1037466 - Let's grant a-team permission to upload (certain) pypi packages

Status: RESOLVED WONTFIX

(Release Engineering :: General, defect)

Description

[Pete Moore [:pmoore][:pete]]

Currently ateam has to request a package to be uploaded to pypi server.

Maybe we can grant them access, to avoid a releng bottleneck?

What are your thoughts on this dustin? I think setuptools provides a publish mechanism, but I don't know if that is compatible with our setup on the web heads. (something like python setup.py sdist upload ?) or maybe pip has a similar mechanism? Not sure what we need on the relengwebadm side though to achieve this, and how we'd handle authentication/authorization?

This might be more suitable than setting up full ssh access. Also not sure how we would make sure a-team couldn't accidentally change releng existing packages...

This could be one of the steps in line with our goal this year to eliminate monkey work from build duty.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

To be honest, I don't have any good ideas on how to solve this.  The sdist upload stuff seems to hard-code pypi.python.org.

The closest thing I can think of at Mozilla is the tooltool uploads, and that wound up being a decent amount of infrastructure (a dedicated VM, with a lot of puppety goodness to handle ssh logins).

Other options I can think of:

 * a checked-in manifest somewhere with names, URLs, and hashes
   - and a crontask to update that manifest and download anything not already in place
   - benefit: hashes checked regularly on all packages
   - benefit: automatically get history on why package X was added, from 'hg blame'
   - downside: delay between checkin and package appearing

 * an LDAP-authenticated webapp allowing uploads
   - this could check for filename collisions by opening files with O_EXCL
   - could be part of relengapi (meaning uploads could be scripted using tokens!)

My plate's a little full to do much of the work on either of those, but I'm happy to work with someone else!

Comment 2

[Pete Moore [:pmoore][:pete]]

Shall we close this as WONTFIX now? Or are there any new mechanisms e.g. in RelEngAPI that would enable this?