Manage projects with namespaces

[4383]

Hey!

Overview

This is a feature proposal. Now when a project is already register on pypi it's not possible to users to test a fork of any projects with the same name when it's already exist, manage projects by namespace increase possiblities for the python community.

With this feature we can introduce trusted packages by allow install/search without namespace and add namespaces on untrusted packages like docker behavior (docker pull nginx or docker pull 4383/nginx).

On docker when the package is trusted (docker trusted image mean maintained by docker itself), namespace does not exist, and when a package is maintain by a third user namespace appear into the name.

I don't want delegate official projects maintainance to the pypa team but we can introduce a vote system for the community and remove namespace when project obtain a certain number of votes from the community (users).

I'm sure to be in the right place for propose this feature, twine, pip etc... must be upgraded also for work with it.

Features

• Allow users to vote for trust project and allow download (install, search, etc...) without prefix with user namespace
• Allow users to upload on pypi project with a name who already exist on pypi but prefixed by user namespace.

Benefits

• Improve project trust
• Improve package trusting and discrease risk that users deal with a miscellaneous package come from a typo squatting example 1, pypa github discussion
• Allow users to provide forked version of an official project
• Allow users to test that packaging work fine on pypi

Examples

With pip:

$ pip install Django # trusted package
$ pip install 4383/Django # untrusted package

Url transposition:

• https://pypi.org/project/Django/
• https://pypi.org/project/4383/Django/

[brainwane]

@4383 Thank you for this feature proposal! I'm the project manager for the current push to deploy Warehouse and, since this is a new feature idea, I've marked it for a future milestone, since it isn't a task we absolutely need to do in order to get Warehouse deployed. Thanks again!

[4383]

@brainwane how I can help you for introduce this feature?

[brainwane]

@4383 I'm so sorry for the wait! @di do you have any thoughts on what next steps would be?

[di]

This will need discussion, likely on distutils-sig. Since a package name like 4383/Django is not currently a valid package name, this would possibly require a PEP, as well as significant changes to tooling in the ecosystem (pip, twine, etc).

[4383]

Hi @brainwane @di!

I can describe the attended behavior in PEP for more examples and to standardize this feature.
My help can start by writing this description.

Thanks for replies!

[di]

To be clear: a discussion on distutils-sig should probably be the first step.

[4383]

@di ok

[4383]

Discussion on distutils-sig was now opened
https://groups.google.com/forum/#!topic/distutils-sig/gFusrdTuWek

And message was sent on the disutils-sig mailing list

[brainwane]

I think that might be the wrong list. Please post to https://mail.python.org/mailman/listinfo/distutils-sig . Thank you and sorry for the mixup.

[4383]

I had already sent an email to this mailing list: distutils-sig@python.org
Can you confirm it's right?

[brainwane]

Thanks! I see it at https://mail.python.org/mm3/archives/list/distutils-sig@python.org/thread/NFLCHKYGPEBAR5I5FMMXMC2JKMLYJQ7G/ in the archives of the distutils-sig mailing list. :)

If you will be at PyCon North America or EuroPython in Edinburgh this year, please consider talking with us in person there at our sprints.

[ewdurbin]

cc @pganssle