Welcome to the Inedo Forums! Check out the Forums Guide for help getting started.
If you are experiencing any issues with the forum software, please visit the Contact Form on our website and let us know!
PEP 700 conformance for PyPI feeds
-
Hi all,
one can request package metadata from pypi.org like this:
curl https://pypi.org/simple/psycopg/ -H "Accept: application/vnd.pypi.simple.v1+json" | jq .which returns something like this
{ "meta": { "_last-serial": 34419005, "api-version": "1.4" }, "alternate-locations": [], "name": "psycopg", "project-status": { "status": "active" }, "versions": [ "3.0b1", ... ], "files": [ { "core-metadata": { "sha256": "37f03f995769dc6eea1b48eeeed2b7dd778755d35f445712f989e302c1d33811" }, "data-dist-info-metadata": { "sha256": "37f03f995769dc6eea1b48eeeed2b7dd778755d35f445712f989e302c1d33811" }, "filename": "psycopg-3.0b1-py3-none-any.whl", "hashes": { "sha256": "fd510caaaa90aec11781c0581a8a03f847e35925db6de293404db87d625a44e8" }, "provenance": null, "requires-python": ">=3.6", "size": 131830, "upload-time": "2021-09-03T21:34:46.638478Z", "url": "https://files.pythonhosted.org/packages/4f/09/82c50c58aa2916d0bb1f46e1c4523ab34dd0513623576d1eb2aff2107d43/psycopg-3.0b1-py3-none-any.whl", "yanked": false }, { "core-metadata": false, "data-dist-info-metadata": false, "filename": "psycopg-3.0b1.tar.gz", "hashes": { "sha256": "90188a415f2132eabccfa58ae41330d3bfc1c5c410add4d6194e783521478189" }, "provenance": null, "requires-python": ">=3.6", "size": 108312, "upload-time": "2021-08-30T04:25:06.027667Z", "url": "https://files.pythonhosted.org/packages/00/9a/6a9736d77056057ff9329d02499b6f3fd71d3fa0e6ef06e35331e5082254/psycopg-3.0b1.tar.gz", "yanked": false }, ... ] }while ProGet Version 2025.23 (Build 11) currently returns something like this
{ "meta": { "api-version": "1.1" }, "name": "my-package", "files": [ { "filename": "my_package-1.2.3-py3-none-any.whl", "url": "https://proget.my-company.com/pypi/my-pypi-feed/download/my-package/1.2.3/my_package-1.2.3-py3-none-any.whl", "requires-python": ">=3.14", "core-metadata": { "sha256": "ea6628ba83f8e99d903c34a31a75b7029b2784bca386d4291c4596512d16455f" }, "hashes": { "md5": "e72e324c1ae5706266286d4153b61da0", "sha1": "7afd9775dcb2e1ec15c2d765b1b099429dd836d5", "sha256": "61ac54e62ddd357c2111097d34898f2249d2490a8d39f933febcb19da73d26e4", "sha512": "d82c3e4b7a5d5a71a0dffade0ac636689c8d8a41b5cc0412d0cf2fec1ba7c4a9248af25613a92f3352c96cb033a1466ed38c30ca33306feba091f4b2c6348d3e" } }, ... ] }Notably, the response from ProGet advertises PEP 700 conformance by specifying
"meta.api-version": "1.1". But according to the specification there should be aversionskey at the top level and asizekey per file which is missing in the response from ProGet. The specification also mentions an optionalupload-timekey per file which is also missing here.I think the
versionskey isn't as important, but I think thatsizeandupload-timecould be really useful.Providing
sizewould help tools like uv to make use of heuristics to speed up downloads which can be seen here where it sorts the wheels to be downloaded by size.Given the current wave of supply chain attacks (trivy, litellm, axos, ...), the
upload-timekey would make it possible to use dependency cooldown features like these:- https://pixi.prefix.dev/latest/reference/pixi_manifest/#exclude-newer-optional
- https://docs.astral.sh/uv/reference/settings/#exclude-newer
I don't mean to use dependency cooldowns for dependencies from my own ProGet instance but since I also mix in dependencies from pypi.org I urgently want to use dependency cooldowns for those dependencies from pypi.org but tools like uv and pixi will simply assume that there is no package version that satisfies the dependency cooldown period when the
upload-timekey is not preset. So even ifupload-timeis declared as optional according to PEP 700, I'd highly encourage adding it to the metadata response.Changing the behavior of ProGet could break existing workflows, so one would have to be careful adding new keys to the response but I'd like to hear more about what users think about adding the
sizeandupload-timekeys in particular or if even going for full PEP 700 conformance would be desirable.Cheers
-
Hi @0xFFFFFFFF,
Thanks for the detailed write-up and explanation.
