Re: [RFC] DPT Policy: Canonise recommendation against PyPi-provided upstream source tarballs
File names on PyPI are write once. Once a specific file name has been used it can never be used again (even if the entire project was deleted and recreated).
Projects can delete uploaded files (and as mentioned they can be yanked, but yanking is just extra metadata beside the file), but file content can never change, only be removed.
Sent from my iPhone
> On Jun 25, 2021, at 11:47 PM, Brian Thompson <brian@hashvault.io> wrote:
>
> On Fri, Jun 25, 2021 at 07:01:39PM -0400, Nicholas D Steeves wrote:
>> Does PyPi provide immutable releases?
>
> From experience, I can tell you that yes, releases cannot be overwritten,
> but they can be "yanked". Pypi states that a yanked release is:
>
> "A release that is always ignored by an installer, unless it is the
> only release that matches a version specifier (using either '==' or
> '===)."
>
> --
> Best regards,
>
> Brian T
Reply to: