3 ms·
Published packages should be immutable. Sure, "unpublish" so it's no longer listed. Even display scary messages in your package manager's stdout. But once you p
by infogulch 4y ago
Published packages should be immutable. Sure, "unpublish" so it's no longer listed. Even display scary messages in your package manager's stdout. But once you publish a package, any package manager with the hash of the package contents in its lockfile should be able to continue retrieving it indefinitely. The fact that it's possible for any maintainer to break all consumers of their previously published works on a whim is insane to me.
- emu 4y agoIf pypi didn't enforce size limits, I'd agree with you. We routinely have to delete older versions of our package to make space for newer versions.
- throwawaybutwhy 4y agoA thousand times this. Immutability, reproducibility, traceability. What irks one the most is the arbitrary discrimination between 'critical' and 'non-critical' maintainers. Use TOTP for everybody and be done with it.