Hiển thị các bài đăng có nhãn pypi. Hiển thị tất cả bài đăng
Hiển thị các bài đăng có nhãn pypi. Hiển thị tất cả bài đăng

Commencing Security, Accessibility, and Internationalization Improvements to PyPI for 2019

           No comments   

The Python Software Foundation (PSF) and PSF Packaging Working Group are excited to announce that the first round of slated improvements to PyPI for 2019 are underway. This Open Technology Fund funded project will bring improvements to the accessibility and security of the service. You can read more about the scope of this project in our request for proposals document.



We are excited to have two returning contractors from the MOSS funded work that brought the full rewrite of PyPI into production.




Kabu Creative



Responsible for the user interface and user experience of PyPI, Kabu Creative will be fulfilling those aspects of new features for the project. Additionally, we are excited for their work on auditing and improving the accessibility of PyPI's web user interface.




Changeset Consulting, LLC



With experience in project management, communications, and contributions for projects and teams across the realm of open source, Changeset Consulting will be responsible for helping to lead the project to completion. Along the way Changeset Consulting will also be performing reporting, communications, and outreach to help keep the Python community up to speed on how the project is progressing.





We are also welcoming a new contractor to the team to complete this project.





Trail of Bits



Bringing their experience securing organizations and products, Trail of Bits will be handling the backend development related to the security milestones of the project, as well as the backend development necessary for implementing internationalization of the PyPI user interface.








The PSF looks forward to sharing more here as features are developed and deployed to PyPI. Subscribe to pypi-announce for announcements of big changes to PyPI, and follow this blog for updates as the work progresses.

Warehouse: All New PyPI is now in beta

           No comments   



  1. Context

  2. Migrating

    1. New PyPI Features

    2. Deprecations

  3. Future Plans

  4. Security

  5. Please test!

    1. Workflows

  6. IRC/Twitter livechat hours

  7. Contact us



The all new Python Package Index is now in beta at pypi.org. We predict the full switch will happen in April 2018 (roadmap), so here's a heads-up about why we're switching, what's changed, and what to expect. To get an email when the new site replaces the old one, please sign up for the low-traffic PyPI announcements email list.

    Context



    The legacy PyPI site at pypi.python.org started in the early 2000s, before modern web frameworks. The legacy codebase has made it hard to maintain and even harder to develop new features, even as past maintainers put in tremendous effort to continuously reduce outages.



    The new PyPI at pypi.org (codebase: Warehouse) looks more modern, and is up-to-date under the hood too. A modern web framework (Pyramid), 100% backend test coverage, and a Docker-based development environment make it easier for current and new developers to maintain and run it and add features.



    Thanks to Mozilla's Open Source Support funding, we have designed and added new features, overhauled infrastructure, and worked towards redirecting traffic to the new site and shutting down the old one. The full switch will include redirecting browser and pip install traffic from the old site; then, sometime in late April or early May, the legacy site will be entirely shut down.





    Migrating



    You may not need to change anything right away. Thanks to redirects, your sites, services, and tools will probably be able to seamlessly switch to the new site.



    Users: On Windows and Linux, no change is necessary as long as your version of OpenSSL supports TLSv1.2. pip install should work as normal. macOS/OS X users running version 10.12 or older need to upgrade to the latest pip (9.0.3) to connect to PyPI securely:





         curl https://bootstrap.pypa.io/get-pip.py | python



    Package maintainers: If you use setup.py upload to upload releases, we recommend you switch to Twine. New PyPI takes the same username/password as legacy PyPI did. If you have problems, follow the packagers' migration guide.



    API users: follow the API users' migration guide.



    If you're affected by a deprecation (below), you should adapt and migrate by early April 2018. For help, come to a livechat or contact us. Sign up for the low-traffic PyPI announcements email listto get a heads-up when we have a more precise date.





    New PyPI Features

    • mobile-responsive UI  

    • chronological release history for each project (example)  

    • easy-to-read project activity journal for project maintainers  

    • better search and filtering  

    • support for multiple project URLs (e.g., for a homepage and a repo)  

    • support for Markdown READMEs for source distributions (soon: wheels too)  

    • user-visible Gravatars and email addresses for maintainers  

    • no need to "register" a project before initial upload  

    • better accessibility (and more work to come)  

    • newer backend infrastructure, supporting new features and a more scalable PyPI  





    Deprecations



    Things that already have gone away (sometimes for policy or spam-fighting reasons) include:



    Things that will go away once legacy PyPI shuts down:



    Late 2018 or later:





    Future plans



    See our issue tracker. Includes:



    For updates, please sign up for the low-traffic PyPI announcements email list.



