pypi/warehouse on Hacker News

…FWIW, https://pypi.org/project/bandersnatch/ is the standard tool for setting up a PyPI mirror, and https://github.com/pypi/warehouse is the codebase for PyPI itself (including the actual website, account management etc.). If "my own…

comment by zahlman · 2026-03-27 · in Telnyx package compromised on PyPI

…This means that PyPI will not accept your project metadata as you currently have it configured. See https://github.com/pypi/warehouse/issues/7136 for more details.

comment by di · 2025-09-11 · in How I solved PyTorch's cross-platform nightmare

…available to them are probably substantially less than Astral could have with a paid offering. [0] https://github.com/pypi/warehouse/graphs/contributors

comment by benrutter · 2025-08-14 · in PYX: The next step in Python packaging

…about it?) PyPI never really saw much "design" (although there is a GitHub project for the site: https://github.com/pypi/warehouse/ as well as for a mirror client: https://github.com/pypa/bandersnatch ). But an established principle now is…

comment by zahlman · 2025-07-23 · in Uv: Running a script with dependencies

…when we tried it out we found that we had other issues with developing on a Linux machine. Attempt: https://github.com/pypi/warehouse/pull/15365 Revert: https://github.com/pypi/warehouse/pull/15444 If you've got experience with making this…

comment by miketheman · 2025-05-08 · in Making PyPI's test suite 81% faster

"Roadmap for PEP 458" https://github.com/pypi/warehouse/issues/10672

comment by westurner · 2024-05-13 · in 16 years of CVE-2008-0166 – Debian OpenSSL Bug

…the path forward for PyPI. https://peps.python.org/pep-0458/ Here's the in-progress roadmap: https://github.com/pypi/warehouse/issues/10672 If there's particular issues you believe you could pick off to help achieve the goal, much…

comment by miketheman · 2023-08-08 · in PyPI Requires 2FA for New User Registrations

…and maintenance efforts. That kind of work is security work, and it's frequently thankless. [1]: https://github.com/pypi/warehouse/commits?author=miketheman

comment by woodruffw · 2023-08-04 · in PSF Hires PyPI Safety and Security Engineer

Warehouse ( https://github.com/pypi/warehouse ) uses the Apache 2.0 License, I wonder how easy it would be to set up a PaaS company to do this.

comment by amlozano · 2023-06-07 · in GitHub Packages no longer planning Python PyPI support

…of this inadequacy. "Implement "hook" support for package signature verification." (2013) https://github.com/pypi/warehouse/issues/1638#issuecomment-2... "GPG signing - how does that really work with PyPI?"…

comment by westurner · 2023-05-23 · in Removing PGP from PyPI

…this because I'm the one who made it extensible, and who's working on supporting them[1][2]. [1]: https://github.com/pypi/warehouse/issues/13551 [2]: https://github.com/pypi/warehouse/issues/13575

comment by woodruffw · 2023-05-21 · in PyPI new user and new project registrations temporarily suspended

…don't break even more of the open, free Internet that I grew up with, I'm pleading with you. [0]: https://github.com/pypi/warehouse [1]: https://dashboard.stripe.com/register

comment by ctoth · 2023-05-21 · in PyPI new user and new project registrations temporarily suspended

there are no plans to limit trusted publishers. in fact there is another in the works: https://github.com/pypi/warehouse/issues/13551

comment by ewdurbin · 2023-05-20 · in PyPI new user and new project registrations temporarily suspended

Perhaps that'll be a future blog post. Also, https://github.com/pypi/warehouse seems a good place to start.

comment by asicsp · 2023-03-22 · in Welcome to the PyPI Blog

…[2]: https://pythoninsider.blogspot.com/2019/07/pypi-now-supports... [3]: https://github.com/pypi/warehouse/issues/12465 [4]: https://www.sigstore.dev/

comment by woodruffw · 2023-02-24 · in Aggressive Attack on PyPI Attempting to Deliver Rust Executable

If you have some substantive insight about the code in https://github.com/pypi/warehouse please post your ideas in https://pypi.org/help/#feedback ;-)

comment by polotics · 2022-12-15 · in Python 3.11 Delivers

…of false positives (too many to manually review). You can see the rules we tried here[1]. [1]: https://github.com/pypi/warehouse/blob/main/warehouse/malwar...

comment by woodruffw · 2022-11-02 · in Dozens of malicious PyPI packages discovered targeting developers

Typosquatting is a thing that has been looked at and is being looked at: https://github.com/pypi/warehouse/pull/5001 - had to be reverted because it was too noisy https://github.com/pypi/warehouse/issues/9527

comment by jbylund · 2022-09-08 · in Pypi.org is running a survey on the state of Python packaging

…being implemented: https://github.com/pypa/pip/pull/11111 (just approved yesterday, not yet merged) https://github.com/pypi/warehouse/issues/8254 (been open for forever, but there has been incremental progress made. Warehouse seems to not…

comment by jbylund · 2022-09-08 · in Pypi.org is running a survey on the state of Python packaging

