# PEP 752: Implicit namespaces for package repositories

**URL:** <https://discuss.python.org/t/pep-752-implicit-namespaces-for-package-repositories/63192>\
**Category:** Packaging\
**Created:** [September 7, 2024, 4:38pm UTC](https://discuss.python.org/t/pep-752-implicit-namespaces-for-package-repositories/63192 "2024-09-07T16:38:34Z")\
**Posts on this page:** 1\
**Showing post:** 69

<div class="post-metadata">

**Author:** ![ofek](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/ofek/32/1033_2.png) [@ofek](https://discuss.python.org/u/ofek)\
**Post date:** [October 3, 2024, 7:39pm UTC](https://discuss.python.org/t/pep-752-implicit-namespaces-for-package-repositories/63192/69 "2024-10-03T19:39:24Z")

</div>

> [@ofek](#):
>
> Okay, I’ll post proposed updates here first to be explicit!

I have a pending [PR](https://github.com/python/peps/pull/4018) ([rendered](https://pep-previews--4018.org.readthedocs.build/pep-0752/))!

> [@PEP 755: Implicit namespace policy for PyPI](https://discuss.python.org/t/pep-755-implicit-namespace-policy-for-pypi/63191/52):
>
> > [@PEP 755: Implicit namespace policy for PyPI](https://discuss.python.org/t/pep-755-implicit-namespace-policy-for-pypi/63191/40):
> >
> > I like this. `pip install microsoft::azure-loganalytics` or `microsoft@azure-loganalytics` might be hijacking the syntax from something potentially better, but interpreting it as “package must have this user as owner/maintainer” would likely be better than the whole namespace.
> 
> I _almost_ like this. I think it needs to be `microsoft@pypi.org::azure-loganalytics` the entire prefix argument falls apart in the multi-index situation (pip’s `--extra-index`), this doesn’t have to.

I added a [section](https://pep-previews--4018.org.readthedocs.build/pep-0752/#attesting-package-owner-names) about this idea. I would appreciate feedback on Java because I’m not familiar with how dependency definitions happen nowadays regarding resolution behavior so I didn’t include it in the table.

> [@mikeshardmind](#):
>
> > [@ofek](#):
> >
> > > [@mikeshardmind](#):
> > >
> > > > [@ofek](#):
> > > >
> > > > I think perhaps you’re talking about Steve’s recommendation of something like `microsoft::pkg_name`? If so, this is basically the same concept as NPM scoping as I put in the rejected ideas section.
> > > 
> > > This is _not_ the same as npm scoping. This doesn’t get rid of the flat namespace, it’s an optional way to say “I want this package from this user”, and errors if that package is not provided by that user.
> > 
> > That sounds like the same thing to me (and NPM also kept the flat namespace). Can you please help me understand how this is different?
> 
> npm added full namespacing and kept the flat global namespace. This allows for packages to have the same name.

Thanks for bearing with me Mike, it took me a bit to understand what this idea was about 😅

> [@ncoghlan](#):
>
> You’ll likely find [Ideas for client side package provenance checks](https://discuss.python.org/t/ideas-for-client-side-package-provenance-checks/64679) of interest.

I also added a [section](https://pep-previews--4018.org.readthedocs.build/pep-0752/#exclusive-reliance-on-digital-attestations) about this, thank you for the detailed writeup! Although I don’t think it’s a viable complete alternative, I made it clear that using attestations for more things is an expressly good idea.

> [@ofek](#):
>
> > [@sinoroc](#):
> >
> > > Datadog offers observability as a service for organizations at any scale.
> > 
> > Can we do without this sentence? I do not know how that is relevant to the proposal.
> 
> If you want me to, I will, but please understand this request is a critique of a footnote at the very end of the document and matches the preceding examples where the first sentence is a description

Done anyway!

---

_[View the full topic](https://discuss.python.org/t/pep-752-implicit-namespaces-for-package-repositories/63192)._