devpi-server 6.19.0__tar.gz → 6.19.1__tar.gz

{devpi_server-6.19.0 → devpi_server-6.19.1}/CHANGELOG

@@ -2,6 +2,16 @@
 
 .. towncrier release notes start
 
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
 6.19.0 (2026-02-06)
 ===================
 

{devpi_server-6.19.0 → devpi_server-6.19.1}/CHANGELOG.short.rst

@@ -9,6 +9,16 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
 6.19.0 (2026-02-06)
 ===================
 
@@ -137,12 +147,3 @@ Bug Fixes
 
 - Keep original metadata_version in database.
 
-
-6.15.0 (2025-05-18)
-===================
-
-Features
---------
-
-- Add ``--connection-limit`` option to devpi-server passed on to waitress.
-

{devpi_server-6.19.0 → devpi_server-6.19.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devpi-server
-Version: 6.19.0
+Version: 6.19.1
 Summary: devpi-server: reliable, private, and pypi.org caching server
 Maintainer-email: Florian Schulze <mail@pyfidelity.com>
 License-Expression: MIT
@@ -22,6 +22,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Classifier: Topic :: Internet :: WWW/HTTP
@@ -42,6 +43,7 @@ Requires-Dist: pluggy<2.0,>=0.6.0
 Requires-Dist: py>=1.4.23
 Requires-Dist: pyramid>=2
 Requires-Dist: repoze.lru>=0.6
+Requires-Dist: setuptools<=81
 Requires-Dist: strenum; python_version < "3.11"
 Requires-Dist: strictyaml
 Requires-Dist: waitress>=1.0.1
@@ -122,6 +124,16 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
 6.19.0 (2026-02-06)
 ===================
 
@@ -250,12 +262,3 @@ Bug Fixes
 
 - Keep original metadata_version in database.
 
-
-6.15.0 (2025-05-18)
-===================
-
-Features
---------
-
-- Add ``--connection-limit`` option to devpi-server passed on to waitress.
-

devpi_server-6.19.1/devpi_server/__init__.py

@@ -0,0 +1 @@
+__version__ = "6.19.1"

{devpi_server-6.19.0 → devpi_server-6.19.1}/devpi_server/mirror.py

@@ -740,7 +740,6 @@ class MirrorStage(BaseStage):
         serial: int,
         etag: str | None,
     ) -> None:
-        assert links != ()  # we don't store the old "Not Found" marker anymore
         assert isinstance(serial, int)
         assert project == normalize_name(project), project
         data: CacheLinks = {

{devpi_server-6.19.0 → devpi_server-6.19.1}/devpi_server/model.py

@@ -546,9 +546,6 @@ class BaseStageCustomizer:
             principals = {':ANONYMOUS:'}
         else:
             principals = set(principals)
-        if self.stage.xom.is_primary():
-            # replicas always need to be able to download packages
-            principals.add("+replica")
         # admins should always be able to read the packages
         if restrict_modify is None:
             principals.add("root")

{devpi_server-6.19.0 → devpi_server-6.19.1}/devpi_server/view_auth.py

@@ -6,6 +6,7 @@ from devpi_server.config import hookimpl
 from devpi_server.config import traced_pluggy_call
 from devpi_server.model import BaseStage
 from devpi_server.model import UpstreamError
+from devpi_server.replica import REPLICA_USER_NAME
 from devpi_server.views import abort
 from pyramid.authorization import ACLHelper
 from pyramid.authorization import Allow
@@ -62,7 +63,10 @@ class RootFactory:
 
     @cached_property
     def __acl__(self):
-        acl = [(Allow, Everyone, 'user_login')]
+        acl = [
+            (Allow, Everyone, "user_login"),
+            (Allow, REPLICA_USER_NAME, "pkg_read"),
+        ]
         if self.restrict_modify is None:
             acl.extend(
                 [

