devpi-server 6.18.0__tar.gz → 6.19.1__tar.gz

{devpi_server-6.18.0 → devpi_server-6.19.1}/CHANGELOG

@@ -2,6 +2,45 @@
 
 .. towncrier release notes start
 
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
+6.19.0 (2026-02-06)
+===================
+
+Features
+--------
+
+- Add ``--autocreate-users`` server option.
+  Automatically creates users that don't exist in devpi, but have successfully authenticated via an authentication plugin.
+  A typical example of when to enable this would be when authenticating via an LDAP directory.
+  Automatically created users do not have passwords, and have no password hash to prevent local authentication.
+
+- Add ``replica-files-in-sync-at``, ``replica-init-queue-finished-at`` and ``replica-metadata-in-sync-at`` to status view, the existing ``replica-in-sync-at`` is now a combination of all three instead of just metadata.
+
+- Warn when an unknown option is found in config file to detect typos. Be aware that some commands don't use all the options, that is why this only warns instead of exiting.
+
+- Add new ``devpiserver_user_created`` hook which can be used to create default indexes or other setup for newly created users.
+
+Bug Fixes
+---------
+
+- Fix ``+status`` json encoding errors by making sure the ``FatalResponse.url`` attribute is a string.
+
+- Ignore existing unknown index options from uninstalled plugins when patching other options with ``+=`` and ``-=``.
+
+- Fix removal with ``-=`` of index options with default values from ``devpiserver_indexconfig_defaults`` hooks.
+
+- Fix #1110: a list for the ``listen`` option in a config file stopped working in 6.18.0.
+
+
 6.18.0 (2026-01-27)
 ===================
 

{devpi_server-6.18.0 → devpi_server-6.19.1}/CHANGELOG.short.rst

@@ -9,6 +9,45 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
+6.19.0 (2026-02-06)
+===================
+
+Features
+--------
+
+- Add ``--autocreate-users`` server option.
+  Automatically creates users that don't exist in devpi, but have successfully authenticated via an authentication plugin.
+  A typical example of when to enable this would be when authenticating via an LDAP directory.
+  Automatically created users do not have passwords, and have no password hash to prevent local authentication.
+
+- Add ``replica-files-in-sync-at``, ``replica-init-queue-finished-at`` and ``replica-metadata-in-sync-at`` to status view, the existing ``replica-in-sync-at`` is now a combination of all three instead of just metadata.
+
+- Warn when an unknown option is found in config file to detect typos. Be aware that some commands don't use all the options, that is why this only warns instead of exiting.
+
+- Add new ``devpiserver_user_created`` hook which can be used to create default indexes or other setup for newly created users.
+
+Bug Fixes
+---------
+
+- Fix ``+status`` json encoding errors by making sure the ``FatalResponse.url`` attribute is a string.
+
+- Ignore existing unknown index options from uninstalled plugins when patching other options with ``+=`` and ``-=``.
+
+- Fix removal with ``-=`` of index options with default values from ``devpiserver_indexconfig_defaults`` hooks.
+
+- Fix #1110: a list for the ``listen`` option in a config file stopped working in 6.18.0.
+
+
 6.18.0 (2026-01-27)
 ===================
 
@@ -108,30 +147,3 @@ Bug Fixes
 
 - Keep original metadata_version in database.
 
-
-6.15.0 (2025-05-18)
-===================
-
-Features
---------
-
-- Add ``--connection-limit`` option to devpi-server passed on to waitress.
-
-
-6.14.0 (2024-10-16)
-===================
-
-Features
---------
-
-- Allow pushing of versions which only have documentation and no releases.
-
-- Allow pushing of release files only with no documentation. Requires devpi-client 7.2.0.
-
-- Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0.
-
-Bug Fixes
----------
-
-- No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry.
-

