devpi-server 6.17.0__tar.gz → 6.19.0__tar.gz

{devpi_server-6.17.0 → devpi_server-6.19.0}/.flake8

@@ -3,7 +3,6 @@
 ignore = E203,E501,E704,E741,W503
 per-file-ignores =
     plugin.py:E127,E128,E231
-    importexport.py:E127
     model.py:E128,E231
     test_importexport.py:E121
     test*.py:E126,E127,E128,E225,E226,E231,E251

{devpi_server-6.17.0 → devpi_server-6.19.0}/CHANGELOG

@@ -2,6 +2,66 @@
 
 .. towncrier release notes start
 
+6.19.0 (2026-02-06)
+===================
+
+Features
+--------
+
+- Add ``--autocreate-users`` server option.
+  Automatically creates users that don't exist in devpi, but have successfully authenticated via an authentication plugin.
+  A typical example of when to enable this would be when authenticating via an LDAP directory.
+  Automatically created users do not have passwords, and have no password hash to prevent local authentication.
+
+- Add ``replica-files-in-sync-at``, ``replica-init-queue-finished-at`` and ``replica-metadata-in-sync-at`` to status view, the existing ``replica-in-sync-at`` is now a combination of all three instead of just metadata.
+
+- Warn when an unknown option is found in config file to detect typos. Be aware that some commands don't use all the options, that is why this only warns instead of exiting.
+
+- Add new ``devpiserver_user_created`` hook which can be used to create default indexes or other setup for newly created users.
+
+Bug Fixes
+---------
+
+- Fix ``+status`` json encoding errors by making sure the ``FatalResponse.url`` attribute is a string.
+
+- Ignore existing unknown index options from uninstalled plugins when patching other options with ``+=`` and ``-=``.
+
+- Fix removal with ``-=`` of index options with default values from ``devpiserver_indexconfig_defaults`` hooks.
+
+- Fix #1110: a list for the ``listen`` option in a config file stopped working in 6.18.0.
+
+
+6.18.0 (2026-01-27)
+===================
+
+Features
+--------
+
+- Store all available hashes of files.
+
+- Validate hashes of all files during devpi-import, not only releases.
+
+Bug Fixes
+---------
+
+- Apply argparse transformations on values read from config file or environment.
+
+- Restore Python and platform info in user agent string after switch to httpx.
+
+- Remove all database entries on project deletion instead of only emptying them.
+
+- Fix error at end of replica streaming caused by changed behavior from switch to httpx.
+
+- Fix #1102: The data stream was cut off after 64k when proxying from replica to primary after switching to httpx.
+
+- Fix #1107: retry file downloads if there has been an error during download.
+
+Other Changes
+-------------
+
+- The filenames of some exported doczip files change due to normalization of the project name caused by changing the internals during export to allow ``--hard-links`` to work.
+
+
 6.17.0 (2025-08-27)
 ===================
 

{devpi_server-6.17.0 → devpi_server-6.19.0}/CHANGELOG.short.rst

@@ -9,6 +9,66 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.0 (2026-02-06)
+===================
+
+Features
+--------
+
+- Add ``--autocreate-users`` server option.
+  Automatically creates users that don't exist in devpi, but have successfully authenticated via an authentication plugin.
+  A typical example of when to enable this would be when authenticating via an LDAP directory.
+  Automatically created users do not have passwords, and have no password hash to prevent local authentication.
+
+- Add ``replica-files-in-sync-at``, ``replica-init-queue-finished-at`` and ``replica-metadata-in-sync-at`` to status view, the existing ``replica-in-sync-at`` is now a combination of all three instead of just metadata.
+
+- Warn when an unknown option is found in config file to detect typos. Be aware that some commands don't use all the options, that is why this only warns instead of exiting.
+
+- Add new ``devpiserver_user_created`` hook which can be used to create default indexes or other setup for newly created users.
+
+Bug Fixes
+---------
+
+- Fix ``+status`` json encoding errors by making sure the ``FatalResponse.url`` attribute is a string.
+
+- Ignore existing unknown index options from uninstalled plugins when patching other options with ``+=`` and ``-=``.
+
+- Fix removal with ``-=`` of index options with default values from ``devpiserver_indexconfig_defaults`` hooks.
+
+- Fix #1110: a list for the ``listen`` option in a config file stopped working in 6.18.0.
+
+
+6.18.0 (2026-01-27)
+===================
+
+Features
+--------
+
+- Store all available hashes of files.
+
+- Validate hashes of all files during devpi-import, not only releases.
+
+Bug Fixes
+---------
+
+- Apply argparse transformations on values read from config file or environment.
+
+- Restore Python and platform info in user agent string after switch to httpx.
+
+- Remove all database entries on project deletion instead of only emptying them.
+
+- Fix error at end of replica streaming caused by changed behavior from switch to httpx.
+
+- Fix #1102: The data stream was cut off after 64k when proxying from replica to primary after switching to httpx.
+
+- Fix #1107: retry file downloads if there has been an error during download.
+
+Other Changes
+-------------
+
+- The filenames of some exported doczip files change due to normalization of the project name caused by changing the internals during export to allow ``--hard-links`` to work.
+
+
 6.17.0 (2025-08-27)
 ===================
 
@@ -86,51 +146,3 @@ Features
 
 - Add ``--connection-limit`` option to devpi-server passed on to waitress.
 
