devpi-server 6.14.0__tar.gz → 6.16.0__tar.gz

{devpi-server-6.14.0 → devpi_server-6.16.0}/.flake8

@@ -1,9 +1,9 @@
 [flake8]
-ignore = E501,E741,W503
+# E203 is ignored because we enforce ruff format which contradicts it
+ignore = E203,E501,E704,E741,W503
 per-file-ignores =
     plugin.py:E127,E128,E225,E231
     importexport.py:E127
     model.py:E128,E225,E231
-    setup.py:E121,E126
     test_importexport.py:E121
     test*.py:E126,E127,E128,E225,E226,E231,E251

{devpi-server-6.14.0 → devpi_server-6.16.0}/CHANGELOG

@@ -2,6 +2,42 @@
 
 .. towncrier release notes start
 
+6.16.0 (2025-06-25)
+===================
+
+Deprecations and Removals
+-------------------------
+
+- Dropped support for Python 3.7 and 3.8.
+
+
+
+Features
+--------
+
+- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
+
+
+
+Bug Fixes
+---------
+
+- Preserve hash when importing mirror data to prevent unnecessary updates later on.
+
+- Keep original metadata_version in database.
+
+
+
+6.15.0 (2025-05-18)
+===================
+
+Features
+--------
+
+- Add ``--connection-limit`` option to devpi-server passed on to waitress.
+
+
+
 6.14.0 (2024-10-16)
 ===================
 

devpi_server-6.16.0/CHANGELOG.short.rst

@@ -0,0 +1,116 @@
+
+
+=========
+Changelog
+=========
+
+
+
+
+.. towncrier release notes start
+
+6.16.0 (2025-06-25)
+===================
+
+Deprecations and Removals
+-------------------------
+
+- Dropped support for Python 3.7 and 3.8.
+
+
+
+Features
+--------
+
+- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
+
+
+
+Bug Fixes
+---------
+
+- Preserve hash when importing mirror data to prevent unnecessary updates later on.
+
+- Keep original metadata_version in database.
+
+
+
+6.15.0 (2025-05-18)
+===================
+
+Features
+--------
+
+- Add ``--connection-limit`` option to devpi-server passed on to waitress.
+
+
+
+6.14.0 (2024-10-16)
+===================
+
+Features
+--------
+
+- Allow pushing of versions which only have documentation and no releases.
+
+- Allow pushing of release files only with no documentation. Requires devpi-client 7.2.0.
+
+- Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0.
+
+
+
+Bug Fixes
+---------
+
+- No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry.
+
+
+
+6.13.0 (2024-09-19)
+===================
+
+Deprecations and Removals
+-------------------------
+
+- Remove/Deprecate "master" related terminology in favor of "primary".
+  Usage related changes are the switch to ``--primary-url`` instead of ``--master-url`` and ``--role=primary`` instead of ``--role=master``.
+  Using the old terms will now output warnings.
+  The ``+status`` API has additional fields and the ``role`` field content will change with 7.0.0.
+
+
+
+Features
+--------
+
+- Enable logging command line options for all commands.
+
+- Added support uv pip as an installer.
+
+
+
+Bug Fixes
+---------
+
+- Don't report on lagging event processing while replicating.
+
+- Report primary serial correctly with streaming replication.
+
+- Don't store file data in memory when fetching a release while pushing from a mirror.
+
+- Only warn about replica not being in sync instead of fatal status while still replicating.
+
+
+
+6.12.1 (2024-07-24)
+===================
+
+Bug Fixes
+---------
+
+- Support Python 3.13 by depending on legacy-cgi.
+
+- Preserve query string when proxying requests from replica to primary. This fixes force removal on non-volatile indexes and probably other bugs.
+
+- Fix #1044: Correctly update cache expiry time when mirrored server returns 304 Not Modified.
+
+

{devpi-server-6.14.0 → devpi_server-6.16.0}/MANIFEST.in

@@ -1,4 +1,6 @@
 include .flake8 CHANGELOG *.ini *.rst LICENSE
-recursive-include devpi_server *.template 
+recursive-include devpi_server py.typed
+recursive-include devpi_server *.template
+recursive-include test_devpi_server py.typed
 recursive-include test_devpi_server *.py
 recursive-include test_devpi_server/importexportdata *.gz* *.json

