Add PEP 449: Removal of *.pypi.python.org mirrors
This commit is contained in:
Nick Coghlan
parent
297ca2977e
commit
cd8c87fa1e
|
|
@ -0,0 +1,108 @@
|
|||
PEP: 449
|
||||
Title: Removal of Official Public PyPI Mirrors
|
||||
Version: $Revision$
|
||||
Last-Modified: $Date$
|
||||
Author: Donald Stufft <donald@stufft.io>
|
||||
BDFL-Delegate: Richard Jones <richard@python.org>
|
||||
Discussions-To: distutils-sig@python.org
|
||||
Status: Draft
|
||||
Type: Process
|
||||
Content-Type: text/x-rst
|
||||
Created: 04-Aug-2013
|
||||
Post-History: 04-Aug-2013
|
||||
Replaces: 381
|
||||
|
||||
|
||||
Abstract
|
||||
========
|
||||
|
||||
This PEP provides a path to deprecate and ultimately remove the official
|
||||
public mirroring infrastructure for `PyPI`_. It does not propose the removal
|
||||
of mirroring support in general.
|
||||
|
||||
|
||||
Rationale
|
||||
=========
|
||||
|
||||
The PyPI mirroring infrastructure (defined in `PEP381`_) provides a means to
|
||||
mirror the content of PyPI used by the automatic installers. It also provides
|
||||
a method for autodiscovery of mirrors and a consistent naming scheme.
|
||||
|
||||
There are a number of problems with the official public mirrors:
|
||||
|
||||
* They give control over a \*.python.org domain name to a third party,
|
||||
allowing that third party to set or read cookies on the pypi.python.org and
|
||||
python.org domain name.
|
||||
* The use of a sub domain of pypi.python.org means that the mirror operators
|
||||
will never be able to get a SSL certificate of their own, and giving them
|
||||
one for a python.org domain name is unlikely to happen.
|
||||
* They are often out of date, most often by several hours to a few days, but
|
||||
regularly several days and even months.
|
||||
* With the introduction of the CDN on PyPI the public mirroring infrastructure
|
||||
is not as important as it once was as the CDN is also a globally distributed
|
||||
network of servers which will function even if PyPI is down.
|
||||
* Although there is provisions in place for it, there is currently no known
|
||||
installer which uses the authenticity checks discussed in `PEP381`_ which
|
||||
means that any download from a mirror is subject to attack by a malicious
|
||||
mirror operator, but further more due to the lack of TLS it also means that
|
||||
any download from a mirror is also subject to a MITM attack.
|
||||
* They have only ever been implemented by one installer (pip), and its
|
||||
implementation, besides being insecure, has serious issues with performance
|
||||
and is slated for removal with it's next release (1.5).
|
||||
|
||||
Due to the number of issues, some of them very serious, and the CDN which more
|
||||
or less provides much of the same benefits this PEP proposes to first
|
||||
deprecate and then remove the public mirroring infrastructure. The ability to
|
||||
mirror and the method of mirroring will not be affected and the existing
|
||||
public mirrors are encouraged to acquire their own domains to host their
|
||||
mirrors on if they wish to continue hosting them.
|
||||
|
||||
|
||||
Plan for Deprecation & Removal
|
||||
==============================
|
||||
|
||||
Immediately upon acceptance of this PEP documentation on PyPI will be updated
|
||||
to reflect the deprecated nature of the official public mirrors and will
|
||||
direct users to external resources like http://www.pypi-mirrors.org/ to
|
||||
discover unofficial public mirrors if they wish to use one.
|
||||
|
||||
On October 1st, 2013, roughly 2 months from the date of this PEP, the DNS names
|
||||
of the public mirrors ([a-g].pypi.python.org) will be changed to point back to
|
||||
PyPI which will be modified to accept requests from those domains. At this
|
||||
point in time the public mirrors will be considered deprecated.
|
||||
|
||||
Then, roughly 2 months after the release of the first version of pip to have
|
||||
mirroring support removed (currently slated for pip 1.5) the DNS entries for
|
||||
[a-g].pypi.python.org and last.pypi.python.org will be removed and PyPI will
|
||||
no longer accept requests at those domains.
|
||||
|
||||
|
||||
Unofficial Public or Private Mirrors
|
||||
====================================
|
||||
|
||||
The mirroring protocol will continue to exist as defined in `PEP381`_ and
|
||||
people are encouraged to utilize to host unofficial public and private mirrors
|
||||
if they so desire. For operators of unofficial public or private mirrors the
|
||||
recommended mirroring client is `Bandersnatch`_.
|
||||
|
||||
|
||||
.. _PyPI: https://pypi.python.org/
|
||||
.. _PEP381: http://www.python.org/dev/peps/pep-0381/
|
||||
.. _Bandersnatch: https://pypi.python.org/pypi/bandersnatch
|
||||
|
||||
|
||||
Copyright
|
||||
=========
|
||||
|
||||
This document has been placed in the public domain.
|
||||
|
||||
|
||||
|
||||
..
|
||||
Local Variables:
|
||||
mode: indented-text
|
||||
indent-tabs-mode: nil
|
||||
sentence-end-double-space: t
|
||||
fill-column: 70
|
||||
coding: utf-8
|
||||
End:
|
||||
Loading…
Reference in New Issue