-
-6.14.0 (2024-10-16)
-===================
-
-Features
---------
-
-- Allow pushing of versions which only have documentation and no releases.
-
-- Allow pushing of release files only with no documentation. Requires devpi-client 7.2.0.
-
-- Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0.
-
-Bug Fixes
----------
-
-- No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry.
-
-
-6.13.0 (2024-09-19)
-===================
-
-Deprecations and Removals
--------------------------
-
-- Remove/Deprecate "master" related terminology in favor of "primary".
-  Usage related changes are the switch to ``--primary-url`` instead of ``--master-url`` and ``--role=primary`` instead of ``--role=master``.
-  Using the old terms will now output warnings.
-  The ``+status`` API has additional fields and the ``role`` field content will change with 7.0.0.
-
-Features
---------
-
-- Enable logging command line options for all commands.
-
-- Added support uv pip as an installer.
-
-Bug Fixes
----------
-
-- Don't report on lagging event processing while replicating.
-
-- Report primary serial correctly with streaming replication.
-
-- Don't store file data in memory when fetching a release while pushing from a mirror.
-
-- Only warn about replica not being in sync instead of fatal status while still replicating.
-

{devpi_server-6.17.0 → devpi_server-6.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devpi-server
-Version: 6.17.0
+Version: 6.19.0
 Summary: devpi-server: reliable, private, and pypi.org caching server
 Maintainer-email: Florian Schulze <mail@pyfidelity.com>
 License-Expression: MIT
@@ -42,6 +42,7 @@ Requires-Dist: pluggy<2.0,>=0.6.0
 Requires-Dist: py>=1.4.23
 Requires-Dist: pyramid>=2
 Requires-Dist: repoze.lru>=0.6
+Requires-Dist: strenum; python_version < "3.11"
 Requires-Dist: strictyaml
 Requires-Dist: waitress>=1.0.1
 Requires-Dist: ruamel.yaml
@@ -121,6 +122,66 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.0 (2026-02-06)
+===================
+
+Features
+--------
+
+- Add ``--autocreate-users`` server option.
+  Automatically creates users that don't exist in devpi, but have successfully authenticated via an authentication plugin.
+  A typical example of when to enable this would be when authenticating via an LDAP directory.
+  Automatically created users do not have passwords, and have no password hash to prevent local authentication.
+
+- Add ``replica-files-in-sync-at``, ``replica-init-queue-finished-at`` and ``replica-metadata-in-sync-at`` to status view, the existing ``replica-in-sync-at`` is now a combination of all three instead of just metadata.
+
+- Warn when an unknown option is found in config file to detect typos. Be aware that some commands don't use all the options, that is why this only warns instead of exiting.
+
+- Add new ``devpiserver_user_created`` hook which can be used to create default indexes or other setup for newly created users.
+
+Bug Fixes
+---------
+
+- Fix ``+status`` json encoding errors by making sure the ``FatalResponse.url`` attribute is a string.
+
+- Ignore existing unknown index options from uninstalled plugins when patching other options with ``+=`` and ``-=``.
+
+- Fix removal with ``-=`` of index options with default values from ``devpiserver_indexconfig_defaults`` hooks.
+
+- Fix #1110: a list for the ``listen`` option in a config file stopped working in 6.18.0.
+
+
+6.18.0 (2026-01-27)
+===================
+
+Features
+--------
+
+- Store all available hashes of files.
+
+- Validate hashes of all files during devpi-import, not only releases.
+
+Bug Fixes
+---------
+
+- Apply argparse transformations on values read from config file or environment.
+
+- Restore Python and platform info in user agent string after switch to httpx.
+
+- Remove all database entries on project deletion instead of only emptying them.
+
+- Fix error at end of replica streaming caused by changed behavior from switch to httpx.
+
+- Fix #1102: The data stream was cut off after 64k when proxying from replica to primary after switching to httpx.
+
+- Fix #1107: retry file downloads if there has been an error during download.
+
+Other Changes
+-------------
+
+- The filenames of some exported doczip files change due to normalization of the project name caused by changing the internals during export to allow ``--hard-links`` to work.
+
+
 6.17.0 (2025-08-27)
 ===================
 
@@ -198,51 +259,3 @@ Features
 
 - Add ``--connection-limit`` option to devpi-server passed on to waitress.
 
