PyPI as a Project repository vs. Name registry (a.k.a. PyPI namesquatting, e.g. for Fedora packages)

[encukou (Petr Viktorin)]

@dustin

@encukou

My intention is to help PyPI admins by making name reservations self-service: rather than up-front review, they’d only require admin attention if they’re disputed. Let me know if that’s not the right direction.

I appreciate this but I think it’s actually easier for us to block a list of project names en masse rather than handle potential PEP 541 requests for the names in question.

Yes, I assume blocking is easy. But what about unblocking the packages as maintainers get ready to share the code on PyPI? At least in the “package in another collection/distro” case, the ideal would be to eventually unblock all the packages again, and that will not happen at once.
I also expect mass blocking to be rare, only done if/when a collection/distro first chooses to sync project names with PyPI.

@dustin

I think in the case of “historical backwards-compatibility” squatting is acceptable.

I guess edge cases like this are adequately covered by PEP 541 requests being handled by humans. (Thank you!)

---

Removing the classifiers idea:

Name reservations

Usually, a package that has no functionality or is empty is considered
“name squatting” and is invalid. As an exception, it is allowed to register
an empty project to reserve a name for:

• a project that is freely available from elsewhere and would otherwise be
  valid (for example: a project only installable by specific installers or
  package managers, or a part of the standard library of a Python
  implementation); or
• a trademark or another name that would infringe the
  Intellectual property policy below if used as project name without
  the owner’s permission.

A name reservation project’s description must state reasons for the reservation
and include relevant links.
It is recommended to use a low pre-release version
(e.g. 0.dev0) and to make the package not installable with pip
(e.g. by uploading a source distribution that fails to build
with an informative message).

Projects that reserve mistyped names of popular projects
(“typo squatting”) are still considered invalid and Package Index
maintainers may remove them without warning or discussion.
(This will not necessarily make the name available: the
Package Index maintainers may block the name for security
reasons when they remove the project.)

Note that private projects should be hosted on a private package
index, and generally should not have a name reservation on the public
Package Index.

And the point in “Invalid projects” should be changed to:

• project is name squatting (package has no functionality or is empty,
  except name reservations as described below);