So I just got the email saying one of my projects is deemed critical so will require 2FA. Thankfully (for me) it’s a deprecated project so I’m not making new releases anyway.
FYI I believe the email is really poorly written. Being a plain text email, I initally assumed it was spam. I definitely did not believe it was an official email for a while.
While it has a basic summary of why it’s being done, there’s no links to “read more information about this here”. It took me way too long to find the link to the link to the link to get this this discuss page.
The givaway link at the bottom makes it sound like the key is going to be required, but I’m not in an eligible country to get one (Australia). This was really disappointing. It felt like I had to get to the fine print to find out I can use a standard authenticator app, rather than a frustratingly easy to loose hw key
Lastly, and most importantly, how is this going to affect my 100% gitlab ci automated release process?
In the email it says “required to enable two-factor authentication on their account in order to add new releases or otherwise modify a critical project.”
On first read, this makes it sounds like I’m going to have to 2FA login to release builds. I can categorically state this will block me from making new releases in an automated fashion, which will stop me making releases (to pypi) at all - I’ll tell people to pip install direct from gitlab instead.
Again on the link to the link to the faq there’s a line “This only affects logging in via a web browser, and not (yet) package uploads.” so I gather I don’t need 2FA to upload new packages… doesn’t this defeat the entire purpose of the 2FA protecting the account from nefarious uploads?
but sure I gather I can still CI release (for now) but at some unspecified time in the future all my projects will likely break on release? after I’ve tagged and set off the automated job to upload?
So many questions, so few answers (that I can find).
Reading more info scattered around… my suggestion is:
- Use a nicer looking (html) email with pypi header etc to at least make it look more official.
- Open with a positive statement like “Thanks for being a valued member of the python community! One (or more) of your packages is so popular it’s been designated as a critical project on PyPI”. Maybe include a link to details about how these determinations are made for transperancy?
- Make it clear in the email you can use TOTP app or (preferred) hw key
- Make it clear in the email that for uploading releases you can already create and use API keys as the current preferred approach.
- Make it clear in the email that while email:pass can still be used for uploads currently, it is being deprecated for these security reasons.