Re: V3 PEP-draft for transitioning to pypi-hosting of release files

On Mar 13, 2013, at 10:26 AM, PJ Eby <[email protected]> wrote:

> On Wed, Mar 13, 2013 at 7:21 AM, holger krekel <[email protected]> wrote:
>> Hi all,
>> 
>> after some more discussions and hours spend by Carl Meyer (who is now
>> co-authoring the PEP) and me, here is a new V3 pre-submit draft.
>> It is now more ambitious than the previous draft as should be obvious
>> from the modified abstract (and Carl Meyers and Philip's earlier
>> interactions on this list).  There also are more details of how
>> the current link-scraping works among other improvements and incorporations
>> of feedback from discussions here.
>> 
>> We intend to submit this draft tonight to the PEP editors.
>> 
>> Feedback now and later remains welcome.  I am sure there are issues to
>> be sorted and clarified, among them the versioning-API suggestion by
>> Marc-Andre.
>> 
>> Thanks for everybody's support and feedback so far,
>> holger
> 
> Looks good to me!
> 
> Setuptools' two releases will probably look like this:
> 
> 1. Default to externals index, warn when fetching URLs that are not
> the same host as the index
> 2. Default to externals index, reject URLs that are not the same host
> as the index unless --allow-hosts is configured  (IOW, default
> allow-hosts to equal index-url host)
> 
> That way, external URLs can still be discovered by the user, but the
> default configuration is still secure.
> _______________________________________________
> Catalog-SIG mailing list
> [email protected]
> http://mail.python.org/mailman/listinfo/catalog-sig


For the record I support the PEP and these 2 steps sound ok to me.

My only suggestion is an additional rel attribute for indexes to indicate this is index hosted file incase the index domain and the package host domain differ (as is the case with Crate).

-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

_______________________________________________
Catalog-SIG mailing list
[email protected]
http://mail.python.org/mailman/listinfo/catalog-sig

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)

iQIcBAEBAgAGBQJRQLObAAoJEG48vOkzctz6mBwP/3lgmuRDaylUeH1Cqxtg6g02
h9kib52WTdAg6ZYlpYunjuL2DUBvatPz6gfCNusv1WVYRNOEtfzxyVqmhdB0w9XL
hwnyhk5IdoX8iv4DC2INDenQVLCkU81kal13egVrr9DCtHY65p0iomTZ2upIAAMx
BSXZLq8QZWeFLRCTbSvB9+ghsTdijyKyZtg43pY84UcmvnG8YrBWf4REUsHLHOIo
G+0tj2QU2CR6qcBDy3h2aXEQH+qXmSY4gLvCbTaUNOMM1oL0Nb9s0Bo+5hP8vEWn
Jthi3FYTiqn8pvGMPpT54jfdkZD1i14RnkLR7981DG1TUu038rvfh3CdLvFmKFaK
ZdZLlcq7JQEcwLnIO2Rz04NRylGkgIsUW/+8LPwZkgoZsAYAD3O4Go+Da2Bn+Tm3
fy6+FxlsfGl9i038WEaqqNazbrHnRgiy3NiPNe/bYpIeDPROkMchjLz6ulyPVjcn
b2f7cYOHJF0f+RnJKKHQWeRU6PtY8j4zRJ8670WlSm11es/Ggse3F20k0goIA+fZ
Iw7cRthhtpdf/1y22tUJnsZV0WfeM1oDtvyYZ94tK7uEkpYjZDORXrbFqBpe5EgP
rhwMDcsbnOvhSmJNbGq7ryKquSp8Sj8JeMCz74J+Zw8xJ9DIl6wSivAQ/25byOLX
yY+VHG387KSdrC/+hLF0
=5kdh
-----END PGP SIGNATURE-----