=== r0bby_ is now known as robbyoconnor
[12:24] <bac> hi all, bzr seems to be missing from pypi this morning.  what's up?
[12:26] <bac> jelmer: ^^ ?  (hello, btw!)
[12:35]  * yashi_ still learning the concept of branches
[12:38] <frankban> hi all, anyone know what's happening with "pip install bzr"? It errors with "Could not find any downloads that satisfy the requirement bzr" and  https://pypi.python.org/pypi/bzr/ is a 404 indeed
[12:54] <vila> bac, frankban: I've heard confusing news from pypi, can you pinpoint when it started happening ?
[12:55] <bac> vila: it worked last night around 2300UTC but i discovered it was missing about one hour ago.
[12:55] <vila> bac: excellent, that confirms my suspicion that they broke bzr on pypi very recently
[12:56] <bac> yes.  there was the email from pypi about externally hosted files that went out recently. in it they said no action would be taken for three months.  related?
[12:58] <vila> bac: you bet
[12:59] <vila> bac: I did upload a tarball one year ago and they seem to have completely removed the project
[13:00] <bac> vila: do you know who the other pypi maintainers were?
[13:00] <vila> bac: https://bugs.launchpad.net/bzr/+bug/1323805
[13:00] <ubot5> Ubuntu bug 1323805 in Bazaar "bzr is not pip installable" [Critical,Fix released]
[13:00] <vila> bac: lifeless and poolie but I think they are screwed as me since the project is nowhere to be seen anymore on pypi
[13:03] <bac> vila: so do i read correctly in that bug that bzr 2.6.0 download file was hosted at pypi?
[13:04] <vila> bac: you read perfectly right :-/
[13:04] <vila> bac: so it seems they removed bzr because old versions weren't hosted on pypi despite the latest (and only relevant one) was
[13:04] <bac> vila: so, the email i referenced really should have not been applicable to the project
[13:04] <vila> bac: yes, I got the same email and I agree
[13:05] <bac> vila: by "they" do you think pypi admins or a bzr maintainer?
[13:05] <vila> bac: I replied this morning but no response yet
[13:05] <bac> nothing should have happened for a while.  :(
[13:05] <vila> bac: pypi, if it's a bzr maintainer..... I would be speechless ;)
[13:05] <vila> bac: it's hard enough without saboters ;-D
[13:06] <vila> bac: and what's your use case by the way ? (I'm ready for the worse)
[13:07] <bac> vila: we have test suites that rely on bzr to be pip installed in a virtualenv.  those projects now fail our CI and are doa at the moment
[13:07] <vila> bac: ok, if we're lucky CI is warning us soon enough...
[13:10] <bac> abentley, mgz: can either of you shed any light or a way forward on the pypi issue?
[13:11] <abentley> I got the same email, about another project.  I don't know what happened here.
[13:12] <mgz_> bac: nope, I have been reading along, seems we need to poke pypi admins
[13:12]  * barry waves
[13:13] <vila> barry: waves as in: you're a pypi admin ?
[13:13] <vila> barry: hi ;)
[13:13] <vila> abentley, mgz_ : hi too ;)
[13:13] <barry> vila: i'm not.  i also don't think i am an owner of bzr on pypi
[13:13] <bac> barry: i don't think anyone is now. :)
[13:13] <barry> vila: so i don't know what's going on, but two things come to mind
[13:13] <vila> barry: I think I was :-/ Well, I was able to upload
[13:14] <vila> barry: yeah, as bac said, I think nobody is anymore :-(
[13:14] <barry> (as i'm sure you know) there was some discussion on the mlist about transfering ownership from mpool.  i never saw a follow up but maybe there was a snafu there
[13:14] <barry> vila: do you know: were the tarballs hosted on pypi or externally (i.e. *only* on lp)?
[13:15] <vila> barry: I think it happens at the same time but I'm pretty sure neither lifeless nor poolie checked pypi
[13:15] <vila> barry: all were on lp *EXCEPT* 2.6.0 that was uploaded on pypi a year ago, see https://bugs.launchpad.net/bzr/+bug/1323805
[13:15] <ubot5> Ubuntu bug 1323805 in Bazaar "bzr is not pip installable" [Critical,Fix released]
[13:16] <barry> bzr 2.6.0 still comes up
[13:16] <barry> in a search, but the link 404s
[13:17] <vila> barry: yup
[13:17] <vila> barry: may be you know a pypi admin that can be poked ?