{devpi-server-6.14.0 → devpi_server-6.16.0}/PKG-INFO

@@ -1,37 +1,51 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: devpi-server
-Version: 6.14.0
-Summary: devpi-server: reliable private and pypi.org caching server
-Home-page: https://devpi.net
-Maintainer: Florian Schulze
-Maintainer-email: mail@pyfidelity.com
-License: MIT
+Version: 6.16.0
+Summary: devpi-server: reliable, private, and pypi.org caching server
+Maintainer-email: Florian Schulze <mail@pyfidelity.com>
+License-Expression: MIT
 Project-URL: Bug Tracker, https://github.com/devpi/devpi/issues
 Project-URL: Changelog, https://github.com/devpi/devpi/blob/main/server/CHANGELOG
 Project-URL: Documentation, https://doc.devpi.net
 Project-URL: Funding, https://github.com/sponsors/devpi
+Project-URL: Homepage, https://devpi.net
 Project-URL: Source Code, https://github.com/devpi/devpi
-Keywords: pypi realtime cache server
+Keywords: pypi,realtime,cache,server
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Web Environment
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Topic :: Internet :: WWW/HTTP
-Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
-Classifier: Programming Language :: Python :: Implementation :: PyPy
-Classifier: Programming Language :: Python :: 3.7
-Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
-Requires-Python: >=3.7
+Classifier: Programming Language :: Python :: Implementation :: PyPy
+Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.9
+Description-Content-Type: text/x-rst
 License-File: LICENSE
-License-File: AUTHORS
+Requires-Dist: argon2-cffi
+Requires-Dist: attrs>=22.2.0
+Requires-Dist: defusedxml
+Requires-Dist: devpi_common<5,>3.6.0
+Requires-Dist: httpx
+Requires-Dist: itsdangerous>=0.24
+Requires-Dist: lazy
+Requires-Dist: legacy-cgi; python_version >= "3.13"
+Requires-Dist: passlib[argon2]
+Requires-Dist: platformdirs
+Requires-Dist: pluggy<2.0,>=0.6.0
+Requires-Dist: py>=1.4.23
+Requires-Dist: pyramid>=2
+Requires-Dist: repoze.lru>=0.6
+Requires-Dist: strictyaml
+Requires-Dist: waitress>=1.0.1
+Requires-Dist: ruamel.yaml
+Dynamic: license-file
 
 =============================================================================
 devpi-server: server for private package indexes and PyPI caching
@@ -97,14 +111,52 @@ For support contracts and paid help contact ``mail at pyfidelity.com``.
 .. _GitHub Discussions: https://github.com/devpi/devpi/discussions
 
 
+
 =========
 Changelog
 =========
 
 
 
+
 .. towncrier release notes start
 
+6.16.0 (2025-06-25)
+===================
+
+Deprecations and Removals
+-------------------------
+
+- Dropped support for Python 3.7 and 3.8.
+
+
+
+Features
+--------
+
+- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
+
+
+
+Bug Fixes
+---------
+
+- Preserve hash when importing mirror data to prevent unnecessary updates later on.
+
+- Keep original metadata_version in database.
+
+
+
+6.15.0 (2025-05-18)
+===================
+
+Features
+--------
+
+- Add ``--connection-limit`` option to devpi-server passed on to waitress.
+
+
+
 6.14.0 (2024-10-16)
 ===================
 
@@ -174,43 +226,3 @@ Bug Fixes
 - Fix #1044: Correctly update cache expiry time when mirrored server returns 304 Not Modified.
 
 
-
-6.12.0 (2024-06-25)
-===================
-
-Features
---------
-
-- Added ``devpiserver_on_toxresult_store`` hook to allow blocking or skipping a toxresult upload on more specific conditions as ``acl_toxresult_upload`` would allow.
-
-- Added ``devpiserver_on_toxresult_upload_forbidden`` hook to allow returning a custom message and result (403 or 200).
-
-
-
-Bug Fixes
----------
-
-- Return json data if toxresult upload is forbidden.
-
-
-
-6.11.0 (2024-04-20)
-===================
-
-Features
---------
-
-- The ``devpi-fsck`` script now returns an error code when there have been missing files or checksum errors.
-
-- Fix #983: Add plugin hook for mirror authentication header.
-
-
-
-Bug Fixes
----------
-
-- Preserve last modified of docs and toxresults during export/import.
-
-- Fix #1033: Use ``int`` for ``--mirror-cache-expiry`` to fix value of ``proxy_cache_valid`` in nginx caching config.
-
-

devpi_server-6.16.0/devpi_server/__init__.py

@@ -0,0 +1 @@
+__version__ = "6.16.0"