{devpi_server-6.18.0 → devpi_server-6.19.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devpi-server
-Version: 6.18.0
+Version: 6.19.1
 Summary: devpi-server: reliable, private, and pypi.org caching server
 Maintainer-email: Florian Schulze <mail@pyfidelity.com>
 License-Expression: MIT
@@ -22,6 +22,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Classifier: Topic :: Internet :: WWW/HTTP
@@ -42,6 +43,7 @@ Requires-Dist: pluggy<2.0,>=0.6.0
 Requires-Dist: py>=1.4.23
 Requires-Dist: pyramid>=2
 Requires-Dist: repoze.lru>=0.6
+Requires-Dist: setuptools<=81
 Requires-Dist: strenum; python_version < "3.11"
 Requires-Dist: strictyaml
 Requires-Dist: waitress>=1.0.1
@@ -122,6 +124,45 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
+6.19.0 (2026-02-06)
+===================
+
+Features
+--------
+
+- Add ``--autocreate-users`` server option.
+  Automatically creates users that don't exist in devpi, but have successfully authenticated via an authentication plugin.
+  A typical example of when to enable this would be when authenticating via an LDAP directory.
+  Automatically created users do not have passwords, and have no password hash to prevent local authentication.
+
+- Add ``replica-files-in-sync-at``, ``replica-init-queue-finished-at`` and ``replica-metadata-in-sync-at`` to status view, the existing ``replica-in-sync-at`` is now a combination of all three instead of just metadata.
+
+- Warn when an unknown option is found in config file to detect typos. Be aware that some commands don't use all the options, that is why this only warns instead of exiting.
+
+- Add new ``devpiserver_user_created`` hook which can be used to create default indexes or other setup for newly created users.
+
+Bug Fixes
+---------
+
+- Fix ``+status`` json encoding errors by making sure the ``FatalResponse.url`` attribute is a string.
+
+- Ignore existing unknown index options from uninstalled plugins when patching other options with ``+=`` and ``-=``.
+
+- Fix removal with ``-=`` of index options with default values from ``devpiserver_indexconfig_defaults`` hooks.
+
+- Fix #1110: a list for the ``listen`` option in a config file stopped working in 6.18.0.
+
+
 6.18.0 (2026-01-27)
 ===================
 
@@ -221,30 +262,3 @@ Bug Fixes
 
 - Keep original metadata_version in database.
 
-
-6.15.0 (2025-05-18)
-===================
-
-Features
---------
-
-- Add ``--connection-limit`` option to devpi-server passed on to waitress.
-
-
-6.14.0 (2024-10-16)
-===================
-
-Features
---------
-
-- Allow pushing of versions which only have documentation and no releases.
-
-- Allow pushing of release files only with no documentation. Requires devpi-client 7.2.0.
-
-- Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0.
-
-Bug Fixes
----------
-
-- No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry.
-

devpi_server-6.19.1/devpi_server/__init__.py

@@ -0,0 +1 @@
+__version__ = "6.19.1"

{devpi_server-6.18.0 → devpi_server-6.19.1}/devpi_server/auth.py

@@ -24,6 +24,7 @@ class Auth:
         self.serializer = itsdangerous.TimedSerializer(secret)
         self.hook = xom.config.hook.devpiserver_auth_request
         self.legacy_hook = xom.config.hook.devpiserver_auth_user
+        self.autocreate_users = xom.config.autocreate_users
 
     @property
     def model(self):
@@ -55,18 +56,27 @@ class Auth:
             return dict(status="ok", groups=sorted(
                 set(itertools.chain.from_iterable(groups))))
 
-    def _validate(self, authuser, authpassword, request=None):
-        """ Validates user credentials.
-
-            If authentication plugins are installed, they will be queried.
+    def _autocreate_user(self, authuser):
+        if self.model.get_user(authuser) is None:
+            # Autocreated users will be authenticated via plugin, and so no
+            # valid password should be stored.
+            self.model.create_user(authuser, password=None)
+            threadlog.debug("automatically created user %r", authuser)
 
-            If no user can be found, returns None.
-            If the credentials are wrong, returns False.
-            On success a list of group names the user is member of will be
-            returned. If the plugins don't return any groups, then the list
-            will be empty.
-            The 'root' user is always authenticated with the devpi-server
-            credentials, never by plugins.
+    def _validate(self, authuser, authpassword, request=None):
+        """Validates user credentials.
+
+        If authentication plugins are installed, they will be queried.
+
+        If no user can be found, returns None.
+        If the credentials are wrong, returns False.
+        On success a list of group names the user is member of will be
+        returned. If the plugins don't return any groups, then the list
+        will be empty.
+        If autocreate-users is enabled, the new user is created, if it
+        doesn't already exist.
+        The 'root' user is always authenticated with the devpi-server
+        credentials, never by plugins.
         """
         user = self.model.get_user(authuser)
         is_root = authuser == 'root'
@@ -77,6 +87,8 @@ class Auth:
             if result is not None:
                 if result["status"] != "ok":
                     return dict(status="reject")
+                if self.autocreate_users:
+                    self._autocreate_user(authuser)
                 # plugins may never return from_user_object
                 result.pop('from_user_object', None)
                 return result

{devpi_server-6.18.0 → devpi_server-6.19.1}/devpi_server/config.py

@@ -6,7 +6,6 @@ from .interfaces import IIOFileFactory
 from .log import threadlog
 from devpi_common.types import cached_property
 from devpi_common.url import URL
-from functools import partial
 from operator import itemgetter
 from pathlib import Path
 from pluggy import HookimplMarker
@@ -29,6 +28,8 @@ import warnings
 if TYPE_CHECKING:
     from .interfaces import IStorageConnection4
     from collections.abc import Callable
+    from collections.abc import MutableMapping
+    from typing import Any
 
 
 log = threadlog
@@ -403,6 +404,20 @@ def add_permission_options(parser, pluginmanager):
              "explicitly if wanted.")
 
