PEP 752: Implicit namespaces for package repositories

[ofek (Ofek Lev)]

@ofek

Okay, I’ll post proposed updates here first to be explicit!

I have a pending PR (rendered)!

@Liz

@steve.dower

I like this. pip install microsoft::azure-loganalytics or microsoft@azure-loganalytics might be hijacking the syntax from something potentially better, but interpreting it as “package must have this user as owner/maintainer” would likely be better than the whole namespace.

I almost like this. I think it needs to be microsoft@pypi.org::azure-loganalytics the entire prefix argument falls apart in the multi-index situation (pip’s --extra-index), this doesn’t have to.

I added a section about this idea. I would appreciate feedback on Java because I’m not familiar with how dependency definitions happen nowadays regarding resolution behavior so I didn’t include it in the table.

@mikeshardmind

@ofek

@mikeshardmind

@ofek

I think perhaps you’re talking about Steve’s recommendation of something like microsoft::pkg_name? If so, this is basically the same concept as NPM scoping as I put in the rejected ideas section.

This is not the same as npm scoping. This doesn’t get rid of the flat namespace, it’s an optional way to say “I want this package from this user”, and errors if that package is not provided by that user.

That sounds like the same thing to me (and NPM also kept the flat namespace). Can you please help me understand how this is different?

npm added full namespacing and kept the flat global namespace. This allows for packages to have the same name.

Thanks for bearing with me Mike, it took me a bit to understand what this idea was about

@ncoghlan

You’ll likely find Ideas for client side package provenance checks of interest.

I also added a section about this, thank you for the detailed writeup! Although I don’t think it’s a viable complete alternative, I made it clear that using attestations for more things is an expressly good idea.

@ofek

@sinoroc

Datadog offers observability as a service for organizations at any scale.

Can we do without this sentence? I do not know how that is relevant to the proposal.

If you want me to, I will, but please understand this request is a critique of a footnote at the very end of the document and matches the preceding examples where the first sentence is a description

Done anyway!