[13:17] <barry> so, the other thing that is happening recently is that pypi (and the whole stack) will stop chasing external links, so *only* tarballs hosted on pypi will be pip installable.  there are good reasons for this, but it should be something like 6mo away.  just yesterday there were some tests of the email that was going to get sent out.  i wonder if something got deployed too early
[13:18] <vila> barry: that's my gut feeling (something on the pypi side)
[13:18] <vila> bac: apart from the CI jobs (juju ?), what could be the impact from your pov ?
[13:18] <dstufft> Hi
[13:19] <barry> dstufft: hi!
[13:19] <vila> dstufft: \o/
[13:19] <barry> dstufft: i'm not a bzr admin on pypi
[13:19] <barry> dstufft: only the 2.6.0 tarball was on pypi
[13:19] <dstufft> I just registered bzr to my name on PyPI, it was deleted from PyPI by someone named "tanner" on PyPI at 2015-09-24 22:38:33
[13:19] <dstufft> the whole project was deleted
[13:19] <vila> O_o
[13:19] <barry> dstufft: so this isn't related to the external tarball thing?
[13:19] <vila> dstufft: can you revert that ?!?!
[13:19] <dstufft> Do you know who tanner is?
[13:20] <barry> i don't
[13:20] <bac> vila: we have a lot of projects (i'm mostly concerned with juju-ish ones) that rely on bzr.  so they are all affected wrt CI and automated landings
[13:20] <vila> dstufft: he is/was a bzr contributor, not sure why he had the power to delete the project
[13:20] <dstufft> barry: No, we've not made any actual changes for external tarballs yet, just emailed people to tell them that in 3 months we're going to do a thing
[13:20] <vila> bac: right, so the fire is coming, that's what I was afraid about
[13:21] <dstufft> tanner might have been spurred on by the email I sent him though
[13:21] <vila> dstufft: or clicked the wrong button and hiding under his couch right now
[13:21] <barry> dstufft: cool.  it was suspicious timing, but it sounds like its unrelated
[13:21] <dstufft> anyways, I can't really revert it. I can give it back to you and release all the filenames so you can reupload
[13:21] <dstufft> I registere dit to my name so nobody else registered it and put up something malicious
[13:22] <barry> dstufft: that sounds like a plan.  vila, bac i'm happy to co-own it if that helps
[13:22] <bac> barry: +1
[13:22] <vila> dstufft: good, I changed my password on pypi this morning in case something was wrong, 'vila', I'll deal with given back the project to the rightful owners
[13:22] <vila> barry: thanks !
[13:22] <dstufft> If you really need it, I can probably fish stuff out of a backup, but that's probably going to burn at least a day for me
[13:22] <dstufft> Ok
[13:23] <dstufft> I'll give vila admin on PyPI and let you take it from there
[13:23]  * vila runs to check if the 2.6.0 pristine tarball is still there
[13:23] <bac> vila: should be easier to re-upload than restore from backup, right?
[13:23] <barry> sounds good, thanks for the quick response!
[13:23] <bac> vila: i saw it on launchpad
[13:23] <vila> bac: yes
[13:23] <vila> dstufft: we've got a plan, thanks so much !
[13:24] <bac> thanks everyone
[13:24] <dstufft> I just removed myself from the bzr project, so it's all you now vila
[13:24] <dstufft> It'll be just a minute for me to release the filenames
[13:24] <bac> vila can you ping me when you think it is restored
[13:24] <dstufft> (once a filename is uploaded to PyPI, you can't ever reupload the same filename without me releasing it)
[13:25] <vila> bac: you bet I'll ping you to test ;)
[13:25] <bac> excelelnt
[13:25] <vila> dstufft: crystal clear and matches my expectations
[13:26]  * vila finds the 2.6.0 tarball and starts breathing again
[13:27] <vila> now to find the right setup.py command...
[13:27] <dstufft> you want twine
[13:28] <dstufft> setup.py doesn't let you upload an already created tarball
[13:28] <dstufft> (also setup.py is bad)
[13:28] <dstufft> anyways, filenames released ^
[13:29] <dstufft> gonna drop out of channel, if y'all need anything else feel free to PM me or pop into #python-infra or #pypa(-dev)
[13:30] <vila> dstufft: ack, thanks, uploading from the web page as I don't want to re-generate/sign a new tarball
[13:32] <vila> Invalid version, cannot be parsed as a valid PEP 440 version. :-(
[13:34] <vila> barry: ^
[13:36] <barry> vila: i'll jump over to #python-infra
[13:38] <vila> barry: I'm in #pypa talking with dstufft
[13:38] <barry> vila: i'm there now too
[13:38] <vila> icu
[14:59] <vila> bac: ping me once your CI jobs get greener just to make sure
[15:01] <bac> vila: one just passed CI.  i think we're good