It looks trivial to add
sizeandupload-time. Addingversionsis probably simple, assuming it's just an array of distinct version numbers (we already have all the "packages" in context).It's probably fine, but just to be safe we will do this in ProGet 2026, given some of the subtle behavioral changes you mentioned ("tools like uv to make use of heuristics to speed up downloads"). For someone with an overloaded server, that might "put it over the edge".
ProGet 2026 may be ready by the end of the month, so it's not so far away.
-- Dean
-
Hi Dean,
Thank you very much for the reply!
This landing in ProGet 2026 would be awesome! But of course I understand you want to be certain that those changes would not cause issues for the users, so I think having to wait a little more would be no problem for me.
-
Hi @dean-houston,
Can I confirm that this was fixed in the ProGet 2026 26.0.0 release last week?
PG-3272
Major Release ProGet 2026 We are experiencing issues with UV attempting to resolve packages that are too new when configured with the "exclude-newer" property, presumably because it's looking for the
upload-timeand notpublishedin the response.For info, we are currently seeing non-PEP 700 compliance on version 2025.27
Thanks,
Ashley -
Hi @Ashley ,
It should have been; I just double-checked and see a commit for "Add full PEP 700 conformance for PyPI feeds" that appears to add the fields discussed here and some more.
Thanks,
Steve -
This post is deleted! -
Hi @stevedennis
I upgraded our dev server to 2026.1 and we are still having issues with the upload-time property. It appears that ProGet will only add the upload-time property when the package has been pulled to ProGet, i.e. not present for remotes.
2026.1 (Build 14):
Request:$rawBytes = (Invoke-WebRequest http://proget-server/pypi/pypi-public/simple/ty -Headers @{ "Accept" = "application/vnd.pypi.simple.v1+json" }).content [System.Text.Encoding]::UTF8.GetString($rawBytes) | Out-File "c:\test.json"Response:
{ "meta": { "api-version": "1.1" }, "name": "ty", "versions": [ "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.22", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", "0.0.23", ... //Excluded for brevity "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39", "0.0.39" ], "files": [ { "filename": "ty-0.0.22.tar.gz", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.22/ty-0.0.22.tar.gz", "requires-python": ">=3.8", "size": 5333861, "upload-time": "2026-05-25T08:36:56.833Z", "hashes": { "md5": "4771ed89add13f88713a6db3875afc5c", "sha1": "1ea16ea77d71ced631d577066855c9ca2bc8d498", "sha256": "391fc4d3a543950341b750d7f4aa94866a73e7cdbf3e9e4e4e8cfc8b7bef4f10", "sha512": "4e1b256aae7d7ae6f5349cd865e03d13c00f6e64183a8c06e6d22438aef6f771aa84da80bd27c280cb3b378c6887c77e559b25ea6366823dfd2629808af1364c" } }, { "filename": "ty-0.0.22-py3-none-linux_armv6l.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.22/ty-0.0.22-py3-none-linux_armv6l.whl", "requires-python": ">=3.8", "size": 10328232, "upload-time": "2026-05-25T08:36:26.603Z", "core-metadata": { "sha256": "91b9b58596f18ff672976d7f04dcab28e9b5ada579303470779c7e2a3be0d131" }, "hashes": { "md5": "bcfc8be7ece186f373fa0f1c43d4ba31", "sha1": "04bb25267d898b6cb4b2586e14639f85820b2fe9", "sha256": "03d37220d81016cb9d2a9c9ec11704d84f2df838f1dbf1296d91ea7fba57f8b5", "sha512": "b79e054a90040dc6624f5556dd7444f50a3ad3ffd2d7b64f758a5a69b376e92dc246428599df78d9995c86207bb697eddbf2386898a1f61c50cbee8e71384de8" } }, ... //Excluded for brevity { "filename": "ty-0.0.23.tar.gz", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.23/ty-0.0.23.tar.gz", "requires-python": ">=3.8", "size": 5341461, "upload-time": "2026-03-13T12:34:23Z", "hashes": { "md5": "c220bcee84ca26a01a2479388d4ad7af", "sha1": "75dd14d7fcbd3f56313886a1b46c23481930bc76", "sha256": "5fb05db58f202af366f80ef70f806e48f5237807fe424ec787c9f289e3f3a4ef", "sha512": "1dcd3d9a55d0734db1b1335f89db36b3b70d0c77112ad667dc24d556c5e122b6d8b0fced5fc19b99a292bbd98ab0ec0a92aebfe50047e37d627ad3442b2b2ef1" } }, { "filename": "ty-0.0.23-py3-none-linux_armv6l.