diff --git a/peps/pep-0752.rst b/peps/pep-0752.rst index 5b6f4600696..a585f8064d0 100644 --- a/peps/pep-0752.rst +++ b/peps/pep-0752.rst @@ -186,10 +186,8 @@ Organizations ------------- Any package repository that allows for the creation of projects (e.g. -non-mirrors) MAY offer the concept of `organizations`__. Organizations -are entities that own projects and have various users associated with them. - -__ https://blog.pypi.org/posts/2023-04-23-introducing-pypi-organizations/ +non-mirrors) MAY offer the concept of organizations [6]_. Organizations are +entities that own projects and have various users associated with them. Organizations MAY reserve one or more namespaces. Such reservations neither confer ownership nor grant special privileges to existing projects. @@ -235,12 +233,12 @@ detected when any existing namespace starts with the proposed namespace. Uploads ------- -If the following criteria are all true for a given upload: +If the name of a package being uploaded matches a reserved namespace and either +of the following criteria are true: -1. The project does not yet exist. -2. The name matches a reserved namespace. -3. The project is not owned by an organization with an active grant for the - namespace. +* The project does not yet exist. +* The project is not owned by an organization with an active grant for the + namespace. Then the upload MUST fail with a 403 HTTP status code. @@ -389,6 +387,16 @@ None at this time. Rejected Ideas ============== +Granting reservations to users +------------------------------ + +As package repositories have a flat namespace, allowing any user to reserve a +namespace would be untenable not just because there would be +`contention for a finite resource`__, but also because no repository has enough +human operators to manage the vetting of an arbitrary number of users. + +__ https://en.wikipedia.org/wiki/Tragedy_of_the_commons + .. _artifact-level-association: Artifact-level Namespace Association @@ -756,6 +764,9 @@ Footnotes .. [5] `Detailed write-up `__ of the potential for provenance assertions. +.. [6] As an example, PyPI's concept of organizations is described + `here `__. + __ https://www.sphinx-doc.org/en/master/usage/extensions/index.html __ https://airflow.apache.org/docs/apache-airflow/stable/authoring-and-scheduling/plugins.html __ https://airflow.apache.org/docs/apache-airflow-providers/index.html