Repository navigation
Screen downloads from a PyPI mirror listed only under pypi - #91
Merged
Merged
Conversation
A PyPI mirror serves its files from the index host, so the pypi registry now names packages in /packages/ paths too, and checks their age.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
pypiregistry now also matches wheel and sdist paths (packages/…) and has the PyPI age lookup, sharing both withpypi-files.Why
A PyPI mirror such as
https://pypi.tuna.tsinghua.edu.cn/serves its index and its files from one host. When it was listed only underpypi, its downloads matched no pattern, so they went through unscreened.How
WHEEL,SDISTandPUBLISHEDare consts inpypi.rs, used by bothPYPIandPYPI_FILES. InPYPIthe file patterns come before the catch-all and have no rewrite, so the package bytes are never touched. pypi.org serves nothing under/packages/, so the change makes no difference there. Index pages carry no version, so the age check still skips them.Tested
cargo testandcargo fmt --checkpass.cargo clippy --all-targetsis clean, with and without--features machine-wide.pypi-only mirror under a path prefix resolves tosix@1.16.0. It fails without the fix.{"registries": {"pypi": ["https://pypi.tuna.tsinghua.edu.cn/"]}}:firewall pip install six==1.16.0logsscreening eco="pypi" pkg=six@1.16.0 url=https://pypi.tuna.tsinghua.edu.cn/packages/…/six-1.16.0-py2.py3-none-any.whland installs. Withmin_age_hours: 100000the same wheel isblocked … was published 47930 hours agoand pip gets a 403.Untested
packages/…, such as devpi's+f/…, still match no pattern.