PyPI Organizations (2023)

https://blog.pypi.org/posts/2023-04-23-introducing-pypi-organizations/

39•calpaterson•7h ago

Comments

hobofan•6h ago

[2023]

mikepurvis•6h ago

Looks like it's taken a while to really get rolling though; as early as January of this year they had thousands of applications in the backlog and 0 paying customers, per https://discuss.python.org/t/state-of-pypi-organizations/337...

However, later in the thread there are updates that look a little better.

alexchantavy•5h ago

PyPI is such an important service and as a Python user it's easy to take for granted that it just works. I recently had to make a config update from my project's GitHub repo to PyPI and lost the password and had to do account recovery, and then suddenly realized "wow, they take care of a lot of other orgs", and "wow, this is a TON of ops work" -- see the issues _just_ on account recovery: https://github.com/pypi/support/issues.

datadrivenangel•5h ago

It would be great if PyPI could use their position to offer internal mirrors with additional security scanning... and then use that capability to increase their malware detection on every package!

bgwalter•3h ago

You can't make suggestions or criticize PyPI. For 20 years, it has been the worst package manager of any language in existence, yet they still get tons of funding and never take external suggestions. In that sense, the funding model is successful.

woodruffw•3h ago

PyPI is a package index, not a package manager.

I can also say from direct experience that (1) it doesn't get very much funding, and (2) they take plenty of external suggestions and contributions.

the_mitsuhiko•5h ago

From my understanding these organizations don’t yet do anything. At least they do not grant a namespace unlike they do on npm. That might change though.

woodruffw•5h ago

> From my understanding these organizations don’t yet do anything

A key thing they do is offer finer-grained roles[1] for project and team (i.e. subteams within an org) management.

You're right that they don't provide namespaces, yet. I believe there's ongoing discussion about how to enable that, including via PEP 752 and 755.

[1]: https://docs.pypi.org/organization-accounts/roles-entities/

mikepurvis•4h ago

The big thing is auth so that multiple owners can separately have 2FA set up and push releases, generate service tokens, etc.

maxnoe•4h ago

Organizations cannot yet create tokens, only the setting up trusted publishing is supported, but that only works on four providers and e.g. not in self hosted gitlabs.

joshdavham•4h ago

This is from 2023 and you still need to request approval for an organization. The approval process is also very slow (my friend requested an organization for us last fall and we still don't have it).

ayhanfuat•3h ago

Is it possible they reached out to you requesting some information and you missed it? According to this thread they have cleared the queue recently https://discuss.python.org/t/state-of-pypi-organizations/337...

Type-constrained code generation with language models

Your fingers wrinkle the same way every time you're in the water too long

Flattening Rust's Learning Curve

Branch Privilege Injection: Exploiting branch predictor race conditions

Starcloud

Map of Palaeohispanic Coins and Inscriptions

Build real-time knowledge graph for documents with LLM

Failed Soviet Venus lander Kosmos 482 crashes to Earth after 53 years in orbit

Google is building its own DeX: First look at Android's Desktop Mode

Show HN: HelixDB – Open-source vector-graph database for AI applications (Rust)

PDF to Text, a challenging problem

Multiple security issues in GNU Screen

A tool to verify estimates, II: a flexible proof assistant

Launch HN: Miyagi (YC W25) turns YouTube videos into online, interactive courses

Garbage collection of object storage at scale

It Awaits Your Experiments

How (memory) safe is Zig? (2021)

Cardiac: A CARDboard Illustrative Aid to Computation [pdf]

Less meat is nearly always better than sustainable meat

Ask HN: How are you acquiring your first hundred users?

When graphic design saves lives

Y Combinator says Google is a monopolist, no comment about its OpenAI ties

OpenTelemetry protocol with Apache Arrow

The world could run on older hardware if software optimization was a priority

I learned Snobol and then wrote a toy Forth

Turritopsis dohrnii: Immortal jellyfish

Using obscure graph theory to solve programming languages problems

Membrane: Media Framework for Elixir

Insurers launch cover for losses caused by AI chatbot errors

In a high-stress work environment, prioritize relationships