devpi-server 6.19.0__tar.gz → 6.19.2__tar.gz

{devpi_server-6.19.0 → devpi_server-6.19.2}/CHANGELOG

@@ -2,6 +2,37 @@
 
 .. towncrier release notes start
 
+6.19.2 (2026-03-17)
+===================
+
+Bug Fixes
+---------
+
+- Preserve log for documentation uploads in export.
+
+- Any missing file on mirrors will be ignored during event processing as is already the case in other places.
+
+- Use short timeout when project list is requested for ``has_project`` call on mirrors instead of the long one used for ``list_projects``. This prevents installers from timing out and retrying several times.
+
+- Fix error handling for proxy requests from replica to primary.
+
+Other Changes
+-------------
+
+- Removed limit of reported missing files for devpi-fsck.
+
+
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
+
 6.19.0 (2026-02-06)
 ===================
 

{devpi_server-6.19.0 → devpi_server-6.19.2}/CHANGELOG.short.rst

@@ -9,6 +9,37 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.2 (2026-03-17)
+===================
+
+Bug Fixes
+---------
+
+- Preserve log for documentation uploads in export.
+
+- Any missing file on mirrors will be ignored during event processing as is already the case in other places.
+
+- Use short timeout when project list is requested for ``has_project`` call on mirrors instead of the long one used for ``list_projects``. This prevents installers from timing out and retrying several times.
+
+- Fix error handling for proxy requests from replica to primary.
+
+Other Changes
+-------------
+
+- Removed limit of reported missing files for devpi-fsck.
+
+
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
+
 6.19.0 (2026-02-06)
 ===================
 
@@ -116,33 +147,3 @@ Other Changes
 
 - Changed User-Agent when fetching data for mirrors from just "server" to "devpi-server".
 
-
-6.16.0 (2025-06-25)
-===================
-
-Deprecations and Removals
--------------------------
-
-- Dropped support for Python 3.7 and 3.8.
-
-Features
---------
-
-- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
-
-Bug Fixes
----------
-
-- Preserve hash when importing mirror data to prevent unnecessary updates later on.
-
-- Keep original metadata_version in database.
-
-
-6.15.0 (2025-05-18)
-===================
-
-Features
---------
-
-- Add ``--connection-limit`` option to devpi-server passed on to waitress.
-

{devpi_server-6.19.0 → devpi_server-6.19.2}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: devpi-server
-Version: 6.19.0
-Summary: devpi-server: reliable, private, and pypi.org caching server
+Version: 6.19.2
+Summary: devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors
 Maintainer-email: Florian Schulze <mail@pyfidelity.com>
 License-Expression: MIT
 Project-URL: Bug Tracker, https://github.com/devpi/devpi/issues
@@ -22,6 +22,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Classifier: Topic :: Internet :: WWW/HTTP
@@ -42,31 +43,32 @@ Requires-Dist: pluggy<2.0,>=0.6.0
 Requires-Dist: py>=1.4.23
 Requires-Dist: pyramid>=2
 Requires-Dist: repoze.lru>=0.6
+Requires-Dist: requests>=2.3.0
+Requires-Dist: setuptools<=81
 Requires-Dist: strenum; python_version < "3.11"
 Requires-Dist: strictyaml
 Requires-Dist: waitress>=1.0.1
 Requires-Dist: ruamel.yaml
 Dynamic: license-file
 
-=============================================================================
-devpi-server: server for private package indexes and PyPI caching
-=============================================================================
+====================================================================================
+devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors
+====================================================================================
 
 
-PyPI cache
-==========
+PyPI on-demand package mirror
+=============================
 
-You can point ``pip or easy_install`` to the ``root/pypi/+simple/``
-index, serving as a transparent cache for pypi-hosted packages.
+You can point ``uv``, ``pip`` or another Python package installer to the ``root/pypi/+simple/`` index,
+serving as a transparent on-demand mirror for PyPI-hosted packages.
 
