109 lines
4.1 KiB
Plaintext
109 lines
4.1 KiB
Plaintext
|
PEP: 449
|
|||
|
|
Title: Removal of Official Public PyPI Mirrors
|
|||
|
|
Version: $Revision$
|
|||
|
|
Last-Modified: $Date$
|
|||
|
|
Author: Donald Stufft <donald@stufft.io>
|
|||
|
|
BDFL-Delegate: Richard Jones <richard@python.org>
|
|||
|
|
Discussions-To: distutils-sig@python.org
|
|||
|
|
Status: Draft
|
|||
|
|
Type: Process
|
|||
|
|
Content-Type: text/x-rst
|
|||
|
|
Created: 04-Aug-2013
|
|||
|
|
Post-History: 04-Aug-2013
|
|||
|
|
Replaces: 381
|
|||
|
|
|
|||
|
|
|
|||
|
|
Abstract
|
|||
|
|
========
|
|||
|
|
|
|||
|
|
This PEP provides a path to deprecate and ultimately remove the official
|
|||
|
|
public mirroring infrastructure for `PyPI`_. It does not propose the removal
|
|||
|
|
of mirroring support in general.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Rationale
|
|||
|
|
=========
|
|||
|
|
|
|||
|
|
The PyPI mirroring infrastructure (defined in `PEP381`_) provides a means to
|
|||
|
|
mirror the content of PyPI used by the automatic installers. It also provides
|
|||
|
|
a method for autodiscovery of mirrors and a consistent naming scheme.
|
|||
|
|
|
|||
|
|
There are a number of problems with the official public mirrors:
|
|||
|
|
|
|||
|
|
* They give control over a \*.python.org domain name to a third party,
|
|||
|
|
allowing that third party to set or read cookies on the pypi.python.org and
|
|||
|
|
python.org domain name.
|
|||
|
|
* The use of a sub domain of pypi.python.org means that the mirror operators
|
|||
|
|
will never be able to get a SSL certificate of their own, and giving them
|
|||
|
|
one for a python.org domain name is unlikely to happen.
|
|||
|
|
* They are often out of date, most often by several hours to a few days, but
|
|||
|
|
regularly several days and even months.
|
|||
|
|
* With the introduction of the CDN on PyPI the public mirroring infrastructure
|
|||
|
|
is not as important as it once was as the CDN is also a globally distributed
|
|||
|
|
network of servers which will function even if PyPI is down.
|
|||
|
|
* Although there is provisions in place for it, there is currently no known
|
|||
|
|
installer which uses the authenticity checks discussed in `PEP381`_ which
|
|||
|
|
means that any download from a mirror is subject to attack by a malicious
|
|||
|
|
mirror operator, but further more due to the lack of TLS it also means that
|
|||
|
|
any download from a mirror is also subject to a MITM attack.
|
|||
|
|
* They have only ever been implemented by one installer (pip), and its
|
|||
|
|
implementation, besides being insecure, has serious issues with performance
|
|||
|
|
and is slated for removal with it's next release (1.5).
|
|||
|
|
|
|||
|
|
Due to the number of issues, some of them very serious, and the CDN which more
|
|||
|
|
or less provides much of the same benefits this PEP proposes to first
|
|||
|
|
deprecate and then remove the public mirroring infrastructure. The ability to
|
|||
|
|
mirror and the method of mirroring will not be affected and the existing
|
|||
|
|
public mirrors are encouraged to acquire their own domains to host their
|
|||
|
|
mirrors on if they wish to continue hosting them.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Plan for Deprecation & Removal
|
|||
|
|
==============================
|
|||
|
|
|
|||
|
|
Immediately upon acceptance of this PEP documentation on PyPI will be updated
|
|||
|
|
to reflect the deprecated nature of the official public mirrors and will
|
|||
|
|
direct users to external resources like http://www.pypi-mirrors.org/ to
|
|||
|
|
discover unofficial public mirrors if they wish to use one.
|
|||
|
|
|
|||
|
|
On October 1st, 2013, roughly 2 months from the date of this PEP, the DNS names
|
|||
|
|
of the public mirrors ([a-g].pypi.python.org) will be changed to point back to
|
|||
|
|
PyPI which will be modified to accept requests from those domains. At this
|
|||
|
|
point in time the public mirrors will be considered deprecated.
|
|||
|
|
|
|||
|
|
Then, roughly 2 months after the release of the first version of pip to have
|
|||
|
|
mirroring support removed (currently slated for pip 1.5) the DNS entries for
|
|||
|
|
[a-g].pypi.python.org and last.pypi.python.org will be removed and PyPI will
|
|||
|
|
no longer accept requests at those domains.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Unofficial Public or Private Mirrors
|
|||
|
|
====================================
|
|||
|
|
|
|||
|
|
The mirroring protocol will continue to exist as defined in `PEP381`_ and
|
|||
|
|
people are encouraged to utilize to host unofficial public and private mirrors
|
|||
|
|
if they so desire. For operators of unofficial public or private mirrors the
|
|||
|
|
recommended mirroring client is `Bandersnatch`_.
|
|||
|
|
|
|||
|
|
|
|||
|
|
.. _PyPI: https://pypi.python.org/
|
|||
|
|
.. _PEP381: http://www.python.org/dev/peps/pep-0381/
|
|||
|
|
.. _Bandersnatch: https://pypi.python.org/pypi/bandersnatch
|
|||
|
|
|
|||
|
|
|
|||
|
|
Copyright
|
|||
|
|
=========
|
|||
|
|
|
|||
|
|
This document has been placed in the public domain.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
..
|
|||
|
|
Local Variables:
|
|||
|
|
mode: indented-text
|
|||
|
|
indent-tabs-mode: nil
|
|||
|
|
sentence-end-double-space: t
|
|||
|
|
fill-column: 70
|
|||
|
|
coding: utf-8
|
|||
|
|
End:
|