-
-6.14.0 (2024-10-16)
-===================
-
-Features
---------
-
-- Allow pushing of versions which only have documentation and no releases.
-
-- Allow pushing of release files only with no documentation. Requires devpi-client 7.2.0.
-
-- Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0.
-
-Bug Fixes
----------
-
-- No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry.
-
-
-6.13.0 (2024-09-19)
-===================
-
-Deprecations and Removals
--------------------------
-
-- Remove/Deprecate "master" related terminology in favor of "primary".
-  Usage related changes are the switch to ``--primary-url`` instead of ``--master-url`` and ``--role=primary`` instead of ``--role=master``.
-  Using the old terms will now output warnings.
-  The ``+status`` API has additional fields and the ``role`` field content will change with 7.0.0.
-
-Features
---------
-
-- Enable logging command line options for all commands.
-
-- Added support uv pip as an installer.
-
-Bug Fixes
----------
-
-- Don't report on lagging event processing while replicating.
-
-- Report primary serial correctly with streaming replication.
-
-- Don't store file data in memory when fetching a release while pushing from a mirror.
-
-- Only warn about replica not being in sync instead of fatal status while still replicating.
-

devpi_server-6.19.0/devpi_server/__init__.py

@@ -0,0 +1 @@
+__version__ = "6.19.0"

{devpi_server-6.17.0 → devpi_server-6.19.0}/devpi_server/__main__.py

@@ -1,4 +1,5 @@
 import devpi_server.main
 
+
 if __name__ == "__main__":
     devpi_server.main.main()

{devpi_server-6.17.0 → devpi_server-6.19.0}/devpi_server/auth.py

@@ -24,6 +24,7 @@ class Auth:
         self.serializer = itsdangerous.TimedSerializer(secret)
         self.hook = xom.config.hook.devpiserver_auth_request
         self.legacy_hook = xom.config.hook.devpiserver_auth_user
+        self.autocreate_users = xom.config.autocreate_users
 
     @property
     def model(self):
@@ -55,18 +56,27 @@ class Auth:
             return dict(status="ok", groups=sorted(
                 set(itertools.chain.from_iterable(groups))))
 
-    def _validate(self, authuser, authpassword, request=None):
-        """ Validates user credentials.
-
-            If authentication plugins are installed, they will be queried.
+    def _autocreate_user(self, authuser):
+        if self.model.get_user(authuser) is None:
+            # Autocreated users will be authenticated via plugin, and so no
+            # valid password should be stored.
+            self.model.create_user(authuser, password=None)
+            threadlog.debug("automatically created user %r", authuser)
 
-            If no user can be found, returns None.
-            If the credentials are wrong, returns False.
-            On success a list of group names the user is member of will be
-            returned. If the plugins don't return any groups, then the list
-            will be empty.
-            The 'root' user is always authenticated with the devpi-server
-            credentials, never by plugins.
+    def _validate(self, authuser, authpassword, request=None):
+        """Validates user credentials.
+
+        If authentication plugins are installed, they will be queried.
+
+        If no user can be found, returns None.
+        If the credentials are wrong, returns False.
+        On success a list of group names the user is member of will be
+        returned. If the plugins don't return any groups, then the list
+        will be empty.
+        If autocreate-users is enabled, the new user is created, if it
+        doesn't already exist.
+        The 'root' user is always authenticated with the devpi-server
+        credentials, never by plugins.
         """
         user = self.model.get_user(authuser)
         is_root = authuser == 'root'
@@ -77,6 +87,8 @@ class Auth:
             if result is not None:
                 if result["status"] != "ok":
                     return dict(status="reject")
+                if self.autocreate_users:
+                    self._autocreate_user(authuser)
                 # plugins may never return from_user_object
                 result.pop('from_user_object', None)
                 return result

devpi_server-6.19.0/devpi_server/compat.py

@@ -0,0 +1,35 @@
+try:
+    from enum import StrEnum
+except ImportError:
+    from strenum import StrEnum  # noqa: F401
+from tempfile import SpooledTemporaryFile
+
+
+# before Python 3.11 some methods were missing
+if not hasattr(SpooledTemporaryFile, "readable"):
+
+    def readable(self):
+        return self._file.readable()
+
+    SpooledTemporaryFile.readable = readable  # type: ignore[method-assign]
+
+if not hasattr(SpooledTemporaryFile, "readinto"):
+
+    def readinto(self, buffer):
+        return self._file.readinto(buffer)
+
+    SpooledTemporaryFile.readinto = readinto  # type: ignore[attr-defined]
+
+if not hasattr(SpooledTemporaryFile, "seekable"):
+
+    def seekable(self):
+        return self._file.seekable()
+
+    SpooledTemporaryFile.seekable = seekable  # type: ignore[method-assign]
+
+if not hasattr(SpooledTemporaryFile, "writable"):
+
+    def writable(self):
+        return self._file.writable()
+
+    SpooledTemporaryFile.writable = writable  # type: ignore[method-assign]