 
 User specific indexes
 =====================
 
-Each user (which can represent a person, project or team) can have
-multiple indexes and upload packages and docs via standard ``twine`` or
-``setup.py`` invocations.  Users and indexes can be manipulated through
-`devpi-client`_ and a RESTful HTTP API.
+Each user (which can represent a person, project or team) can have multiple indexes,
+and can upload packages and documents to these indexes via standard ``twine`` or ``setup.py`` invocations.
+Users and indexes can be manipulated through `devpi-client`_ and a RESTful HTTP API.
 
 
 Index inheritance
@@ -78,19 +80,16 @@ index using ``root/pypi`` as a parent is a good place to test out a
 release candidate before you push it to PyPI.
 
 
-Good defaults and easy deployment
-=================================
+Sensible defaults for a low friction deployment
+===============================================
 
-Get started easily and create a permanent devpi-server deployment
-including pre-configured templates for ``nginx`` and process managers.
+Get started easily and deploy a devpi-server instance with pre-configured templates for ``nginx`` and process managers.
 
 
 Separate tool for Packaging/Testing activities
 ==============================================
 
-The complementary `devpi-client`_ tool
-helps to manage users, indexes, logins and typical setup.py-based upload and
-installation workflows.
+The complementary `devpi-client`_ tool helps to manage users, indexes, logins and typical package upload and installation workflows.
 
 See https://doc.devpi.net on how to get started and further documentation.
 
@@ -103,9 +102,9 @@ Support
 
 If you find a bug, use the `issue tracker at Github`_.
 
-For general questions use `GitHub Discussions`_ or the `devpi-dev@python.org mailing list`_.
+For general questions, use `GitHub Discussions`_ or the `devpi-dev@python.org mailing list`_.
 
-For support contracts and paid help contact ``mail at pyfidelity.com``.
+For support contracts and paid help, contact ``mail at pyfidelity.com``.
 
 .. _issue tracker at Github: https://github.com/devpi/devpi/issues/
 .. _devpi-dev@python.org mailing list: https://mail.python.org/mailman3/lists/devpi-dev.python.org/
@@ -122,6 +121,37 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.2 (2026-03-17)
+===================
+
+Bug Fixes
+---------
+
+- Preserve log for documentation uploads in export.
+
+- Any missing file on mirrors will be ignored during event processing as is already the case in other places.
+
+- Use short timeout when project list is requested for ``has_project`` call on mirrors instead of the long one used for ``list_projects``. This prevents installers from timing out and retrying several times.
+
+- Fix error handling for proxy requests from replica to primary.
+
+Other Changes
+-------------
+
+- Removed limit of reported missing files for devpi-fsck.
+
+
+6.19.1 (2026-02-09)
+===================
+
+Bug Fixes
+---------
+
+- Pin setuptools as pyramid still requires pkg_resources.
+
+- Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
+
+
 6.19.0 (2026-02-06)
 ===================
 
@@ -229,33 +259,3 @@ Other Changes
 
 - Changed User-Agent when fetching data for mirrors from just "server" to "devpi-server".
 
-
-6.16.0 (2025-06-25)
-===================
-
-Deprecations and Removals
--------------------------
-
-- Dropped support for Python 3.7 and 3.8.
-
-Features
---------
-
-- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
-
-Bug Fixes
----------
-
-- Preserve hash when importing mirror data to prevent unnecessary updates later on.
-
-- Keep original metadata_version in database.
-
-
-6.15.0 (2025-05-18)
-===================
-
-Features
---------
-
-- Add ``--connection-limit`` option to devpi-server passed on to waitress.
-

{devpi_server-6.19.0 → devpi_server-6.19.2}/README.rst

@@ -1,22 +1,21 @@
-=============================================================================
-devpi-server: server for private package indexes and PyPI caching
-=============================================================================
+====================================================================================
+devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors
+====================================================================================
 
 
-PyPI cache
-==========
+PyPI on-demand package mirror
+=============================
 
-You can point ``pip or easy_install`` to the ``root/pypi/+simple/``
-index, serving as a transparent cache for pypi-hosted packages.
+You can point ``uv``, ``pip`` or another Python package installer to the ``root/pypi/+simple/`` index,
+serving as a transparent on-demand mirror for PyPI-hosted packages.
 
