Differences between revisions 21 and 39 (spanning 18 versions)
Revision 21 as of 2019-07-22 20:01:19
Size: 10971
Comment: Pradyun and pip
Revision 39 as of 2020-06-05 22:32:24
Size: 808
Comment: moved to GitHub
Deletions are marked like this. Additions are marked like this.
Line 3: Line 3:
This page lists specific things that The [[https://github.com/psf/fundable-packaging-improvements|Fundable Packaging Improvements repository]] lists specific things that
Line 9: Line 9:
<<TableOfContents(3)>> That list [[https://wiki.python.org/psf/Fundable%20Packaging%20Improvements?action=info|was previously on this wiki page]] and has now been moved [[https://github.com/psf/fundable-packaging-improvements|to GitHub]].
Line 11: Line 11:
== Foundational tool improvements ==

=== Finish dependency resolver for pip ===
We're partway through a next-generation rewrite of the dependency resolver within pip, Python's package download and installation tool. The project ran into massive technical debt, but the refactoring is nearly finished and prototype functionality is in alpha now. ([[https://docs.google.com/document/d/1x_VrNtXCup75qA3glDd2fQOB2TakldwjKZ6pXaAjAfg/edit|In-depth explanation by Sebastian Awwad of the problem & our approach]], [[https://gist.github.com/pradyunsg/5cf4a35b81f08b6432f280aba6f511eb|lead developer Pradyun Gedam's initial plan]], [[https://pradyunsg.me/gsoc-2017/|2017 status updates]], and [[https://pradyunsg.me/blog/2019/06/23/pip-update/|June 2019 status update]], [[https://github.com/pypa/pip/issues/988|GitHub issue #988 tracking progress]] and [[https://github.com/pypa/pip/issues/6536|issue #6536 for planning rollout]].)

Funding would support user experience, communications/publicity, and testing work (including developing robust testing/CI infrastructure) as well as core feature development and review.

We need to finish the resolver because so many other improvements are blocked on it:
 * [[https://github.com/pypa/pip/issues/4551|adding an "upgrade-all" command to pip]]
 * [[https://github.com/pypa/pip/issues/5497|warning when trying to download or build wheels from incompatible set of packages/requirements]]
 * [[https://github.com/pypa/pip/issues/4745|adding a no-implicit-upgrades strategy]]
 * [[https://github.com/pypa/packaging-problems/issues/264|making PyPI and pip enforce metadata compliance more strictly]]
 * [[https://github.com/pypa/pip/issues/4681|warning the user when uninstalling a package that other packages depend on]]
 * [[https://github.com/pypa/pip/issues/6495|properly respecting constraints]]
 * [[https://github.com/pypa/packaging-problems/issues/215|recording requested and installed extras]]
 * [[https://github.com/pypa/pip/issues/53|option to show what versions of packages are currently available]]
 * [[https://github.com/pypa/packaging-problems/issues/54|listing packages' dependencies and depdendents on PyPI]]
 * [[https://mail.python.org/archives/list/distutils-sig@python.org/thread/2QECNWSHNEW7UBB24M2K5BISYJY7GMZF/#2QECNWSHNEW7UBB24M2K5BISYJY7GMZF|minimizing duplication of work between pip and pipenv]]
 * [[https://github.com/pypa/pipenv/issues?q=is%3Aopen+is%3Aissue+label%3A%22Category%3A+Dependency+Resolution%22|better pipenv functionality]]
 * [[https://discuss.python.org/t/namespace-support-in-pypi/1609/35|package namespace support]]
 * [[https://discuss.python.org/t/if-python-started-moving-more-code-out-of-the-stdlib-and-into-pypi-packages-what-technical-mechanisms-could-packaging-use-to-ease-that-transition/1738/24|moving more code out of Python's standard library so we can release improvements faster]]

and it would fix so many dependency issues for our users:
 * [[https://github.com/pypa/pip/issues/4907|Django installation conflict]]
 * [[https://github.com/pradyunsg/zazo/issues/2|cherrypy/six/cheroot installation conflict]]
 * [[https://github.com/pypa/pip/issues/5043|Spyder downgrade requirement]]
 * [[https://github.com/pradyunsg/zazo/issues/4|boto3/bravado dependency failure]]
 * [[https://github.com/pypa/pip/issues/5313|Ansible/PyOpenSSL/cryptography failure]]
 * [[https://github.com/pypa/pip/issues/4957|extras installation failure]]
 * [[https://github.com/pypa/pip/issues/4391|extras upgrade failure]]
 * [[https://github.com/pypa/pip/issues/6494|breaking installed packages]]
 * [[https://github.com/pradyunsg/zazo/issues/14|elasticsearch/requests failure]]
 * [[https://github.com/ofek/hatch/issues/47|hatch, another packaging tool]]

And in our larger ecology, this causes installation problems for:
 * [[https://github.com/conda/conda/issues/8657|conda's compatibility with pip]]
 * [[https://github.com/servo/servo/issues/10611|the Servo browser engine]]
 * [[https://github.com/pypa/pip/issues/4582|numpy and scipy]]
 * [[https://github.com/juju/python-libjuju/issues/45|Canonical's DevOps tool Juju]]
 * [[https://github.com/antocuni/capnpy/issues/16|a Cap'n Proto implementation]]
 * [[https://github.com/DataBiosphere/toil/issues/2230|toil, awscli, and boto3]]
 * [[https://github.com/mozilla/bedrock/issues/5967|the Mozilla website & icalendar]]
 * [[https://github.com/certbot/certbot/issues/5195|certbot, in the past and possibly the future]]
 * [[https://github.com/TurboGears/tg2devtools/issues/13|TurboGears]]
 * [[https://github.com/pycontribs/jira/pull/744|a JIRA API client library]]
 * [[https://github.com/crossbario/autobahn-testsuite/issues/55|a WebSocket protocol test suite]]
 * [[https://github.com/gerkey/ros1_external_use/issues/7|Robot Operating System tooling]]

=== Robust interoperability testing ===

We need funding to ensure core packaging tools work well with each other; currently they aren't seamlessly interoperable. See [[https://github.com/pypa/integration-test|the integration-test project]]. This will help us get faster at testing and rolling out bugfixes and features for '''all''' [[https://packaging.python.org/key_projects/|Python packaging and distribution tools]]: well-known projects like pip, virtualenv, and wheel, but also all the downstream projects that depend on them.