{devpi-server-6.14.0 → devpi_server-6.16.0}/devpi_server/auth.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import base64
 import hashlib
 import itertools
@@ -6,6 +8,12 @@ import secrets
 from .log import threadlog
 from passlib.context import CryptContext
 from passlib.utils.handlers import MinimalHandler
+from typing import TYPE_CHECKING
+
+
+if TYPE_CHECKING:
+    from typing import Any
+    from typing import Union
 
 
 notset = object()
@@ -133,7 +141,7 @@ class Auth:
                 username,
                 result.get("groups", []),
                 result.get("from_user_object", False)])
-            assert not isinstance(pseudopass, str) or pseudopass.encode('ascii')  # type: ignore[attr-defined]
+            assert not isinstance(pseudopass, str) or pseudopass.encode("ascii")
             return {"password": pseudopass,
                     "expiration": self.LOGIN_EXPIRATION}
 
@@ -175,7 +183,7 @@ class DevpiHandler(MinimalHandler):
         return "%s:%s" % (salt, hash)
 
     @classmethod
-    def verify(cls, secret, hash):
+    def verify(cls, secret: Union[str, bytes], hash: Union[str, bytes], **context_kwds: Any) -> Any:  # noqa: A002, ARG003
         (salt, hash) = cls._get_salt_and_hash(hash)
         return salt and hash and (getpwhash(secret, salt) == hash)
 

{devpi-server-6.14.0 → devpi_server-6.16.0}/devpi_server/config.py

@@ -56,6 +56,24 @@ def get_pluginmanager(load_entrypoints=True):
     return pm
 
 
+def traced_pluggy_call(hook, **caller_kwargs):
+    firstresult = hook.spec.opts.get("firstresult", False) if hook.spec else False
+    results = []
+    plugin_names = []
+    hookimpls = hook._hookimpls if hasattr(hook, '_hookimpls') else hook.get_hookimpls()
+    for hook_impl in reversed(hookimpls):
+        args = [caller_kwargs[argname] for argname in hook_impl.argnames]
+        res = hook_impl.function(*args)
+        if res is not None:
+            results.append(res)
+            plugin_names.append(hook_impl.plugin_name)
+            if firstresult:
+                break
+    if firstresult:
+        results = results[0] if results else None
+    return (results, plugin_names)
+
+
 def add_help_option(parser, pluginmanager):
     parser.addoption(
         "-h", "--help",
@@ -155,6 +173,11 @@ def add_web_options(parser, pluginmanager):
         default=50,
         help="number of threads to start for serving clients.")
 
+    parser.addoption(
+        "--connection-limit", type=int,
+        default=100,
+        help="maximum number of simultaneous client connections.")
+
     parser.addoption(
         "--trusted-proxy", type=str,
         help="IP address of proxy we trust. See waitress documentation.")
@@ -332,10 +355,6 @@ def add_secretfile_option(parser, pluginmanager):
              "validation. If not specified, a random secret is "
              "generated on each start up.")
 
-
-def add_deploy_options(parser, pluginmanager):
-    add_secretfile_option(parser, pluginmanager)
-
     parser.addoption(
         "--argon2-memory-cost", type=int, default=DEFAULT_ARGON2_MEMORY_COST,
         help=argparse.SUPPRESS)
@@ -348,6 +367,10 @@ def add_deploy_options(parser, pluginmanager):
         "--argon2-time-cost", type=int, default=DEFAULT_ARGON2_TIME_COST,
         help=argparse.SUPPRESS)
 
