PyPI Now Rejects New Files on Releases Older Than 14 Days
PyPI Blog: Releases now reject new files after 14 days
To prevent supply chain attacks, PyPI now blocks new file uploads to releases older than 14 days. This change follows compromises of LiteLLM and Telnyx, aiming to stop attackers from poisoning long-stable packages. While some projects previously added new Python versions to old releases, data showed this practice was rare. We advise users not to rely on this behavior yet, as formal semantics for closed releases are still being defined under PEP 694.
The rough consensus of the discussion was that the summit attendees thought it was acceptable to require users to bump to the next version to support new Python versions.
- nneonneo
The remaining risk now is that a patient, malicious actor could put out a new, clean source-only release, wait for ~7 days for people to decide it's safe and update to that version (and pass typical update delay controls), and then attach a bunch of malicious binary wheels. 14 days still seems to be too long.
Of course, this is already miles better than the current state of affairs where an old but popular package could become an infection vector at any time.
- yladiz
I’m a bit surprised this is possible in the first place. I get that you might not be able to upload everything in one go, but it feels like you should “start” and “finish” a release in that case, and once it’s finished you can’t modify it.
I guess the use case is that you might want to build a wheel for an older release for a newer version of Python?
- llg-312g
Python packaging, the most convoluted way of creating simple zip files imaginable.
The tool fragmentation is insane, the demand to create "source distributions" was maybe funny in 2002 but just a hindrance now.
Packages no longer build since distutils was ripped out and upstream replaced it with meson etc.
Since building from source no longer works, which is profitable for third party vendors like Conda, "wheels" are uploaded. And they cannot be built on the server since the whole "scientific" ecosystem is perpetually broken. And they are separate artifacts, leading to the above problem.
Shipping checksummed tar archives is of course it not possible, that would hurt the income streams of the package profiteers.
- skinfaxi
14 days is still too long if you ask me. Releases should be immutable.
- firesteelrain
This seems like common sense configuration management 101. If I download v1.2 and it’s been published then it should be considered released and not modifiable. With exceptions for ‘dev’ releases of course. I have never published anything on PyPI but I would expect there is a publish button and finalize (?) optional button that if not checked after 14 days makes it final ?