    Security



    If you find any potential security vulnerabilities, please follow our published security policy. Please don't report security issues in Warehouse via GitHub, IRC, or mailing lists. Instead, please directly email the security team.





    Please test!



    The point of the beta is to find and fix bugs. Please help us. Most of these workflows you can test on pypi.org, using the same login as you use on pypi.python.org (legacy PyPI). For testing destructive actions, like removing an owner, deleting a project, or deleting a release, please use test.pypi.org.





    Workflows



    Package users:

    • Register/confirm a new user  

    • Login/logout  

    • Reset password  

    • Search for projects  

    • pip install a package  

    • Download release files via browser  

    • Call JSON, RSS, Simple, and XML-RPC APIs  



    Project maintainers:

    • Add/remove a maintainer  

    • Add/remove an owner  

    • Transition ownership  

    • Remove a project  

    • Remove a release  

    • View journals for a project  

    • View journals for a release  

    • Upload a new release (source distribution and wheel; upgrade your versions of twine and setuptools first)  

    • Confirm display of project description, release history, download files, project links, maintainers, tags, and classifiers (example)  





    IRC/Twitter livechat hours



    Warehouse developers will be in IRC, in #pypa-dev on Freenode, and on Twitter (#newpypi), available to talk about problems you run into, or about how to hack on Warehouse:

    1. Tuesday, March 27th, 9am-10am PDT, noon-1pm EDT, 18:00-19:00 CEST, 9:30pm-10:30pm India, 16:00-17:00 UTC  

    2. Friday, March 30th, 10-11am EDT, 16:00-17:00 CEST, 7:30pm-8:30pm India, 14:00-15:00 UTC  

    3. Tuesday, April 3rd, 8am-9am PDT, 11am-noon EDT, 17:00-18:00 CEST, 8:30pm-9:30pm India, 15:00-16:00 UTC  

    4. Thursday, April 5th, 5pm-6pm PDT, 8pm-9pm EDT, (April 5th) 8am-9am Manila, (April 5th) 10am-11am Melbourne, (April 5th) 0:00-1:00 UTC  



    Feel free to drop in! (By participating, you agree to abide by the PyPA Code of Conduct.)





    Contact us





    (By participating, you agree to abide by the PyPA Code of Conduct.)



    Thank you for using PyPI!



    Tobacco Warehouse in Louisville, Kentucky 1906


    Python package maintainers, help test the new PyPI!

               No comments   





    Warehouse is a next-generation Python Package Repository which will replace the existing code base that currently powers PyPI. (See the source code on GitHub, and roadmap for details.) We are seeking maintainers of projects on PyPI to test it and send us bug reports, and we're seeking new contributors to Warehouse.



    Since Warehouse must be a reimplementation of the existing PyPI, please focus initially on any differences, missing features, or incorrect behavior that is exhibited on pypi.org that affect your workflows for account management and package maintainership. We'll be soliciting feedback on other concerns soon! Feedback on user experience, accessibility, and overall ease of use are welcome. Go to the pre-production deployment at pypi.org and try it out!






    Background




    Last year, the PSF's Packaging Working Group successfully applied for a grant from Mozilla's Open Source Support program. Mozilla awarded USD 170,000 to get PyPI upgraded. The team's been working since early December—see our progress reports and roadmap—and pypi.org now has the essential features that package maintainers, and most other users, need.







    Guidelines for Particpation




    By participating, you agree to abide by the PyPA Code of Conduct.

    You should sign up for the PyPI Announcement Mailing List for updates.






    Things to test




    Most of these you can test on pypi.org, using the same login as you use on pypi.python.org (legacy PyPI). For testing destructive actions, like removing an owner, deleting a project, or deleting a release, please use test.pypi.org, which has an entirely separate package index.






    Workflows






    • Add/Remove Maintainer

    • Add/Remove Owner

    • Transition Ownership

    • User Registration and Confirmation

    • Login/Logout

    • Password Reset

    • Remove a project

    • Remove a release

    • View Journals for a Project

    • View Journals for a Release




    Warehouse has handled new projects and new release uploads since last summer, so those workflows are not the most important to test now. The list of workflows above are the ones we request you to exercise.






    Security




    If you find any potential security vulnerabilities, please follow our published security policy. Please don't report security issues in Warehouse via GitHub, IRC, or mailing lists. Instead, please directly email one or more of our maintainers.






