攻击不时出现, 在 uv 等工具中启用 exclude-newer 是缓解这类攻击对用户影响的重要方式, 
现在除了换官方源还有什么解决方案吗



--
Yours,
Ajax

--
您收到此邮件是因为您订阅了 Google 群组的“TUNA 主邮件列表”群组。
要退订此群组并停止接收此群组的电子邮件，请发送电子邮件到[email protected]。
如需查看此讨论，请访问 
https://groups.google.com/d/msgid/tuna-general/af4f4b9b-bba1-43f6-9a7e-271c601fad48%40aajax.top。



Attachment:
OpenPGP_0xC342EF3F96F5AA37.asc

Description: OpenPGP public key



Attachment:
OpenPGP_signature.asc

Description: OpenPGP digital signature






















					回复