3 ms·
What if the maintainers just say no?
by hardolaf 4y ago
What if the maintainers just say no?
- Conan_Kudo 4y agoWell, PyPI would be in a very bad place, because they can't force them to say "yes". But they've backed themselves into a corner by punishing people for making software that becomes popular. :/
- tlocke 4y agoAs I recall it's mandatory. I can see the package indexes becoming much more involved in supply chain issues. A bit like the app stores, where a considerable amount of vetting goes on.
- senko 4y agoThat's an interesting idea! A "vetted" package index that charges subscription and splits the revenue with package maintainers. In return, maintainers agree to jump through all the extra hoops and index maintainers do extra verification (but still no warranty except that the standard procedure is followed). The same package can then be uploaded to the normal index (as it is now), but without these extra steps, and no vetting.