Distribution via PyPi

[weddige]

This package is (via the fork https://github.com/GreenPonik/PySocksipyChain) 3 times on PyPi:

• https://pypi.org/project/PySocksipyChain/
• https://pypi.org/project/GreenPonikSocksipyChain/
• https://pypi.org/project/SocksipyChain/

In addition, there is the ancient SocksiPy-branch 1.01, which is with over 629.000 downloads in the last 6 month one of the top projects on PyPi.

For the sake of supply chain security, it would be a good idea to try to clean up this situation.

[weddige]

And ofc. there is sockschain

@seanmcfeely, @GreenPonik: It would be great, if you could get together on this issue.

[seanmcfeely]

Yea, @pagekite is non-responsive .

Hm, I wonder why Mickael Lehoux from @GreenPonik uploaded the project three different times to PyPi.

What do you propose @weddige?

[BjarniRunar]

Hey, sorry we missed that PR. I unfortunately put myself in the situation of getting way to many Github notifications and just didn't see that. I would like to do my part to sort this out, will look into the PR today to understand what is up.

[weddige]

What do you propose @weddige?

As all packages are currently being used (See screenshot with download statistics for the last 6 months), it's not really an option to just deleting the packages. IMHO there should be one canonical package and all (or as many as possible) of the other packages should get a README that points to that package. And the packages should be transferred to a single owner (or group of owners if you prefer).

[BjarniRunar]

Note that socksipy and sockipychain are different things; I added the chaining ability (which is starting to feel a bit dated and not particularly elegant) which the original code did not have at all.

I agree that cleaning up and merging would be nice, but I'm not really sure where to begin or even whether I'm the right person for the job.

[weddige]

I included socksipy because it has not been maintained since 2006 and socksipychain, whilst dated itself, is the better maintained alternative.

Maybe you could form a team of maintainers and share load? I'm not sure how much need there is for further development, but it certainly would help users find the relevant repository/package and get in touch with somebody.

[weddige]

I haven't used it, but having a look at https://github.com/simonw/pypi-rename might be worth it.

[BjarniRunar]

Hey, @MkLHX could you chime in here? I've merged some fixes to PySocksipyChain and tagged as v2.1.3, but I'm now unable to update PyPI because you own the project.

If you're busy with other things, you could create a pull request so your publishing workflows live over on my side and transfer ownership of the PyPI project to me? I realize that I haven't been the most responsive or active of maintainers, but as far as I can tell I'm still the least worst of us. 😆

[MkLHX]

Hi there, do what you need, because GreenPonik is dead, i'm not the owner of pagekite project or anything

[BjarniRunar]

Hey! Very good, let's get this sorted. Could you e-mail me at bre@pagekite.net or even better, connect with me on Signal (username BjarniRunar.76)? I think we probably need to exchange some secrets or do some coordination to transfer ownership of the PyPI project to me then.

[MkLHX]

I have a doubt about secrets or things about it because GreenPonik company is dead, emails and data too. The best solution isn't to delete anything about it on pypi ?

[BjarniRunar]

That might work, but I worry that they keep the name reserved for a while even if you delete the project? I'll go see if I can find some docs.

[BjarniRunar]

https://pypi.org/help/#request-ownership - the questions in that section suggest it will be much easier if you transfer ownership to me, rather than delete.

[MkLHX]

The biggest thing to know, is i haven't access to the account anymore. Pypi ask for 2FA code i haven't and when i try to change the password i never receive the email because the email address was delete with all things about the GreenPonik company.

[BjarniRunar]

Ah, I see. I'll see about requesting a transfer then. Thanks for clarifying!