Skip to content

updates to /security and /help, lead people to FAQ when project-name conflicts arise. #2410

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Sep 18, 2017
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions tests/unit/forklift/test_legacy.py
Original file line number Diff line number Diff line change
Expand Up @@ -619,7 +619,9 @@ def test_fails_with_invalid_names(self, pyramid_config, db_request, name):
resp = excinfo.value

assert resp.status_code == 400
assert resp.status == "400 The name {!r} is not allowed.".format(name)
assert resp.status == ("400 The name {!r} is not allowed. "
"See https://pypi.org/help/#project-name "
"for more information.").format(name)

@pytest.mark.parametrize("name", ["xml", "XML", "pickle", "PiCKle",
"main", "future", "al", "uU", "test",
Expand Down Expand Up @@ -648,8 +650,9 @@ def test_fails_with_stdlib_names(self, pyramid_config, db_request, name):

assert resp.status_code == 400
assert resp.status == (("400 The name {!r} is not allowed (conflict "
"with Python Standard Libary module name).")
.format(name))
"with Python Standard Libary module name). "
"See https://pypi.org/help/#project-name "
"for more information.").format(name))

def test_upload_fails_without_file(self, pyramid_config, db_request):
pyramid_config.testing_securitypolicy(userid=1)
Expand Down
13 changes: 10 additions & 3 deletions warehouse/forklift/legacy.py
Original file line number Diff line number Diff line change
Expand Up @@ -648,7 +648,10 @@ def file_upload(request):
func.normalize_pep426_name(form.name.data))).scalar():
raise _exc_with_message(
HTTPBadRequest,
"The name {!r} is not allowed.".format(form.name.data),
("The name {!r} is not allowed. "
"See https://pypi.org/help/#project-name "
"for more information.")
.format(form.name.data),
) from None

# Also check for collisions with Python Standard Library modules.
Expand All @@ -657,7 +660,9 @@ def file_upload(request):
raise _exc_with_message(
HTTPBadRequest,
("The name {!r} is not allowed (conflict with Python "
"Standard Libary module name).").format(form.name.data),
"Standard Libary module name). See "
"https://pypi.org/help/#project-name for more information.")
.format(form.name.data),
) from None

# The project doesn't exist in our database, so we'll add it along with
Expand Down Expand Up @@ -693,7 +698,9 @@ def file_upload(request):
if not request.has_permission("upload", project):
raise _exc_with_message(
HTTPForbidden,
"You are not allowed to upload to {!r}.".format(project.name)
("You are not allowed to upload to {!r}. "
"See https://pypi.org/help#project-name for more information.")
.format(project.name)
)

try:
Expand Down
15 changes: 15 additions & 0 deletions warehouse/templates/pages/help.html
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,21 @@ <h3 id="preproduction" class="common-question">What does pre-production mean?</h

<p>This is mostly just a warning at this point that the UI might return funky results, some things might not be great yet and to discourage throwing the full force of people's production traffic at it.</p>
<p>The current hosting arrangement can't handle the full amount of traffic we get from <code>pip install</code> however uploads are fine and we're working on building on the new infrastructure with our future hosting arrangement that can handle the full production load.</p>

<h3 id="project-name" class="common-question">Why isn't my desired Project name available?</h3>

<p>When creating a new Project on PyPI, you may recieve an error from your publishing tool which indicates that a project is not able to be created with your desired name. In addition you may find that there are no associated project or release on pypi.org, currently there are three primary reasons this may occur:</p>
<ul>
<li>The project name conflicts with a <a href="https://docs.python.org/3/library/index.html">Python Standard Library</a> module from any major version from 2.5 to present.</li>
<li>The project name has been explicitly prohibitted by the PyPI administrators, for example <code>pip install requirements.txt</code> is a common typo for <code>pip install -r requirements.txt</code>, and should not surprise the user with a malicious package.</li>
<li>The project name has been registered by another user, but no releases have been created.</li>
</ul>

<h3 id="project-name-claim" class="common-question">How do I claim an abandoned or previously registered Project name?</h3>

<p>There is currently no established process for performing this administrative task that is explicit and fair for all parties. However, one is currently in development with <a href="https://www.python.org/dev/peps/pep-0541/">PEP 541</a></p>

<p>When <a href="https://www.python.org/dev/peps/pep-0541/">PEP 541</a> is accepted, the project will create a workflow, to be documented here.</p>
</div>
</section>

Expand Down
3 changes: 2 additions & 1 deletion warehouse/templates/pages/security.html
Original file line number Diff line number Diff line change
Expand Up @@ -32,11 +32,12 @@ <h2>Reporting a security issue</h2>

<br>

<p>Instead, please email Donald Stufft or Richard Jones directly, providing as much relevant information as possible.</p>
<p>Instead, please email Donald Stufft, Ernest W. Durbin III, or Richard Jones directly, providing as much relevant information as possible.</p>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't need to block merging this, but we should probably reach out to Richard to ask him if he wants to still receive these emails or not since he's stepped back from PyPI.

<p>Messages may be optionally encrypted with GPG using key fingerprints (these public keys are available from most commonly-used key servers):</p>

<ul>
<li><strong>Donald Stufft:</strong> [email protected] <code>7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA</code></li>
<li><strong>Ernest W. Durbin III:</strong> [email protected] <code>11CD 3DD9 8D7E 61C7 6D1A 3224 8815 9C24 830F 6F7E</code></li>
<li><strong>Richard Jones:</strong> [email protected] <code>0145 FD2B 52E8 0A8E 329A 16C7 AC68 AC04 41C6 E930</code></li>
</ul>

Expand Down