https://github.com/pypi/warehouse/issues/5867

2FA: "trust this device for 30 days" option on PyPI.org @pypi

I opened this issue in 2019 while working on PyPI security; cool to notice folks resolving it just now!

#PythonPackaging

New blog post on user support frustration, its causes, and how we could build the "infrastructure of equanimity" in #opensource, including ideas for potential cross-project tools & practices.

https://www.harihareswara.net/posts/2023/user-support-equanimity-potential-cross-project-tools-practices-open-source/

Shout-outs to @davidism, Heidi Waterhouse, @offby1, @jacob, Nicole Harris, @bernard, + @georgia for work & conversations that I built on in this piece.

#maintainer #maintainership #FLOSS #UX #UserExperience #sustainability #ProjectManagement #Python #PythonPackaging #burnout

@brettcannon Giant congrats and thanks!

A big step towards https://github.com/pypa/packaging-problems/issues/264 "Increasing pip's & PyPI's metadata strictness". What a milestone!

#PythonPackaging

Very interesting piece from Chris Warrick about #python #PythonPackaging ... might be time for me to ditch #pipenv in favor of #pdm ? https://chriswarrick.com/blog/2023/01/15/how-to-improve-python-packaging/

Hey look, new #PyPI data! #Python #PythonPackaging

Getting close to 200K unique accounts on PyPI 👀

https://github.com/sethmlarson/pypi-data/releases/tag/2023.03.19

Need to write something about how minimum dependency versions aren't for ensuring a consumer's dependencies are free of security vulnerabilities. I feel like I would save myself at least 10 minutes a month with a URL to that.

#opensource #Python #PythonPackaging

「 The flexibility is great to have when you need it but, without a “default” workflow, it serves to create more user confusion than it resolves. It contributes to the bumpy ride reputation and to the perceived complexity 」

#Python #PythonPackaging​

「 User expectations for a “default” workflow

A class of users expect a packaging tool that provides a cohesive experience (like npm (NodeJS), cargo (Rust), gem (Ruby), pub (Dart), dotnet (C#/.NET), etc) – a single tool that provides a build system, dependency manager, publishing, running project-specific tasks/scripts, etc 」

#Python #PythonPackaging

「 Brian Skinn said recently:

You can package darn near anything in Python, even though it may take figuring out a complicated three-step-and-a-hop process to get there… and I suspect that this has been part of what’s enabled Python to grow into its “second best programming language for every task” aphorism 」

#Python #PythonPackaging​

「 Python users are not software engineers

Many of the users who write Python code are not primarily full-time software engineers or “developers”.

They are not particularly interested in this aspect of their job. They’re using Python as a tool to get their job done.

They’re not interested in the details of how the tool works, or even how complicated things are under the hood 」

Thoughts on the Python packaging ecosystem
— pradyunsg.me
#Python #PythonPackaging

https://pradyunsg.me/blog/2023/01/21/thoughts-on-python-packaging/?utm_source=pocket_mylist

https://iscinumpy.dev/post/bound-version-constraints/

In #Python libraries, should authors have a version cap on #dependencies: less than next major version? This (very long) article argues no, don't by default unless you have a specific reason: far more problems come up. Capping is not recommended by most core Python people, but is by some packaging tools.

This matches my previous thoughts, and I agree with its reasons, so I'm glad to see it written out. Anyone want me to summarize more? #RSEng #PythonPackaging

Another #dataset updated for the holidays, I compile #OpenSSF Scorecard data on the top 5,000 most downloaded #Python packages on #PyPI and make it available here:

https://github.com/sethmlarson/pypi-scorecards

#PythonPackaging

:python:📦 A new dump of #PythonPackaging data right before Christmas! This one has data on over 400K #Python packages and 180K maintainers of those packages.

https://github.com/sethmlarson/pypi-data/releases/tag/2022.12.23

If you've never seen this project, it's a snapshot in time for most packages on #PyPI with data about the package, maintainers, dependencies, URLs, #OpenSSF scorecard data, and more!

Check it out here: https://github.com/sethmlarson/pypi-data

#followfriday for my favourite #PythonPackaging folks: @pradyunsg, @henryiii, @sethmlarson, @hynek, @MissingClara, @ralfgommers, @pganssle

#Python

📢Now in print!🍾

In search of a comprehensive guide to the Python packaging landscape?

Publishing Python Packages by @easyaspython will teach you the ins and outs of how to package and publish python code: http://mng.bz/m2ry

#pythonpackaging #Python #pythonpackage #pypi