    IRC livechat hours




    Warehouse developers will be in IRC, in #pypa-dev on Freenode, and available to talk about problems you run into, or about how to hack on Warehouse:


    1. Tuesday Feb 27th: 1700 UTC / noon-1pm EST

    2. Tuesday Feb 27th: 2300 UTC / 6pm-7pm EST

    3. Thursday March 1st: 1700 UTC / noon-1pm EST

    4. Thursday March 1st: 2300 UTC / 6pm-7pm EST


    Feel free to drop in!






    Notice




    We're working hard on nearly every aspect of the Warehouse codebase to get it ready for production deployment and we are shipping features nearly every day, so check back and maybe even try using pypi.org for your maintainer activities full time. Due to the rate of change some errors, downtime, and outright broken features may occur. We have some automated reporting of the scenarios in place, but let us know!



    Reminder: Sign up for the PyPI Announcement Mailing List to be kept in the loop as we continue this process.






    Dive into the code




    We've improved Warehouse's developer experience substantially in the last few months. We have several open "good first contribution" issues and a guide to getting started. One of our maintainers, Ernest W. Durbin III, wants to help you dive in and to give you Warehouse stickers, and has 30-minute 1:1 slots available to mentor you. We'll also be running a sprint at PyCon North America in May!






    Contact us







    Thank you for testing Warehouse! You're helping us launch sooner and future users of PyPI will appreciate it.



    — The PyPI Team






    Photo © Mark Hunter

    The PSF awarded $170,000 grant from Mozilla Open Source Program to improve sustainability of PyPI

               No comments   

    When are we finally going to see Warehouse deployed? What's the holdup? Has this project stalled?



    For the last year, we at the Python Packaging Authority have heard these questions continuously from the Python community.



    Today we are excited to announce that we have applied for, and been awarded, a grant to help improve the sustainability of the Python Package Index in the amount of $170,000.  This has been awarded by Mozilla, through the Foundational Technology track of their Open Source Support Program.  We would like to thank Mozilla for their support.



    This post will explain both the context for this request, and the work that will be funded.

    Specifically, this grant funds several contributors' efforts to finish the development and deployment of Warehouse (pypi.org), the replacement for our legacy codebase that runs pypi.python.org -- which will allow more people to contribute.




    Background





    The Python Packaging Index (PyPI) is the principal repository of software packages for the Python programming language. Currently, over 100 million Python packages are downloaded from PyPI every week. The Python community (and indeed the wider technical community) depends on PyPI for the ongoing functioning of the entire Python ecosystem.



    There are no paid staff at the PSF who work on PyPI, and there are only a handful of people who contribute regularly.  This leads to a situation where we have to depend on volunteers to be on-call for outages and respond to critical security vulnerabilities in core Python Infrastructure. For deeper context, read PyPI maintainer Donald Stufft's May 2016 post "Powering the Python Package Index", (but note that since his job change in the last year his paid time to work on PyPI has decreased significantly).



    This isn't a tenable situation for the long term, and we hope that this grant will help us start to change this.




    Developer Sustainability




    Unfortunately, the codebase that runs PyPI is old, almost entirely lacking in automated test coverage and other common best practices. (PyPI contributor Ernest W. Durbin III goes into this further in his PyGotham 2017 talk "Running Vintage Software: PyPI's Aging Codebase.") The new Warehouse code base is built with Pyramid, and is much easier to maintain. This technical debt has a number of undesirable outcomes, but the one I'd like to focus on is repelling new contributors.



    Eric Holscher, like many would-be contributors to the legacy PyPI codebase, once tried to contribute a small feature to PyPI years ago, thinking it would be quite simple. However, as he opened the code base and started looking around, he discovered that the code wasn't written in a modern framework, didn't follow standard conventions or best practices, and he could barely even understand where to start adding something new.



    Migrating PyPI to a new codebase will stop this from happening. We hope to gain a number of new contributors who are willing and able to help maintain the code base, and decrease the chance of burnout for the staff.




    Operations Sustainability




    Operations are the other large sustainability issue that we're hoping to tackle with this grant. There are only two people currently who wear a pager and are on-call for PyPI. They are not currently supported by modern automation tools or served by a continuing project manager. Once all package index activity is going through pypi.org (Warehouse) and we deprecate the old pypi.python.org codebase and site, with a stabilized infrastructure resource load, we can assess our new level of staffing and hosting needs. Based on that assessment, we'll be able to fundraise for staffing and ask our sponsors for financial and in-kind donations to keep PyPI robust.




