Re: V4 Pre-PEP: transition to release-file hosting on PYPI

On Mar 15, 2013, at 11:15 AM, PJ Eby <[email protected]> wrote:

> Do we even need the internal/external rel info?  I was planning to
> just use the URL hostname.
> 
> i.e., are there any use cases for designating an externally-hosted
> file internal, or an internally-hosted file external?  If not, it
> seems the rel="" is redundant.
> 
> It's also more work to implement, vs. just defaulting --allow-hosts to
> be the --index-url host; a strategy ISTM pip could also use, since it
> has the same two options available.
> 
> Also, if we're not doing homepage/download crawling any more, I was
> hoping we could just drop the code that 'parses' rel="" links in the
> first place, as it's an awkward ugly hack.  ;-)
> _______________________________________________
> Catalog-SIG mailing list
> [email protected]
> http://mail.python.org/mailman/listinfo/catalog-sig

It makes things uglier for end users if you have packages and the simple index hosted on several sites. It also just adds extra information so if setuptools/easy_install wants to just use the host case that wouldn't be bad.

It's actually more defensible to keep the service (ala PyPI/simple index) and the user uploaded content (ala distribution files) hosted on separate domains as it makes things like gifar style attacks harder to execute. Making a move like that would break mirroring ATM on PyPI but it's good information to include on the simple index to make it simpler for tools to determine what links are internal and what are external. 

FWIW Crate has the uploaded files on an external domain for just this reason. (Also for CDN reasons but that's because a SSL CDN is $$$$).


-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

_______________________________________________
Catalog-SIG mailing list
[email protected]
http://mail.python.org/mailman/listinfo/catalog-sig

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)

iQIcBAEBAgAGBQJRQzyeAAoJEG48vOkzctz6MS0QAK+PRW/TxVdrR8XUzW4VNksh
Fyyyo9ewhPu+pR0VBuSoAG4ddJ9Zp0d9Q5QYYTq6X+486RNSvL9tG7F1CWbQF5h4
UVZyOIgvUBWkSQPtbkrKNQZmP9opHRafrbOGVHkZaFrBi9Cc8kXZMEjduiPgbLC0
zuVvaLeBtLeIHtOFzO328+rN/kCXiJyv9U61EPGceLHF89bQefsVV8US/pu2yl2V
4KjjahAHKLMw5SBCAfd9ekmDWjROX/el9DUtLGQ0XrpvDT5at91yoFFg+DZfZgR9
tElZADWTOgmVio42JzcmDCkOlRocnclTesw5VPq20ToPWx+hCmIhL7idu1ZmeTb/
1u4bBBeXER3kAVnB/WS/M0vbofZ2c9J2RqQYNWT6v2wuodv9Nzzkc17H+n5Zgs7e
DajmhGoGfx2W/XhiDDv8cUGOSGzUWMBmSXFg1oux1rpk7nx2NCdH4vxZGVxcc1ee
QERDfyaJoqATHMEGq2BXXusAWaJR7uEqwQ8mcsjs+CHYZ3l8d2nun5c5KOlrogzz
Fl3GO3zoO8A2KmGvwNqiaNpYWLQS+6XH89NkCZ/oWKbH0F5QwB/D6h5GOs0sLT0f
fuaanvcFZqyd3R+tay7ZqH+np+dIulJ8hrl/0bHd5kQky9iEiLYWcK45iiI5q0tx
arJRDKI8O4hwYTixL2LO
=2+2g
-----END PGP SIGNATURE-----