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.23/ty-0.0.23-py3-none-linux_armv6l.whl", "requires-python": ">=3.8", "size": 10329096, "upload-time": "2026-03-13T12:34:09Z", "core-metadata": { "sha256": "6367da298c587b4db7c8709f079114d1dbbc9f748735deefb4179e295b7a1bb2" }, "hashes": { "md5": "62bc86fe02c8109ab3a619b2b5196fa2", "sha1": "dedbdef7ad32e50890f667cd2e8ae2a64ef28625", "sha256": "e810eef1a5f1cfc0731a58af8d2f334906a96835829767aed00026f1334a8dd7", "sha512": "b615aaa871792d14c9ad725ed54c9749976da032eaf19e278787094308ab9ca7438c4d3e4ae46132b783d43a8e6fcf4643b0b9b9cf4450e181edb126e13493ec" } }, ... //Excluded for brevity { "filename": "ty-0.0.39-py3-none-linux_armv6l.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-linux_armv6l.whl", "requires-python": ">=3.8", "size": 11360431, "hashes": { "sha256": "c1bb7ac70f1f7d70cc6655fd96558039e4562b10f489fa49c7ebfd5fcee73ad1" } }, { "filename": "ty-0.0.39-py3-none-macosx_10_12_x86_64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-macosx_10_12_x86_64.whl", "requires-python": ">=3.8", "size": 11096281, "hashes": { "sha256": "3435b64c1e59c14c9aa39c20cc018823937cd38d55db853e74d95b8f420569b0" } }, { "filename": "ty-0.0.39-py3-none-macosx_11_0_arm64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-macosx_11_0_arm64.whl", "requires-python": ">=3.8", "size": 10529674, "hashes": { "sha256": "5f136377ce46c73677701a9e1ad730bf72f699bcec046e422eb79d0886cac3ab" } }, { "filename": "ty-0.0.39-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", "requires-python": ">=3.8", "size": 11055561, "hashes": { "sha256": "36b65fb0cc17f03e851d40e210d420be94ab8bc52d041328ad1e45f616036a61" } }, { "filename": "ty-0.0.39-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", "requires-python": ">=3.8", "size": 11127185, "hashes": { "sha256": "4967967bfadf3860ff84c3fccdbaec8edf8aa20d0d727521084733d853de6657" } }, { "filename": "ty-0.0.39-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", "requires-python": ">=3.8", "size": 11608459, "hashes": { "sha256": "9e10ecb1297099ddf9a1f054f8bd921d1863ce85fb819a3c96ed27865a1ba6ed" } }, { "filename": "ty-0.0.39-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", "requires-python": ">=3.8", "size": 12177101, "hashes": { "sha256": "9b19cca70e465d71b0510656343883d62372bbe74b7845cae7c0e701d6d5264b" } }, { "filename": "ty-0.0.39-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", "requires-python": ">=3.8", "size": 11827815, "hashes": { "sha256": "56c6704b01b9b3d80ff26b2918423b742516d1e469bef830e9254dcedc9185bf" } }, { "filename": "ty-0.0.39-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", "requires-python": ">=3.8", "size": 11694429, "hashes": { "sha256": "40b7840ff46764b6a6757f4ade1cd0530fc3e8a0b435ca93e7602360e4cb90b6" } }, { "filename": "ty-0.0.39-py3-none-manylinux_2_31_riscv64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-manylinux_2_31_riscv64.whl", "requires-python": ">=3.8", "size": 11869846, "hashes": { "sha256": "1c62a3a87ce26b50819f0dbf03bd95f23f19eeb87bbc7aa732ec64277c77f1aa" } }, { "filename": "ty-0.0.39-py3-none-musllinux_1_2_aarch64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-musllinux_1_2_aarch64.whl", "requires-python": ">=3.8", "size": 11029763, "hashes": { "sha256": "f8c34bc81a9c3516e49904e9d8330aac385377cca98390193ea02b903a40fcf0" } }, { "filename": "ty-0.0.39-py3-none-musllinux_1_2_armv7l.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-musllinux_1_2_armv7l.whl", "requires-python": ">=3.8", "size": 11146761, "hashes": { "sha256": "66f5ab11586a64e79cb692ad685ee5469325c31b5f30bd3554f52f36dbe28cc4" } }, { "filename": "ty-0.0.39-py3-none-musllinux_1_2_i686.