{devpi_server-6.19.0 → devpi_server-6.19.1}/devpi_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devpi-server
-Version: 6.19.0
+Version: 6.19.1
 Summary: devpi-server: reliable, private, and pypi.org caching server
 Maintainer-email: Florian Schulze <mail@pyfidelity.com>
 License-Expression: MIT
@@ -22,6 +22,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Classifier: Topic :: Internet :: WWW/HTTP
@@ -42,6 +43,7 @@ Requires-Dist: pluggy<2.0,>=0.6.0
 Requires-Dist: py>=1.4.23
 Requires-Dist: pyramid>=2
 Requires-Dist: repoze.lru>=0.6
+Requires-Dist: setuptools<=81
 Requires-Dist: strenum; python_version < "3.11"
 Requires-Dist: strictyaml
 Requires-Dist: waitress>=1.0.1
@@ -122,6 +124,16 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
 6.19.0 (2026-02-06)
 ===================
 
@@ -250,12 +262,3 @@ Bug Fixes
 
 - Keep original metadata_version in database.
 
-
-6.15.0 (2025-05-18)
-===================
-
-Features
---------
-
-- Add ``--connection-limit`` option to devpi-server passed on to waitress.
-

{devpi_server-6.19.0 → devpi_server-6.19.1}/devpi_server.egg-info/requires.txt

@@ -11,6 +11,7 @@ pluggy<2.0,>=0.6.0
 py>=1.4.23
 pyramid>=2
 repoze.lru>=0.6
+setuptools<=81
 strictyaml
 waitress>=1.0.1
 ruamel.yaml

{devpi_server-6.19.0 → devpi_server-6.19.1}/pyproject.toml

@@ -22,6 +22,7 @@ dependencies = [
     "py>=1.4.23",
     "pyramid>=2",
     "repoze.lru>=0.6",
+    "setuptools<=81",  # removed pkg_resources required by pyramid
     "strenum;python_version<'3.11'",
     "strictyaml",
     "waitress>=1.0.1",
@@ -46,6 +47,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Programming Language :: Python :: Implementation :: PyPy",
     "Topic :: Internet :: WWW/HTTP :: WSGI :: Application",
     "Topic :: Internet :: WWW/HTTP",

{devpi_server-6.19.0 → devpi_server-6.19.1}/test_devpi_server/test_replica.py

@@ -1305,6 +1305,125 @@ def test_replica_user_auth_before_other_plugins(makexom):
             auth._get_auth_status(replica.REPLICA_USER_NAME, '')
 
