upvote

points

by firesteelrain8 hours ago |
comments
upvoteby akerl_5 hours ago|
[-]
Are there any package managers that have that kind of publish/finalize flow?

Every one I’m aware of works either as a one-shot (you have to submit everything in one push) or lets you keep adding new assets forever (other, obviously, than PyPI with the addition of this 14 day wall).

reply
upvoteby firesteelrain5 hours ago|
parent|
next
[-]
Doesn’t that sound bizarre? I have never heard of such a thing. The builds should be immutable
reply
upvoteby akerl_3 hours ago|
parent|
[-]
No?

Again, can you think of any packages managers that have a finalize step like you’re describing?

All the package managers I’m aware of do one of two things:

1. You push once with everything baked in.

2. You push as many things as you want forever.

Python releases can sometimes have many different package files (for example, because each platform can have its own wheel), which makes the first option pretty challenging.

reply
upvoteby firesteelrain30 minutes ago|
parent|
next
[-]
My point is adding stuff to an existing version doesn’t make it immutable like it should
reply
upvoteby etbebl3 hours ago|
parent|
prev|
[-]
I'm learning here, but for option 2, besides the security risk, doesn't this create the possibility that users could get a broken/unfinished package any time they're updating to a recently "published" release? The property of releases being atomic seems very important.
reply
upvoteby akerl_3 hours ago|
parent|
[-]
Generally each artifact in the release is atomic, as is (and was) the case here.

You’ll never get served a partially uploaded wheel for amd64 Linux, but somebody could come back a year later and add a 2nd wheel to that release for a different architecture.

reply
upvoteby gred3 hours ago|
parent|
prev|
[-]
In the Java world, Maven has a "publish" step. Published artifacts (groups of files) are immutable, so publish == finalize.
reply
upvoteby akerl_3 hours ago|
parent|
[-]
That’s exactly how individual artifacts are (and were) on PyPI. This change isn’t to artifact immutability, it’s to releases (collections of artifacts)
reply
upvoteby gred3 hours ago|
parent|
[-]
Yeah, I think that's the difference. In Maven, the entire set of files which compose a release is immutable. You can't add to or remove from the set of files once you've published. You have to release a new version if you want to add anything.
reply
upvoteby akerl_1 hours ago|
parent|
[-]
Interesting. I’ve only used Maven-format repos once or twice and always via somebody’s preexisting CI tooling. Is there essentially a “draft” release that you can edit repeatedly before hitting “publish”? Is that draft release visible externally as a pre-release, or only to the author?
reply