News for hackers. Stuff that matters.

A comment on Gx: A package management tool built around IPFS.

Re:Gx: A package management tool built around IPFS by x1798DE on Wednesday March 23, 2016 @03:10PM (#11347325)
In all this discussion of npm, I wonder how PyPi stacks up. Once I tried to fix an issue with the source distribution of one of my packages on PyPi and found that I could delete it just fine, but uploading a new file with the same name failed. I tried re-uploading the original sdist, but that failed as well. Apparently once it's gone it's gone.

I eventually just uploaded a different format then quickly pushed a new version, but I was kinda disturbed that I could irreversibly break a dependency like that.

[ Parent | on HN ]
Re:Gx: A package management tool built around IPFS by svisser on Wednesday March 23, 2016 @03:35PM (#11347524)
This is probably done for security: if a package gets removed it can't be replaced by something potentially malicious. In addition, people that have tied their version numbers would get alerted this way.
[ Parent | on HN ]
Re:Gx: A package management tool built around IPFS by x1798DE on Wednesday March 23, 2016 @03:47PM (#11347616)
Yeah, but I think either I shouldn't be able to delete it in the first place or I should be able to upload the original package with an unchanged hash. The alternative is that anyone with an == dependency is now permanently broken.
[ Parent | on HN ]