 
+def test_pkg_read_permission(makemapp, maketestapp, makexom):
+    from devpi_common.types import ensure_unicode
+    from devpi_server.config import hookimpl
+    from devpi_server.model import ACLList
+    from webob.headers import ResponseHeaders
+    import itsdangerous
+
+    class Plugin:
+        @hookimpl
+        def devpiserver_indexconfig_defaults(self, index_type):  # noqa: ARG002
+            return {"acl_pkg_read": ACLList(["root"])}
+
+        @hookimpl
+        def devpiserver_stage_get_principals_for_pkg_read(self, ixconfig):
+            return ixconfig.get("acl_pkg_read", None)
+
+    plugin = Plugin()
+    xom = makexom(plugins=[plugin])
+    xom.config.nodeinfo["role"] = "primary"
+    testapp = maketestapp(xom)
+    mapp = makemapp(testapp)
+    auth_serializer = itsdangerous.TimedSerializer(mapp.xom.config.get_replica_secret())
+    uuid = "111"
+    api = mapp.create_and_use("someuser/dev")
+    mapp.upload_file_pypi("hello-1.0.tar.gz", b"content", "hello", "1.0")
+    (path,) = mapp.get_release_paths("hello")
+    # replica should be able to access the release
+    testapp.xget(
+        200,
+        "/+authcheck",
+        headers=ResponseHeaders(
+            {
+                H_REPLICA_UUID: uuid,
+                "X-Original-URI": path,
+                "Authorization": f"Bearer {ensure_unicode(auth_serializer.dumps(uuid))}",
+            }
+        ),
+    )
+    testapp.xget(
+        200,
+        path,
+        headers=ResponseHeaders(
+            {
+                H_REPLICA_UUID: uuid,
+                "Authorization": f"Bearer {ensure_unicode(auth_serializer.dumps(uuid))}",
+            }
+        ),
+    )
+    # after project deletion the file is marked as gone
+    mapp.delete_project("hello")
+    testapp.xget(
+        200,
+        "/+authcheck",
+        headers=ResponseHeaders(
+            {
+                H_REPLICA_UUID: uuid,
+                "X-Original-URI": path,
+                "Authorization": f"Bearer {ensure_unicode(auth_serializer.dumps(uuid))}",
+            }
+        ),
+    )
+    testapp.xget(
+        410,
+        path,
+        headers=ResponseHeaders(
+            {
+                H_REPLICA_UUID: uuid,
+                "Authorization": f"Bearer {ensure_unicode(auth_serializer.dumps(uuid))}",
+            }
+        ),
+    )
+    # after index deletion the file is still marked as gone
+    mapp.delete_index(api.stagename)
+    testapp.xget(
+        200,
+        "/+authcheck",
+        headers=ResponseHeaders(
+            {
+                H_REPLICA_UUID: uuid,
+                "X-Original-URI": path,
+                "Authorization": f"Bearer {ensure_unicode(auth_serializer.dumps(uuid))}",
+            }
+        ),
+    )
+    testapp.xget(
+        410,
+        path,
+        headers=ResponseHeaders(
+            {
+                H_REPLICA_UUID: uuid,
+                "Authorization": f"Bearer {ensure_unicode(auth_serializer.dumps(uuid))}",
+            }
+        ),
+    )
+    # also after user deletion
+    mapp.delete_user(api.user)
+    testapp.xget(
+        200,
+        "/+authcheck",
+        headers=ResponseHeaders(
+            {
+                H_REPLICA_UUID: uuid,
+                "X-Original-URI": path,
+                "Authorization": f"Bearer {ensure_unicode(auth_serializer.dumps(uuid))}",
+            }
+        ),
+    )
+    testapp.xget(
+        410,
+        path,
+        headers=ResponseHeaders(
+            {
+                H_REPLICA_UUID: uuid,
+                "Authorization": f"Bearer {ensure_unicode(auth_serializer.dumps(uuid))}",
+            }
+        ),
+    )
+
+
 class TestFileReplicationSharedData:
     @pytest.fixture
     def shared_data(self, replica_xom):

{devpi_server-6.19.0 → devpi_server-6.19.1}/test_devpi_server/test_stage_customizer.py

@@ -269,7 +269,6 @@ def test_package_filters(makemapp, maketestapp, makexom):
 
 def test_pkg_read_permission(makemapp, maketestapp, makexom):
     from devpi_server.model import ACLList
-    from devpi_server.replica import REPLICA_USER_NAME
     from webob.headers import ResponseHeaders
     import json
 
@@ -341,16 +340,6 @@ def test_pkg_read_permission(makemapp, maketestapp, makexom):
     req = dict(name="hello", version="1.0", targetindex="otheruser/dev")
     r = testapp.push("/someuser/dev", json.dumps(req))
     assert r.status_code == 403
-    with xom.keyfs.read_transaction():
-        stage = xom.model.getstage(api1.stagename)
-        # by default get_principals_for_pkg_read returns just the set principals
-        assert stage.customizer.get_principals_for_pkg_read() == {
-            'root', 'someuser'}
-        # but if the server acts as a primary for replicas,
-        # then the special replica user is included
-        xom.config.nodeinfo['role'] = 'primary'
-        assert set(stage.customizer.get_principals_for_pkg_read()) == {
-            'root', 'someuser', REPLICA_USER_NAME}
 
 
 def test_sro_skip_plugin(makemapp, maketestapp, makexom, pypistage):

{devpi_server-6.19.0 → devpi_server-6.19.1}/tox.ini

@@ -1,5 +1,5 @@
 [tox]
-envlist=py39{,-keyfs_sqlite,-hash_hl},py313,pypy3,flake8
+envlist=py39{,-keyfs_sqlite,-hash_hl},py314,pypy3,flake8
 
 
 [devpisettings]

devpi_server-6.19.0/devpi_server/__init__.py

@@ -1 +0,0 @@
-__version__ = "6.19.0"

devpi_server-6.19.0/devpi_server/py.typed

@@ -1 +0,0 @@
-partial

devpi_server-6.19.0/test_devpi_server/py.typed

@@ -1 +0,0 @@
-partial