PyPI as a Project repository vs. Name registry (a.k.a. PyPI namesquatting, e.g. for Fedora packages)

Below is my proposal, to go under Invalid projects in PEP 541. Does that look good?
PEP 541 calls for amendments to go through PSF General Counsel, but I think we should agree here before I start a formal approval process.

PEP 541 is marked Final, but it seems Active would be a better fit (per end of PEP Review & Resolution in PEP 1). Is Final→Active a valid transition?


Name reservations

Usually, a package that has no functionality or is empty is considered
“name squatting” and is invalid. As an exception, it is allowed to register
an empty project to reserve a name for:

  • a mistyped name of a popular project on PyPI (“typo-squatting”);
  • a project that is freely available from elsewhere and would otherwise be
    valid (for example: a project only installable by specific installers or
    package managers, or a part of the standard library of a Python
    implementation); or
  • a trademark or another name that would infringe the
    Intellectual property policy below if used as project name without
    the owner’s permission.

A name reservation project’s description must state reasons for the reservation
and include relevant links. It is recommended to use a low pre-release version
(e.g. 0.0.dev0) and to make the package not installable with pip
(e.g. by uploading a source distribution that fails to build
with an informative message).

Note that private projects should be hosted on a private package
index, and generally should not have a name reservation on the public
Package Index.

And the point in “Invalid projects” should be changed to:

  • project is name squatting (package has no functionality or is empty,
    except name reservations as described below);
3 Likes