PyPI Organizations (2023)

https://blog.pypi.org/posts/2023-04-23-introducing-pypi-organizations/

42•calpaterson•8mo ago

Comments

hobofan•8mo ago

[2023]

mikepurvis•8mo ago

Looks like it's taken a while to really get rolling though; as early as January of this year they had thousands of applications in the backlog and 0 paying customers, per https://discuss.python.org/t/state-of-pypi-organizations/337...

However, later in the thread there are updates that look a little better.

alexchantavy•8mo ago

PyPI is such an important service and as a Python user it's easy to take for granted that it just works. I recently had to make a config update from my project's GitHub repo to PyPI and lost the password and had to do account recovery, and then suddenly realized "wow, they take care of a lot of other orgs", and "wow, this is a TON of ops work" -- see the issues _just_ on account recovery: https://github.com/pypi/support/issues.

datadrivenangel•8mo ago

It would be great if PyPI could use their position to offer internal mirrors with additional security scanning... and then use that capability to increase their malware detection on every package!

bgwalter•8mo ago

You can't make suggestions or criticize PyPI. For 20 years, it has been the worst package manager of any language in existence, yet they still get tons of funding and never take external suggestions. In that sense, the funding model is successful.

woodruffw•8mo ago

PyPI is a package index, not a package manager.

I can also say from direct experience that (1) it doesn't get very much funding, and (2) they take plenty of external suggestions and contributions.

the_mitsuhiko•8mo ago

From my understanding these organizations don’t yet do anything. At least they do not grant a namespace unlike they do on npm. That might change though.

woodruffw•8mo ago

> From my understanding these organizations don’t yet do anything

A key thing they do is offer finer-grained roles[1] for project and team (i.e. subteams within an org) management.

You're right that they don't provide namespaces, yet. I believe there's ongoing discussion about how to enable that, including via PEP 752 and 755.

[1]: https://docs.pypi.org/organization-accounts/roles-entities/

mikepurvis•8mo ago

The big thing is auth so that multiple owners can separately have 2FA set up and push releases, generate service tokens, etc.

maxnoe•8mo ago

Organizations cannot yet create tokens, only the setting up trusted publishing is supported, but that only works on four providers and e.g. not in self hosted gitlabs.

joshdavham•8mo ago

This is from 2023 and you still need to request approval for an organization. The approval process is also very slow (my friend requested an organization for us last fall and we still don't have it).

ayhanfuat•8mo ago

Is it possible they reached out to you requesting some information and you missed it? According to this thread they have cleared the queue recently https://discuss.python.org/t/state-of-pypi-organizations/337...

joshdavham•8mo ago

This is useful to hear about! I'll see if my friend heard anything.

Show HN: COGext – A minimalist, open-source system monitor for Chrome (<550KB)

FOSDEM 26 – My Hallway Track Takeaways

Show HN: Env-shelf – Open-source desktop app to manage .env files

Show HN: Almostnode – Run Node.js, Next.js, and Express in the Browser

Dell support (and hardware) is so bad, I almost sued them

Project Pterodactyl: Incremental Architecture

Styling: Search-Text and Other Highlight-Y Pseudo-Elements

Crypto firm accidentally sends $40B in Bitcoin to users

Magnetic fields can change carbon diffusion in steel

Fantasy football that celebrates great games

Show HN: Animalese

StrongDM's AI team build serious software without even looking at the code

John Haugeland on the failure of micro-worlds

Show HN: Velocity - Free/Cheaper Linear Clone but with MCP for agents

Corning Invented a New Fiber-Optic Cable for AI and Landed a $6B Meta Deal [video]

Show HN: XAPIs.dev – Twitter API Alternative at 90% Lower Cost

Near-Instantly Aborting the Worst Pain Imaginable with Psychedelics

Show HN: Nginx-defender – realtime abuse blocking for Nginx

The Super Sharp Blade

Smart Homes Are Terrible

What I haven't figured out

KPMG pressed its auditor to pass on AI cost savings

Open-source Claude skill that optimizes Hinge profiles. Pretty well.

First Proof

I squeezed a BERT sentiment analyzer into 1GB RAM on a $5 VPS

Kagi Translate

Building Interactive C/C++ workflows in Jupyter through Clang-REPL [video]

Tactical tornado is the new default

Full-Circle Test-Driven Firmware Development with OpenClaw

Automating Myself Out of My Job – Part 2