5 ms·
In all this discussion of npm, I wonder how PyPi stacks up. Once I tried to fix an issue with the source distribution of one of my packages on PyPi and found th
by x1798DE 11y ago
In all this discussion of npm, I wonder how PyPi stacks up. Once I tried to fix an issue with the source distribution of one of my packages on PyPi and found that I could delete it just fine, but uploading a new file with the same name failed. I tried re-uploading the original sdist, but that failed as well. Apparently once it's gone it's gone.
I eventually just uploaded a different format then quickly pushed a new version, but I was kinda disturbed that I could irreversibly break a dependency like that.
- svisser 11y agoThis is probably done for security: if a package gets removed it can't be replaced by something potentially malicious. In addition, people that have tied their version numbers would get alerted this way.
- x1798DE 11y agoYeah, but I think either I shouldn't be able to delete it in the first place or I should be able to upload the original package with an unchanged hash. The alternative is that anyone with an == dependency is now permanently broken.
- deleted 11y ago[deleted]