 
+def add_autocreate_users_options(
+    parser,
+    pluginmanager,  # noqa: ARG001 - call convention
+):
+    parser.addoption(
+        "--autocreate-users",
+        action="store_true",
+        default=False,
+        help="when using an authentication plugin, automatically create new "
+        "users that authenticate, but don't already exist. This is "
+        "helpful for deployments making use of LDAP authentication.",
+    )
+
+
 def addoptions(parser, pluginmanager):
     add_help_option(parser, pluginmanager)
     add_configfile_option(parser, pluginmanager)
@@ -441,6 +456,9 @@ def addoptions(parser, pluginmanager):
     add_permission_options(
         parser.addgroup("permission options"),
         pluginmanager)
+    add_autocreate_users_options(
+        parser.addgroup("autocreate users options"), pluginmanager
+    )
 
 
 def try_argcomplete(parser):
@@ -514,21 +532,31 @@ def load_config_file(config_file):
         return config.data
 
 
-def default_getter(name, config_options, environ):
-    if name is None:
-        return
-    if name == "serverdir":
-        if "DEVPI_SERVERDIR" in environ:
+class ArgumentDefaultGetter:
+    used_config_options: set[str]
+
+    def __init__(
+        self, *, config_options: dict[str, Any], environ: MutableMapping[str, Any]
+    ):
+        self.config_options = config_options
+        self.environ = environ
+        self.used_config_options = set()
+
+    def __call__(self, name: str | None) -> Any | None:
+        if name is None:
+            return None
+        if name == "serverdir" and "DEVPI_SERVERDIR" in self.environ:
             log.warning(
                 "Using deprecated DEVPI_SERVERDIR environment variable. "
                 "You should switch to use DEVPISERVER_SERVERDIR.")
-            return environ["DEVPI_SERVERDIR"]
-    envname = "DEVPISERVER_%s" % name.replace('-', '_').upper()
-    if envname in environ:
-        value = environ[envname]
-        if value:
-            return value
-    return config_options[name]
+            return self.environ["DEVPI_SERVERDIR"]
+        envname = f"DEVPISERVER_{name.replace('-', '_').upper()}"
+        if envname in self.environ:
+            value = self.environ[envname]
+            if value:
+                return value
+        self.used_config_options.add(name)
+        return self.config_options[name]
 
 
 def parseoptions(pluginmanager, argv, parser=None):
@@ -553,10 +581,9 @@ def parseoptions(pluginmanager, argv, parser=None):
             "Error in config file '%s':\n  %s", config_file, e
         )
         sys.exit(4)
-    defaultget = partial(
-        default_getter,
-        config_options=config_options,
-        environ=os.environ)
+    defaultget = ArgumentDefaultGetter(
+        config_options=config_options, environ=os.environ
+    )
     parser.post_process_actions(defaultget=defaultget)
     # the getattr is a workaround for a problem with 3.14t-dev
     # weirdly enough it does not happen with 3.14-dev
@@ -564,6 +591,11 @@ def parseoptions(pluginmanager, argv, parser=None):
         parser.print_help()
         parser.exit()
     args = parser.parse_args(argv[1:])
+    if unknown_keys := set(config_options).difference(defaultget.used_config_options):
+        exec_name = Path(argv[0]).name or "unknown"
+        for unknown_key in unknown_keys:
+            msg = f"Unknown {exec_name} option {unknown_key!r} in {config_file}"
+            log.warning(msg)
     config = Config(args, pluginmanager=pluginmanager)
     return config
 
@@ -609,7 +641,11 @@ class MyArgumentParser(argparse.ArgumentParser):
                 except KeyError:
                     pass
                 else:
-                    if isinstance(action, argparse._StoreTrueAction):
+                    if isinstance(action, argparse._AppendAction) and isinstance(
+                        default, list
+                    ):
+                        pass
+                    elif isinstance(action, argparse._StoreTrueAction):
                         default = bool(strtobool(default))
                     elif isinstance(action, argparse._StoreFalseAction):
                         default = not bool(strtobool(default))
@@ -987,6 +1023,10 @@ class Config:
             rm = frozenset(x.strip() for x in rm.split(','))
         return rm
 