 
 User specific indexes
 =====================
 
-Each user (which can represent a person, project or team) can have
-multiple indexes and upload packages and docs via standard ``twine`` or
-``setup.py`` invocations.  Users and indexes can be manipulated through
-`devpi-client`_ and a RESTful HTTP API.
+Each user (which can represent a person, project or team) can have multiple indexes,
+and can upload packages and documents to these indexes via standard ``twine`` or ``setup.py`` invocations.
+Users and indexes can be manipulated through `devpi-client`_ and a RESTful HTTP API.
 
 
 Index inheritance
@@ -28,19 +27,16 @@ index using ``root/pypi`` as a parent is a good place to test out a
 release candidate before you push it to PyPI.
 
 
-Good defaults and easy deployment
-=================================
+Sensible defaults for a low friction deployment
+===============================================
 
-Get started easily and create a permanent devpi-server deployment
-including pre-configured templates for ``nginx`` and process managers.
+Get started easily and deploy a devpi-server instance with pre-configured templates for ``nginx`` and process managers.
 
 
 Separate tool for Packaging/Testing activities
 ==============================================
 
-The complementary `devpi-client`_ tool
-helps to manage users, indexes, logins and typical setup.py-based upload and
-installation workflows.
+The complementary `devpi-client`_ tool helps to manage users, indexes, logins and typical package upload and installation workflows.
 
 See https://doc.devpi.net on how to get started and further documentation.
 
@@ -53,9 +49,9 @@ Support
 
 If you find a bug, use the `issue tracker at Github`_.
 
-For general questions use `GitHub Discussions`_ or the `devpi-dev@python.org mailing list`_.
+For general questions, use `GitHub Discussions`_ or the `devpi-dev@python.org mailing list`_.
 
-For support contracts and paid help contact ``mail at pyfidelity.com``.
+For support contracts and paid help, contact ``mail at pyfidelity.com``.
 
 .. _issue tracker at Github: https://github.com/devpi/devpi/issues/
 .. _devpi-dev@python.org mailing list: https://mail.python.org/mailman3/lists/devpi-dev.python.org/

devpi_server-6.19.2/devpi_server/__init__.py

@@ -0,0 +1 @@
+__version__ = "6.19.2"

{devpi_server-6.19.0 → devpi_server-6.19.2}/devpi_server/auth.py

@@ -1,12 +1,15 @@
 from __future__ import annotations
 
 from .log import threadlog
+from .markers import notset
 from passlib.context import CryptContext
+from typing import TYPE_CHECKING
 import itertools
 import itsdangerous
 
 
-notset = object()
+if TYPE_CHECKING:
+    from .main import XOM
 
 
 class AuthException(Exception):
@@ -19,7 +22,7 @@ class Auth:
     class Expired(Exception):
         """ proxy authentication expired. """
 
-    def __init__(self, xom, secret):
+    def __init__(self, xom: XOM, secret: str) -> None:
         self.xom = xom
         self.serializer = itsdangerous.TimedSerializer(secret)
         self.hook = xom.config.hook.devpiserver_auth_request
@@ -56,7 +59,7 @@ class Auth:
             return dict(status="ok", groups=sorted(
                 set(itertools.chain.from_iterable(groups))))
 
-    def _autocreate_user(self, authuser):
+    def _autocreate_user(self, authuser: str) -> None:
         if self.model.get_user(authuser) is None:
             # Autocreated users will be authenticated via plugin, and so no
             # valid password should be stored.

{devpi_server-6.19.0 → devpi_server-6.19.2}/devpi_server/cfg/nginx-devpi-caching-http.conf.template

@@ -9,6 +9,7 @@ map $http_user_agent $devpi_installer_agent {
         ~*setuptools/   1;
         ~*pip/          1;
         ~*pex/          1;
+        ~*uv/           1;
 }
 
 map $http_accept $devpi_installer_accept {