    Next Steps




    With the help of many people (especially the Packaging Working Group, our MOSS liaison Gervase Markham, our Mozilla champion Dan Callahan, and Ewa Jodlowska and Mark Mangoba at the PSF), we've been figuring out the timeline for this work.



    The first milestone for Warehouse is redirecting portions of the production pypi.python.org to Warehouse including traffic for the simple index and package downloads. At that milestone Warehouse will be the main entryway to Python packages for all but a small fraction of the interactions PyPI sees.



    The bulk of the work will be bringing Warehouse to feature parity with the administrative capabilities users need from the Package Index.  We'll keep you posted as we figure out when you can expect that to be true.



    Please feel free to ask questions about the Warehouse project in the #pypa-dev channel on Freenode, or in the GitHub issues for Warehouse! If you have questions for the PSF about the grant, you can ask via email.



    Thanks to Donald Stufft, Ewa Jodlowska, Nathaniel J. Smith, Nick Coghlan, Nicole Harris, Sumana Harihareswara, Ernest W. Durbin III, Dustin Ingram, Mark Mangoba, Kenneth Reitz, Eric Holscher for contributing to this post.

    Postscript to Warehouse Post!

               No comments   

    Yesterday’s post described an important development project currently being undertaken by the PSF called Warehouse. This will redevelop and improve the Python Package Index, PyPI. I wanted to let you know about a particular issue that the developers are currently trying to solve–that of translation into languages other than English.
    Yesterday, Donald Stufft wrote to the PSF community mailing list, soliciting help from Pythonistas with experience and knowledge in non-English coding, translating, teaching, or other relevant expertise.
    The desire is to support translations of the PyPI UI (user interface). Most, but not all, PyPI content is in English, which typically isn’t and shouldn’t be a problem. But the UI aspires to be more welcoming to folks who either are not native English speakers, or may not speak English at all.
    The current translation engine for PyPI is L20n.js, but the drawback is that this client-side engine only supports more modern evergreen browsers–those which continually and automatically update. There may be users who have older browsers, especially in non-English speaking parts of the world. 
    One possible solution is to write a server-side implementation of L20n, i.e., to port it to Python. But this solution would involve taking development time away from Warehouse itself, as well as losing some beneficial features of client-side translation. Another possibility is to switch to Gettext, which PyPI had been using previously, but this solution is also considered less than ideal. 
    If you can help with this issue, or would like to be better informed, please visit:
    I would love to hear from readers. Please send feedback, comments, or blog ideas to me at msushi@gnosis.cx.

    Welcome to the Warehouse!

          , , , ,      No comments   



    Warehouse is the new codebase being developed to power the Python Packaging Index (PyPI). Python developers and users already know that PyPI is the official comprehensive repository of third-party open source Python packages (see Wikipedia). PyPI, maintained by the PSF, is where developers publish their software modules and from which package managers, such as pip, download packages. Given the important role played by PyPI, the Warehouse project is bound to have a huge impact on the continued use and growth of Python. 


    While many volunteers have been working on the project, the biggest contributions have come from lead developer Donald Stufft and web-design specialist, Nicole Harris. Donald, based in the US, is a core contributor to PyPI (as well as to CPython, pip, virtualenv, Django & Cryptography), while UK-based Nicole runs a web development business, Kabu Creative.


    The design goals, as stated on Nicole's website, were:




    • To update the visual identity 

    • To make packages more discoverable

    • To accommodate the needs of both users and package maintainers 

    • To give the project the same level of professionalism as a commercial project of the same scale 

    • To ensure that the user experience reflects the Python community–a community that is welcoming, helpful and inclusive



    Donald and Nicole have recently released a first look at the new design on the demo sites, Warehouse and Warehouse staging.


    Looking great, thanks to Donald and Nicole's hard work, but there is plenty more to be done: writing code, writing the user guide (PyPUG), usability testing, and giving feedback. Details on how to volunteer and more info can be found on Nicole's site.


    I would love to hear from readers. Please send feedback, comments, or blog ideas to me at msushi@gnosis.cx.


    Popular Posts

    Maxon CINEMA 4D Studio R19.024 Free Download

    Download Maxon CINEMA 4D Studio R19.024 Free latest version offline setup for Microsoft Windows 7, 8, 10, XP, Vista. Maxon CINEMA 4D Studio ...

    Tìm kiếm Blog này
    Được tạo bởi Blogger.

    Nhãn