PEP 752: Package repository namespaces

I wouldn’t want to see this feature be made as complicated as some of the above discussion suggests. Either you want to totally close off your namespace (and live with the existing packages, or one-by-one get them to rename themselves, though I promise you virtually nobody can be bothered to do that until it’s a real security/trademark issue!), or you don’t close it off and rely on the list of maintainers to show your package is official.

The list of maintainers is the critical indicator. I’d prefer to see “verified” ticks on those before any namespace registration feature at all.

It was mentioned above, but one big tradeoff of registered namespaces is it breaks the “package name == import name” assumption, which I know isn’t always true, but it’s nice to be close to it. We actively discourage teams at Microsoft from starting their packages with “microsoft-” today because there’s no way they’re going to claim import microsoft :wink: And the team that controls import azure spends a lot of effort actively caring for that namespace. So the name would just be a marker rather than reflecting the import, and I’m not personally a huge fan of that.

Oh, you’re imagining Nuget! But yeah, this is why I think any registration should come with a decent sized (thinking five figures annually) bill paid towards PyPI support and maintenance. If you want to claim a chunk of the namespace for yourself, you’d better really want it.

6 Likes