[Distutils] PEP 503 - Simple Repository API

[Paul Moore]

On 5 September 2015 at 17:15, Donald Stufft <donald at stufft.io> wrote:
> I've updated the PEP with the typo corrections, clarifications, and the missing
> GPG signature support that Marc-Andre and Marius pointed out. It should be live
> on the PEP site soon, but the diff can be viewed online at
> https://hg.python.org/peps/rev/a314911efa10

Looks good.

Some background information might be worth adding (for instance, the
explanation of why you need a top-level index page at all that you
posted in response to MAL's question).

Also for background, 2 questions that struck me:

1. If my project page contains extra links as well as the file links
(for example, to documentation, possibly even downloadable archives of
the documentation) how will installers (specifically pip) know what to
do with those? While I appreciate the effort to keep the PEP
installer-agnostic, giving a bit of "pip works like this" as
background would help. For example, is a page with 3 downloadable
files referenced and 100 links to other stuff, going to perform worse
than a page with just the 3 download links?

2. Will installers (pip) download all the files, or will they only
grab the requested release? How would they know? (Parsing the filename
works for wheels, but isn't guaranteed to for sdists, and definitely
won't for arbitrary extra links).

In practice, I'd expect an index page to only contain bare links to
valid sdist and wheel files, with the sdist filenames being standard
names as generated by distutils. I wouldn't actually see any harm in
mandating that, but as it stands the PEP doesn't do so. Maybe it's
intended to? Should the paragraph "Below the root URL is another URL
...  This URL must respond with a valid HTML5 page with a single
anchor element per file for the project. ..." finish with a further
restriction "The page MUST NOT contain any content other than the
specified anchor elements"?

Paul