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-musllinux_1_2_i686.whl", "requires-python": ">=3.8", "size": 11281843, "hashes": { "sha256": "e8d89732bcbbcb091f439e556dfc4932f198b118b47d5b85212c60662099670e" } }, { "filename": "ty-0.0.39-py3-none-musllinux_1_2_x86_64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-musllinux_1_2_x86_64.whl", "requires-python": ">=3.8", "size": 11792477, "hashes": { "sha256": "eceb6c91dcd05a231119f82abdd9aa337513de23ca6ac990bc44f88791dc1799" } }, { "filename": "ty-0.0.39-py3-none-win32.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-win32.whl", "requires-python": ">=3.8", "size": 10615377, "hashes": { "sha256": "891c3262314dbc80bf3e872634d23dd216306945daa9a9fcc206ce5ed21ac4c9" } }, { "filename": "ty-0.0.39-py3-none-win_amd64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-win_amd64.whl", "requires-python": ">=3.8", "size": 11710711, "hashes": { "sha256": "ba7f2d54452535419e90f6f03ff39282999e87b43c21c00559f6d7ad711a36d5" } }, { "filename": "ty-0.0.39-py3-none-win_arm64.whl", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39-py3-none-win_arm64.whl", "requires-python": ">=3.8", "size": 11081409, "hashes": { "sha256": "eb4cf0fefbbfedf9a352597bb2431ebdcb7eb3a595c0f825f228e897a0ec285d" } }, { "filename": "ty-0.0.39.tar.gz", "url": "http://proget-server/pypi/pypi-public/download/ty/0.0.39/ty-0.0.39.tar.gz", "requires-python": ">=3.8", "size": 5702365, "hashes": { "sha256": "f750277e76a01ecd86185960eca73823c26a53c51103568d56d4d904575159fd" } } ] }Note: Only versions 0.0.22 and 0.0.23 have the upload-time property, this is because I manually pulled these version to ProGet.
upload-timeshould always be present prior to pulls so that client package managers like uv withexclude-newer = "7 days"can avoid pulling new packages that will be blocked by ProGet due to non-compliance rules. -
-
Hi Alana,
Thanks for investigating! Is the maintenance release this Friday or the week after?
-
Hi @Ashley ,
We're planning this Friday... though it may not make it. Hopefully!
It's a bit more involved, since it involves calling the separate API instead of the simple API.
Cheers,
Alana -
Hi @Ashley,
It turns out that we just weren't reading
upload-timefrom the upstream json when using the simple API, so this was pretty trivial to fix and we'll certainly be able to include it in tomorrow's release. Here's the abbreviated result of a quick local test I did after making the fix (also after fixing the issue with the duplicated versions):{ "meta": { "api-version": "1.1" }, "name": "psycopg", "versions": [ "3.0b1", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.2.0", "3.2.1", "3.2.2", "3.2.3", "3.2.4", "3.2.5", "3.2.6", "3.2.7", "3.2.8", "3.2.9", "3.2.10", "3.2.11", "3.2.12", "3.2.13", "3.3.0", "3.3.1", "3.3.2", "3.3.3", "3.3.4" ], "files": [ { "filename": "psycopg-3.0b1-py3-none-any.whl", "url": "http://localhost:5000/pypi/snake/download/psycopg/3.0b1/psycopg-3.0b1-py3-none-any.whl", "requires-python": ">=3.6", "size": 131830, "upload-time": "2021-09-03T21:34:46.638478Z", "hashes": { "sha256": "fd510caaaa90aec11781c0581a8a03f847e35925db6de293404db87d625a44e8" } }, { "filename": "psycopg-3.0b1.tar.gz", "url": "http://localhost:5000/pypi/snake/download/psycopg/3.0b1/psycopg-3.0b1.tar.gz", "requires-python": ">=3.6", "size": 108312, "upload-time": "2021-08-30T04:25:06.027667Z", "hashes": { "sha256": "90188a415f2132eabccfa58ae41330d3bfc1c5c410add4d6194e783521478189" } }, { "filename": "psycopg-3.0-py3-none-any.whl", "url": "http://localhost:5000/pypi/snake/download/psycopg/3.0/psycopg-3.0-py3-none-any.whl", "requires-python": ">=3.6", "size": 140812, "upload-time": "2021-10-12T16:20:12.084578Z", "hashes": { "sha256": "65b9fb8838dae61040ad3e0cfc184d4ffd17f740ef4c0353d76050a6eb061a9c" } } //...SNIP ] } -
Hi,
We just upgraded to 2026.2 and it looks good, thanks for getting the update out so quick!
-
@Ashley thanks for letting us know!
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login