…need to generate API keys - you can just grant your GitHub Actions permissions to publish to PyPi. https://github.com/pypi/warehouse/issues/10619

comment by captn3m0 · 2022-07-28 · in How to create a Python package in 2022

…any secrets. [1]: https://www.sigstore.dev/ [2]: https://github.com/sigstore/sigstore-python [3]: https://github.com/pypa/warehouse/pull/10870 [4]: https://github.com/pypa/warehouse/pull/11272

comment by woodruffw · 2022-06-17 · in Bundling binary tools in Python wheels

…OIDC based authentication+authorization for package publishing. PyPi has an ongoing PR for this: https://github.com/pypa/warehouse/issues/10970 with some really great UX. You specify a repository name on GitHub and GitHub actions there get…

comment by captn3m0 · 2022-06-14 · in Making popular Ruby packages more secure

…From (an obscure comment with pictures on) "Roadmap update for TUF support " https://github.com/pypa/warehouse/issues/5247#issuecomment-9... : > Only users with package release permissions can create a new SoftwareRelease record for th

comment by westurner · 2021-11-27 · in HTTP Message Signatures

…to be correct. There's a Github thread [1] with more background info, if you're interested. [1] https://github.com/pypa/warehouse/issues/474

comment by bblommers · 2021-11-25 · in Customize Python dependency resolution with machine learning

…packaging community! [1]: https://pyfound.blogspot.com/2018/12/upcoming-pypi-improveme... [2]: https://github.com/pypa/warehouse/tree/main/warehouse/malwar...

comment by woodruffw · 2021-11-05 · in Embedded malware in RC (NPM package)

PyPI did this in 2018: https://github.com/pypa/warehouse/issues/3411

comment by di · 2021-08-24 · in The NPM registry is deprecating TLS 1.0 and TLS 1.1

In case anyone is interested, it looks like this is the implementation on the PyPI side: https://github.com/pypa/warehouse/pull/8563

comment by simonw · 2021-03-24 · in The Python Package Index is now a GitHub secret scanning integrator

…TL;DR is that it probably requires a PEP. FD: I've been working on adjacent features in PyPI. [1]: https://github.com/pypa/warehouse/issues/8254

comment by woodruffw · 2020-12-03 · in New Pip resolver takes a long time to complete

…that they don't atrophy. [1]: https://discuss.python.org/t/what-methods-should-we-implemen... [2]: https://github.com/pypa/warehouse/tree/master/warehouse/malw...

comment by woodruffw · 2020-11-13 · in Hunting for Malicious Packages on PyPI

There's now a PEP for that that seems to have had some work on it recently: https://github.com/pypa/warehouse/issues/1506 (I got an email referencing it a couple days ago from an old project I asked to take over).

comment by pydry · 2020-06-08 · in Old Code Gets Younger Every Year

…[5] https://blog.docker.com/2015/08/content-trust-docker-1-8/ [6] https://uptane.github.io/ [7] https://github.com/pypa/warehouse/issues/5247 [8] https://github.com/deislabs/cnab-spec/blob/master/300-CNAB-s...

comment by trishankdatadog · 2019-09-30 · in Small world with high risks: a study of security threats in the NPM ecosystem

…I lock myself out of my account if I lose my phone? Edit: There's a ticket already opened for that https://github.com/pypa/warehouse/issues/5800

comment by avian · 2019-05-30 · in PyPI now offers two-factor auth

…web interface, and we (Trail of Bits) will be adding support for scoped API keys for uploads. [1]: https://github.com/pypa/warehouse/pull/5795

comment by woodruffw · 2019-05-30 · in PyPI now offers two-factor auth

…2FA. So I suppose this is of limited value, at least at the moment. Relevant warehouse issue: https://github.com/pypa/warehouse/issues/994 .

comment by oefrha · 2019-05-30 · in PyPI now offers two-factor auth

…happened on the online servers) have disappeared from the UI, and that is seen as a "feature": https://github.com/pypa/warehouse/issues/3356 You can still get them through some obscure API and you still need to know the right PGP key for…

comment by zimmerfrei · 2018-06-15 · in Backdoored images downloaded 5M times removed from Docker Hub

Maintainer's response: https://webcache.googleusercontent.com/search?q=cache:vjUIkP... https://github.com/pypa/warehouse/issues/3896#issuecomment-3...

comment by jwilk · 2018-05-09 · in Backdoor in ssh-decorator package

…now that pypi.org is built on Pyramid. That's cool. :-) Some more links for anyone interested: https://github.com/pypa/warehouse https://trypyramid.com/community-powered-by-pyramid.html

comment by hathawsh · 2018-04-26 · in Flask 1.0 Released

…12 servers, OpenSSL had to be upgraded for pip to work. Maybe that's the issue you encountered? https://github.com/pypa/warehouse/issues/3411

comment by adrian17 · 2018-04-14 · in Pip 10 has been released

▲ 1

PyPi will stop displaying PGP signatures

story by ymse · 2018-03-22 · 0 comments

This broke a bunch of peoples Ubuntu 14.04 CI/CD pipelines: https://github.com/pypa/warehouse/issues/3280 It's working again now, but for a few hours there, some older versions of pip weren't working.

comment by zdw · 2018-03-16 · in Https://pypi.org load testing underway

▲ 1

Pypi.org Compatibility with pip 1.5.4 (including Ubuntu 14.04)

story by mmagin · 2018-03-16 · 0 comments

▲ 3

PyPI: Block stdlib names

story by hodgesmr · 2017-09-18 · 0 comments

▲ 1

Next Generation Python Package Repository

story by philngo · 2017-04-24 · 0 comments

I added a comment here: https://github.com/pypa/warehouse/issues/991 (For some reason there is vocal opposition to showing any popularity stats, effectively making good packages drowning in the see of not-even-updated ones.)

comment by stared · 2016-05-16 · in Powering the Python Package Index

…of the package index has been in development for some time now. Have a look at: https://pypi.io/ https://github.com/pypa/warehouse https://warehouse.readthedocs.io/

comment by gvalkov · 2016-05-16 · in Powering the Python Package Index