+
+def add_deploy_options(parser, pluginmanager):
+    add_secretfile_option(parser, pluginmanager)
+
     parser.addoption(
         "--requests-only", action="store_true",
         help="only start as a worker which handles read/write web requests "
@@ -446,8 +469,9 @@ def find_config_file():
             config_files.append(config_file)
     if len(config_files) > 1:
         log.warning("Multiple configuration files found:\n%s", "\n".join(config_files))
-    if len(config_files):
-        return config_files[-1]
+    if not config_files:
+        return None
+    return config_files[-1]
 
 
 class InvalidConfigError(ValueError):
@@ -680,6 +704,8 @@ class Config(object):
             kwargs["trusted_proxy_count"] = self.args.trusted_proxy_count
         if self.args.trusted_proxy_headers is not None:
             kwargs["trusted_proxy_headers"] = self.args.trusted_proxy_headers
+        if self.args.connection_limit is not None:
+            kwargs["connection_limit"] = self.args.connection_limit
         return dict(kwargs=kwargs, addresses=addresses)
 
     @cached_property
@@ -1099,10 +1125,6 @@ class Config(object):
         return self.get_derived_key(b'devpi-server-replica')
 
 
-def getpath(path):
-    return py.path.local(os.path.expanduser(str(path)))
-
-
 def gensecret():
     from .log import threadlog as log
     from .main import CommandRunner

{devpi-server-6.14.0 → devpi_server-6.16.0}/devpi_server/filestore.py

@@ -5,6 +5,7 @@ for all indexes.
 """
 import hashlib
 import mimetypes
+from .readonly import get_mutable_deepcopy
 from wsgiref.handlers import format_date_time
 import re
 from devpi_common.metadata import splitbasename
@@ -333,7 +334,7 @@ class FileStore:
 
     def maplink(self, link, user, index, project):
         key = key_from_link(self.keyfs, link, user, index)
-        entry = FileEntry(key, readonly=False)
+        entry = MutableFileEntry(key)
         entry.url = link.geturl_nofragment().url
         entry.hash_spec = unicode_if_bytes(link.hash_spec)
         entry.project = project
@@ -357,14 +358,14 @@ class FileStore:
             return None
         return key
 
-    def get_file_entry(self, relpath, readonly=True):
+    def get_file_entry(self, relpath):
         key = self.get_key_from_relpath(relpath)
         if key is None:
             return None
-        return self.get_file_entry_from_key(key, readonly=readonly)
+        return FileEntry(key)
 
-    def get_file_entry_from_key(self, key, meta=_nodefault, readonly=True):
-        return FileEntry(key, meta=meta, readonly=readonly)
+    def get_file_entry_from_key(self, key, meta=_nodefault):
+        return MutableFileEntry(key, meta=meta)
 
     def store(self, user, index, basename, content_or_file, *, dir_hash_spec=None, hashes=None):
         # dir_hash_spec is set for toxresult files
@@ -376,7 +377,7 @@ class FileStore:
         key = self.keyfs.STAGEFILE(
             user=user, index=index,
             hashdir_a=hashdir_a, hashdir_b=hashdir_b, filename=basename)
-        entry = FileEntry(key, readonly=False)
+        entry = MutableFileEntry(key)
         entry.file_set_content(content_or_file, hashes=hashes)
         return entry
 
@@ -401,8 +402,9 @@ class BadGateway(Exception):
         self.url = url
 
 
-class FileEntry(object):
-    __slots__ = ('_meta', '_storepath', 'basename', 'key', 'readonly', 'relpath')
+class BaseFileEntry:
+    __slots__ = ("_meta", "_storepath", "basename", "key", "relpath")
+
     BadGateway = BadGateway
     _hash_spec = metaprop("hash_spec")  # e.g. "md5=120938012"
     last_modified = metaprop("last_modified")
@@ -410,11 +412,10 @@ class FileEntry(object):
     project = metaprop("project")
     version = metaprop("version")
 
-    def __init__(self, key, meta=_nodefault, readonly=True):
+    def __init__(self, key, meta=_nodefault):
         self.key = key
         self.relpath = key.relpath
         self.basename = self.relpath.split("/")[-1]
-        self.readonly = readonly
         self._storepath = "/".join(("+files", str(self.relpath)))
         self._meta = _nodefault
         if meta is not _nodefault:
@@ -517,9 +518,7 @@ class FileEntry(object):
 
