Thanks Brett for the great idea. I am starting this thread to open myself up for questions you want to know about me and my nomination to the PPC.
This should lower the barrier to getting information from me about how I think about the PPC and where I see packaging going with the new PPC. But I will start with some information for those that do not know me. I am what I like to call a Senior Python Ecologist at AWS, my job is to keep the internal AWS Python ecosystem healthy through mirror management, build systems and community engagement. I am also the co-maintainer of Hatch, Hatchling, and PyApp with Ofek.
I appreciate the invitation to ask questions, especially the focus on lowering the barrier to understanding PPC candidates. Your experience maintaining Hatch, Hatchling, and PyApp gives useful perspective on how packaging tools affect the wider Python ecosystem. I am curious how you would balance short-term improvements for maintainers with longer-term changes that need broader coordination. Which packaging issue would you prioritize first if elected?
I think the first issue that has to be tackled by the PPC are the wheel variants PEPs. Because the concept of variants is so wide reaching in impact on the entire packaging ecosystem I think there will need to be a deep focus on getting those decisions right. In terms of balancing short term improvements for maintainers with the longer term changes, I think the PPC itself will help to move along incremental improvements and hopefully provide the ability for the packaging PEP process to be more efficient. There are PEPs like wheel variants that are going to really make the long term horizon for packaging much better for everyone but there are incremental things out there that might seem small but they add up. Working with PyPI to add some level of security scanning is something most of us do not care about day to day until we are the victims of an attack for instance. But those small things add up in the ecosystem to make it a better experience. Another great example is the freezing of the HTML APIs where that small thing allows the ecosystem to focus now around the JSON APIs and that makes things simpler for everyone.
I wanted to answer some questions I have seen asked in other AMAs for people.
What do I see the role of the PPC with regards to PyPI which is maintained by the PSF?
I think that PyPI stays strictly in the control of the PSF and those that are already running it and performing administration of it. I do think there is an opportunity for the PPC to help provide triage and relief as needed for those admins.
What should the relationship look like between the PyPA and the PPC going forward?
I think that the PPC is for making directional decisions at a higher level and the PyPA still acts as the collection of maintainers that continue to work towards providing tools that enable the goals of the PPC and packaging space. I think the PPC has a responsibility to engage and take feedback from the PyPA maintainers who’s communities are impacted by changes to the packaging ecosystem. I think the PyPA acts as one place that the PPC can go and get feedback about how communities have responded to changes.
The PPC and making packaging PEP authoring more approachable
This is probably the biggest thing that drove my wanting to be involved with the PPC. I have been working through the PEP process with various proposals. What I have noticed here is that it can become overwhelming when you look at PEPs that sit in draft state for years. I think the PPC should not be considered successful until packaging PEP process is more efficient. The PPC itself is the start of making the process more efficient by moving from a single PEP delegate to a council of 5. If I am on the PPC this will be a focus I want to take on working with the other members of the PPC to look at what ideas allow PEP authoring to become a process that encourages people to make proposals.
Packaging and Security
This is something that I have been spending a lot of time thinking about. Some of it is more in the Index spec and provider space but there are plenty of things to look at within packaging itself. The PPC should help to drive packaging that is more secure without adding complexity that makes creating packaging harder. What this looks like will take some time brainstorming with the community and other members of the PPC but I think the PPC will be the right place to make changes. One example that I can draw of that is awaiting review to be included in PEP 694, having separate tokens for the upload session and the publish session. What this does is help ensure that compromising 1 token will not be enough to gain access and publish as a bad actor using a known project to do so. Another space that fits here is making provenance better and better, knowing the exact contents that are placed inside an artifact to make it easier to find out if you are impacted by a CVE.
[quote=“Cary Hawkins, post:4, topic:108547, username:cjames23”] What should the relationship look like between the PyPA and the PPC going forward?
I think that the PPC is for making directional decisions at a higher level and the PyPA still acts as the collection of maintainers that continue to work towards providing tools that enable the goals of the PPC and packaging space. I think the PPC has a responsibility to engage and take feedback from the PyPA maintainers who’s communities are impacted by changes to the packaging ecosystem. I think the PyPA acts as one place that the PPC can go and get feedback about how communities have responded to changes.
[/quote]
Thanks Cary for being proactive and sharing your thoughts on questions posted on other threads. I have a few questions about the PPC and PyPA relationship.
How would you feel about breaking out standards for packaging into an org outside of PyPA? For example, PEPs, standards, and packaging guide could be part of the PPC org responsibility while the PyPA org can continue to host packaging related repos.
How would you envision the PPC communicating out and asking for feedback from the PyPA projects as well as projects (pixi, uv, conda, spack) that are not part of PyPA but important to segments of the Python community?
I think the standards, PEPs and the packaging guide should be outside of the PyPA and belong to the PPC. The PyPA should be one of the groups that the PPC partners with to understand the pain points of their communities. In my experience maintaining hatch, I field a lot of standards questions in discussions and issues on the repo itself that never make their way to DPO. I think these insights are critical for the council when making decisions for long term health of packaging and making packaging easier to understand for users. I will say that I think along with Paul that for some changes in the packaging space PEPs might not be the right avenue and that the PPC should engage with the community across packaging tools to find a balance between PEPs for the big things but changing parts of the spec might go through a different path than a full PEP. I want to see the process for changes become more open for newer contributors to present ideas and make it less of a mountain to climb when someone has new ideas. That does not mean there is no friction that will happen but the more we have friction in the right amount and in the right places I think the more we will see the packaging ecosystem start to flourish.
I think that there needs to be a cadence of availability of office hours that the PPC hosts to engage in direct tool maintainer feedback. Sometimes those types of environments get more raw feedback without the fear that they will be misunderstood in something like a DPO thread. I think DPO also continues to be a valuable resource as well. I personally will be available across as many channels as I can make available and time for. Even if not elected to the PPC because I want to see the packaging space foster even more contributions and tools. I know you were there during my talk at the maintainers summit, but for others I firmly believe that tools should collaborate more across the packaging ecosystem and not be seen as competing in an unhealthy way. I like to look at hatch and uv here where I believe that we have pushed each other to become better tools for the community. I think the PPC plays a critical role during the inaugural group to set this tone and foster this community building as much as possible.