=== Improve pip user experience ===

`pip`'s user experience needs to become more consistent across features, fit the user's mental model better, reduce unintended data loss, and provide [[https://github.com/pypa/pip/milestone/25|better error messages]] and prompts, logs, output, and reporting. `pip`'s maintainers have [[https://github.com/pypa/pip/milestone/10|a list of TODOs]] and need funding so that user experience researchers, UX designers, developers, and technical writers can spend dedicated time addressing them.

=== Audit and update package metadata ===

If we [[https://github.com/pypa/warehouse/issues/474#issuecomment-370986838|audit and update PyPI metadata for existing projects based on already-uploaded artifacts]], we can publish information about what packages depend on each other and on certain environments, and ensure a high-quality API for many tools to reuse and build upon. The current PyPI upload API relies on the upload client extracting the metadata and supplying it with the first upload request, and that isn't a valid assumption for older upload clients. Currently, our constraint is a combination of developer time, compute resources, and privileged backend database access; funding would break this bottleneck.

=== Package preview feature for PyPI ===

Right now, there are ways for package maintainers to test and share draft versions of their upcoming releases, but they cause friction and confusion. So we want to add [[https://github.com/pypa/warehouse/issues/726|staged releases -- a temporary state that a release can be in, where PyPI ''has'' it and can evaluate it, but hasn't ''published'' it yet]]. This will let project owners/maintainers preview how their package metadata displays on the website, and review where their fresh releases are out of compliance with site and interoperability requirements. And as we increase the packaging ecology's strictness regarding metadata standards compliance, during the intermediate period where we're warning maintainers/owners about failing strictness checks but not yet blocking releases on those new stricter checks, the package preview feature will help us provide soft warnings.

We'll need database support for understanding the release state ("is this published or not"), user experience and developer support, and testing, security, infrastructure, and project management support.

=== Feature flag system on PyPI ===

It's difficult to roll out new features gradually to PyPI's test site or to selected test users. A [[https://github.com/pypa/warehouse/issues/5869|feature flag system]] would help us do targeted outreach to particular groups of users, deploy more confidently, and roll back changes when needed. We'd need user experience, front and backend engineer, data analytics, and project management support to develop and deploy this.

=== Add pipfile support to pip ===

`pip` currently uses `requirements.txt` to specify dependencies; it can specify ''versions'' of packages but not ''hashes''. The [[https://github.com/pypa/pipfile|newer pipfile format]] can include hashes, but `pip` [[https://github.com/pypa/pip/issues/4732|doesn't yet support it]], so many users are blocked from using `pipfile` to better secure their Python runtimes. We'd need Python engineering work and project management to develop and deploy this.

=== Improve specificity of license classifiers ===

Our packaging ecosystem relies on [[https://pypi.org/classifiers/|a particular structured data format (classifiers)]] to indicate a package's legal license. However, our current system [[https://github.com/pypa/warehouse/issues/2996|allows for ambiguity that makes some downstream data display incoherent or very difficult, and doesn't allow for some license specificity that downstream consumers need]] ([[https://libraries.io/|Libraries.io]] and similar projects). Fixing this is a fairly small project, involving Python development, public communications, project management, and potentially a few hours of legal counsel for review.

== Security improvements and prerequisites ==

=== System to label projects on PyPI with administrative statuses/attributes ===

To scale up our anti-abuse moderation and help package maintainers with security response, we need to be able to, for instance, mark a release as deprecated or a project as unsupported. This means we need a generic system to add, edit, and remove administrative attributes ("flags" or "statuses") to individual projects and releases. We need support to do the architectural design to implement this. (See [[PackagingWG/2019-03-22-Warehouse|notes from this meeting]].)

=== Security notifications for vulnerable packages ===

To keep PyPI's users secure, we want to give them [[https://github.com/pypa/warehouse/issues/798|an opt-in communication channel to hear about security vulnerabilities for the packages they use]]. Implementing this would also give us architectural support to ''warn or prevent'' `pip` users who try to install a PyPI package that's been found to be broken or malware. We need funding for user experience work, development, testing, infrastructure, potentially platform services (e.g., SMS), and community outreach.
Please contact the Packaging WG to ask us to estimate how much one of these improvements would cost; we'll get back to you within a few business days.

Packaging improvements that could be funded

The Fundable Packaging Improvements repository lists specific things that

  1. the Python packaging community wants
  2. are fairly well-scoped
  3. would happen much faster if the Packaging Working Group got funding to achieve them (through donations or grants/directed gifts)

That list was previously on this wiki page and has now been moved to GitHub.

Please contact the Packaging WG to ask us to estimate how much one of these improvements would cost; we'll get back to you within a few business days.

Fundable Packaging Improvements (last edited 2020-06-05 22:32:24 by SumanaHarihareswara)

Unable to view page? See the FrontPage for instructions.