devpi-server 6.9.0

devpi-server: reliable private and pypi.org caching server

devpi-server: server for private package indexes and PyPI caching

PyPI cache

You can point pip or easy_install to the root/pypi/+simple/ index, serving as a transparent cache for pypi-hosted packages.

User specific indexes

Each user (which can represent a person, project or team) can have multiple indexes and upload packages and docs via standard twine or setup.py invocations. Users and indexes can be manipulated through devpi-client and a RESTful HTTP API.

Index inheritance

Each index can be configured to merge in other indexes so that it serves both its uploads and all releases from other index(es). For example, an index using root/pypi as a parent is a good place to test out a release candidate before you push it to PyPI.

Good defaults and easy deployment

Get started easily and create a permanent devpi-server deployment including pre-configured templates for nginx and process managers.

Separate tool for Packaging/Testing activities

The complementary devpi-client tool helps to manage users, indexes, logins and typical setup.py-based upload and installation workflows.

See https://doc.devpi.net on how to get started and further documentation.

Support

If you find a bug, use the issue tracker at Github.

For general questions use GitHub Discussions or the [e-mail] mailing list.

For support contracts and paid help contact mail at pyfidelity.com.

Changelog

6.9.0 (2023-05-23)

Features

• Support export directory layout for --replica-file-search-path option.

• Fix #931: Add mirror_no_project_list setting for mirror indexes that have no full project list like google cloud artifacts or if you want to prevent downloading the full list for huge indexes like PyPI.

Bug Fixes

• Keep a reference to async tasks to avoid their removal mid execution.

• Support changed default of enforce_content_length in urllib3 >= 2.

• Fix #934: Properly set PATH_INFO when outside URL is used with sub-path.

• Fix #945: Adapt FatalError to be usable as an async HTTP response when updating a project on a mirror.

• Fix wrong hash metadata introduced in 6.5.0 for toxresults which prevents replication. The metadata can be fixed by an export/import cycle.

6.8.0 (2022-12-05)

Features

• Fix #929: Cache normalized project names per transaction on mirror index instances.

Bug Fixes

• Fix #914: add locking to list_projects_perstage of mirror indexes to prevent multiple slow concurrent updates of the full project name list.

• Catch exceptions in async_httpget analog to httpget.

• Add locking to mirror name cache to prevent race condition on updates.

6.7.0 (2022-09-28)

Features

• Add nginx example to devpi-gen-config with caching of simple pages for installers like pip.

• Automatically check for +files when using --replica-file-search-path.

• Set headers to prevent caching for simple links with stale results.

Bug Fixes

• Fix #840: Correct url scheme in config if nginx is behind another proxy.

6.6.1 (2022-09-12)

Bug Fixes

• Fix slowdown introduced in 6.6.0 when simple links for mirrors are requested more than once in the same thread.

• Removed preservation of original server uuid during import. Imported state is different from the original server. Replicas could not detect the change and get into an inconsistent state.

• Prevent cache trashing when updating simple links on mirrors for projects with huge number of releases.

• Preserve toxresult filenames during import to keep them being accessible on the same URLs after the fix for #686 in 5.2.0.

6.6.0 (2022-08-16)

Features

• Fix #592: return dict from list_projects_perstage of mirrors where the values contain the un-normalized project name. This allows support in devpi-web 4.1.0 to index them correctly.

• Check name in project list instead of fetching project page for mirrors. This improves response times and avoids leaking typos of private package names upstream.

• Use ETag header if provided by mirror to reduce bandwidth usage and latency.

• Prevent concurrent updates of simple links on mirrors with a short lived lock.

• Support PEP-691 conformant fetching for mirrors, and requests with JSON result for installers. Proxy servers should add compression support for the application/vnd.pypi.simple.v1+json content type (gzip_types for nginx).

Bug Fixes

• Fix #743: support PEP427 escaped wheels with local version, where the + is replaced by _.

• Fix #895: store and return content of data-yanked.

• Fix #908: include basic auth from mirror_url when fetching packages.

• Fix #914: switch to write transaction as late as possible when streaming a file from a mirror.