     @property
     def meta(self):
-        if self._meta is _nodefault:
-            self._meta = self.key.get(readonly=self.readonly)
-        return self._meta
+        raise NotImplementedError
 
     def file_exists(self):
         return self.tx.conn.io_file_exists(self._storepath)
@@ -531,7 +530,10 @@ class FileEntry(object):
         return self.tx.conn.io_file_size(self._storepath)
 
     def __repr__(self):
-        return f"<FileEntry {self.key!r}>"
+        return f"<{self.__class__.__name__} {self.key!r}>"
+
+    def file_new_open(self):
+        return self.tx.conn.io_file_new_open(self._storepath)
 
     def file_open_read(self):
         return self.tx.conn.io_file_open(self._storepath)
@@ -563,6 +565,9 @@ class FileEntry(object):
         # changed which will not replay correctly at a replica.
         self.key.set(self.meta)
 
+    def file_set_content_no_meta(self, content_or_file, *, hashes=None):  # noqa: ARG002
+        self.tx.conn.io_file_set(self._storepath, content_or_file)
+
     def gethttpheaders(self):
         assert self.file_exists()
         headers = {}
@@ -605,6 +610,30 @@ class FileEntry(object):
         return None
 
 
+class FileEntry(BaseFileEntry):
+    @property
+    def meta(self):
+        if self._meta is _nodefault:
+            self._meta = self.key.get()
+        return self._meta
+
+    @property
+    def readonly(self):
+        return True
+
+
+class MutableFileEntry(BaseFileEntry):
+    @property
+    def meta(self):
+        if self._meta is _nodefault:
+            self._meta = get_mutable_deepcopy(self.key.get())
+        return self._meta
+
+    @property
+    def readonly(self):
+        return False
+
+
 def get_checksum_error(content_or_hash, relpath, hash_spec):
     warnings.warn(
         "The get_checksum_error function is deprecated, "

{devpi-server-6.14.0 → devpi_server-6.16.0}/devpi_server/hookspecs.py

@@ -158,6 +158,12 @@ def devpiserver_get_identity(request, credentials):
     """
 
 
+@hookspec
+def devpiserver_identity_loaded(request, credential_plugin_name, identity_plugin_name, identity):
+    """ called when identity is loaded for a request.
+    """
+
+
 @hookspec(warn_on_impl=DeprecationWarning("Use new devpiserver_auth_request hook instead"))
 def devpiserver_auth_user(userdict, username, password):
     """return dict containing authentication validation results.

{devpi-server-6.14.0 → devpi_server-6.16.0}/devpi_server/importexport.py

@@ -257,7 +257,7 @@ class IndexDump:
 
     def dump_releasefiles(self, linkstore):
         for link in linkstore.get_links(rel="releasefile"):
-            entry = self.exporter.filestore.get_file_entry(link.entrypath)
+            entry = self.exporter.filestore.get_file_entry(link.relpath)
             if not entry.last_modified:
                 continue
             if not entry.file_exists():
@@ -279,13 +279,15 @@ class IndexDump:
                 self.basedir.join(linkstore.project, reflink._hash_spec,
                                   tox_link.basename)
             )
-            self.add_filedesc(type="toxresult",
-                              project=linkstore.project,
-                              relpath=relpath,
-                              version=linkstore.version,
-                              entrymapping=tox_link.entry.meta,
-                              for_entrypath=reflink.entrypath,
-                              log=tox_link.get_logs())
+            self.add_filedesc(
+                type="toxresult",
+                project=linkstore.project,
+                relpath=relpath,
+                version=linkstore.version,
+                entrymapping=tox_link.entry.meta,
+                for_entrypath=reflink.relpath,
+                log=tox_link.get_logs(),
+            )
 
     def add_filedesc(self, type, project, relpath, **kw):
         if not self.exporter.basepath.join(relpath).check():
@@ -580,7 +582,10 @@ class Importer:
                 (_, links_with_data, serial) = stage._load_cache_links(project)
                 if links_with_data is None:
                     links_with_data = []
-                links = [(url.basename, entry.relpath)]
+                entrypath = entry.relpath
+                if hash_spec := entry.best_available_hash_spec:
+                    entrypath = f"{entrypath}#{hash_spec}"
+                links = [(url.basename, entrypath)]
                 requires_python = [versions[version].get('requires_python')]
                 yanked = [versions[version].get('yanked')]
                 for key, href, require_python, is_yanked in links_with_data:
@@ -618,6 +623,7 @@ class Importer:
                 hashes=hashes, last_modified=last_modified)
         else:
             msg = f"unknown file type: {type}"
+            f.close()
             raise Fatal(msg)
         if link is not None:
             history_log = filedesc.get('log')