+    @property
+    def autocreate_users(self):
+        return getattr(self.args, "autocreate_users", False)
+
     @property
     def wait_for_events(self):
         return getattr(self.args, 'wait_for_events', False)

{devpi_server-6.18.0 → devpi_server-6.19.1}/devpi_server/exceptions.py

@@ -8,8 +8,7 @@ class LazyExceptionFormatter:
         self.e = e
 
     def __str__(self):
-        return ''.join(traceback.format_exception(
-            self.e.__class__, self.e, self.e.__traceback__)).strip()
+        return format_exception(self.e)
 
 
 class LazyExceptionOnlyFormatter:
@@ -19,8 +18,15 @@ class LazyExceptionOnlyFormatter:
         self.e = e
 
     def __str__(self):
-        return ''.join(traceback.format_exception_only(
-            self.e.__class__, self.e)).strip()
+        return format_exception_only(self.e)
+
+
+def format_exception(e):
+    return "".join(traceback.format_exception(e.__class__, e, e.__traceback__)).strip()
+
+
+def format_exception_only(e):
+    return "".join(traceback.format_exception_only(e.__class__, e)).strip()
 
 
 def lazy_format_exception(e):

{devpi_server-6.18.0 → devpi_server-6.19.1}/devpi_server/hookspecs.py

@@ -98,6 +98,14 @@ def devpiserver_mirror_initialnames(stage, projectnames):
     """
 
 
+@hookspec
+def devpiserver_user_created(user):
+    """called when a user was successfully created.
+
+    - user is an instance of model.User
+    """
+
+
 @hookspec
 def devpiserver_stage_created(stage):
     """ called when a stage was successfully created. (both for replica and a primary)

{devpi_server-6.18.0 → devpi_server-6.19.1}/devpi_server/httpclient.py

@@ -41,9 +41,10 @@ def get_caller_location(stacklevel: int = 2) -> str:
 
 class FatalResponse:
     status_code = -1
+    url: str
 
     def __init__(self, url: URL | str, reason: str):
-        self.url = url
+        self.url = str(url)
         self.reason_phrase = reason
         self.status = self.status_code
 

{devpi_server-6.18.0 → devpi_server-6.19.1}/devpi_server/mirror.py

@@ -740,7 +740,6 @@ class MirrorStage(BaseStage):
         serial: int,
         etag: str | None,
     ) -> None:
-        assert links != ()  # we don't store the old "Not Found" marker anymore
         assert isinstance(serial, int)
         assert project == normalize_name(project), project
         data: CacheLinks = {

{devpi_server-6.18.0 → devpi_server-6.19.1}/devpi_server/model.py

@@ -187,6 +187,8 @@ class RootModel:
             threadlog.info("created user %r with email %r" % (username, kwargs["email"]))
         else:
             threadlog.info("created user %r" % username)
+        # Call any user created hooks, passing along the newly created user object.
+        self.xom.config.hook.devpiserver_user_created(user=user)
         return user
 
     def create_stage(self, user, index, type="stage", **kwargs):
@@ -544,9 +546,6 @@ class BaseStageCustomizer:
             principals = {':ANONYMOUS:'}
         else:
             principals = set(principals)
-        if self.stage.xom.is_primary():
-            # replicas always need to be able to download packages
-            principals.add("+replica")
         # admins should always be able to read the packages
         if restrict_modify is None:
             principals.add("root")
@@ -786,12 +785,13 @@ class BaseStage:
                     % (index_type, ", ".join(sorted(conflicting))))
             for key, value in defaults.items():
                 new_value = kwargs.pop(key, value)
-                if isinstance(value, bool):
-                    new_value = ensure_boolean(new_value)
-                elif isinstance(value, ACLList):
-                    new_value = ensure_acl_list(new_value)
-                elif isinstance(value, (list, tuple, set)):
-                    new_value = ensure_list(new_value)
+                if new_value is not RemoveValue:
+                    if isinstance(value, bool):
+                        new_value = ensure_boolean(new_value)
+                    elif isinstance(value, ACLList):
+                        new_value = ensure_acl_list(new_value)
+                    elif isinstance(value, (list, tuple, set)):
+                        new_value = ensure_list(new_value)
                 ixconfig.setdefault(key, new_value)
         # XXX backward compatibility for old exports where these could appear
         # on mirror indexes