devpi-server 6.19.1__tar.gz → 6.19.3__tar.gz

{devpi_server-6.19.1 → devpi_server-6.19.3}/.flake8

@@ -4,5 +4,4 @@ ignore = E203,E501,E704,E741,W503
 per-file-ignores =
     plugin.py:E127,E128,E231
     model.py:E128,E231
-    test_importexport.py:E121
     test*.py:E126,E127,E128,E225,E226,E231,E251

{devpi_server-6.19.1 → devpi_server-6.19.3}/CHANGELOG

@@ -2,6 +2,39 @@
 
 .. towncrier release notes start
 
+6.19.3 (2026-04-13)
+===================
+
+Bug Fixes
+---------
+
+- Fix #1112: Parse simple JSON reply even with wrong content-type in reply if the body seems to contain JSON.
+
+- Return stale project list for mirrors when the lock can't be acquired within the timeout.
+
+- Fix importing of toxresults from devpi-server 6.5.0 to 6.9.0 where the wrong hash was stored.
+
+
+6.19.2 (2026-03-17)
+===================
+
+Bug Fixes
+---------
+
+- Preserve log for documentation uploads in export.
+
+- Any missing file on mirrors will be ignored during event processing as is already the case in other places.
+
+- Use short timeout when project list is requested for ``has_project`` call on mirrors instead of the long one used for ``list_projects``. This prevents installers from timing out and retrying several times.
+
+- Fix error handling for proxy requests from replica to primary.
+
+Other Changes
+-------------
+
+- Removed limit of reported missing files for devpi-fsck.
+
+
 6.19.1 (2026-02-09)
 ===================
 
@@ -12,6 +45,7 @@ Bug Fixes
 
 - Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
 
+
 6.19.0 (2026-02-06)
 ===================
 

{devpi_server-6.19.1 → devpi_server-6.19.3}/CHANGELOG.short.rst

@@ -9,6 +9,39 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.3 (2026-04-13)
+===================
+
+Bug Fixes
+---------
+
+- Fix #1112: Parse simple JSON reply even with wrong content-type in reply if the body seems to contain JSON.
+
+- Return stale project list for mirrors when the lock can't be acquired within the timeout.
+
+- Fix importing of toxresults from devpi-server 6.5.0 to 6.9.0 where the wrong hash was stored.
+
+
+6.19.2 (2026-03-17)
+===================
+
+Bug Fixes
+---------
+
+- Preserve log for documentation uploads in export.
+
+- Any missing file on mirrors will be ignored during event processing as is already the case in other places.
+
+- Use short timeout when project list is requested for ``has_project`` call on mirrors instead of the long one used for ``list_projects``. This prevents installers from timing out and retrying several times.
+
+- Fix error handling for proxy requests from replica to primary.
+
+Other Changes
+-------------
+
+- Removed limit of reported missing files for devpi-fsck.
+
+
 6.19.1 (2026-02-09)
 ===================
 
@@ -19,6 +52,7 @@ Bug Fixes
 
 - Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
 
+
 6.19.0 (2026-02-06)
 ===================
 
@@ -78,72 +112,3 @@ Other Changes
 
 - The filenames of some exported doczip files change due to normalization of the project name caused by changing the internals during export to allow ``--hard-links`` to work.
 
-
-6.17.0 (2025-08-27)
-===================
-
-Deprecations and Removals
--------------------------
-
-- Dropped support for migrating old password hashes that were replaced in devpi-server 4.2.0.
-
-- Removed support for basic authorization in primary URL. The connection is already secured by a bearer token header.
-
-- Removed the experimental ``--replica-cert`` option. The replica is already using a token via a shared secret, so this is redundant.
-
-- Removed ``--replica-max-retries`` option. It wasn't implemented for async_httpget and didn't work correctly when streaming data.
-
-Features
---------
-
-- Use httpx for all data fetching for mirrors and fetch projects list asynchronously to allow update in background even after a timeout.
-
-- Use httpx instead of requests when proxying from replicas to primary.
-
-- Use httpx for all requests from replicas to primary.
-
-- Use httpx when pushing releases to external index.
-
-- Added ``mirror_ignore_serial_header`` mirror index option, which allows switching from PyPI to a mirror without serials header when set to ``True``, otherwise only stale links will be served and no updates be stored.
-
-- The HTTP cache information for mirrored projects is persisted and re-used on server restarts.
-
-- Added ``--file-replication-skip-indexes`` option to skip file replication for ``all``, by index type (i.e. ``mirror``) or index name (i.e. ``root/pypi``).
-
-Bug Fixes
----------
-
-- Correctly handle lists for ``Provides-Extra`` and ``License-File`` metadata in database.
-
-- Fix traceback by returning 401 error code when using wrong password with a user that was created using an authentication plugin like devpi-ldap which passes authentication through in that case.
-
-- Fix #1053: allow users to update their passwords when ``--restrict-modify`` is used.
-
-- Fix #1097: return 404 when trying to POST to +simple.
-
-Other Changes
--------------
-
-- Changed User-Agent when fetching data for mirrors from just "server" to "devpi-server".
-
-
-6.16.0 (2025-06-25)
-===================
-
-Deprecations and Removals
--------------------------
-
-- Dropped support for Python 3.7 and 3.8.
-
-Features
---------
-
-- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
-
-Bug Fixes
----------
-
-- Preserve hash when importing mirror data to prevent unnecessary updates later on.
-
-- Keep original metadata_version in database.
-

{devpi_server-6.19.1 → devpi_server-6.19.3}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: devpi-server
-Version: 6.19.1
-Summary: devpi-server: reliable, private, and pypi.org caching server
+Version: 6.19.3
+Summary: devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors
 Maintainer-email: Florian Schulze <mail@pyfidelity.com>
 License-Expression: MIT
 Project-URL: Bug Tracker, https://github.com/devpi/devpi/issues
@@ -43,6 +43,7 @@ Requires-Dist: pluggy<2.0,>=0.6.0
 Requires-Dist: py>=1.4.23
 Requires-Dist: pyramid>=2
 Requires-Dist: repoze.lru>=0.6
+Requires-Dist: requests>=2.3.0
 Requires-Dist: setuptools<=81
 Requires-Dist: strenum; python_version < "3.11"
 Requires-Dist: strictyaml
@@ -50,25 +51,24 @@ Requires-Dist: waitress>=1.0.1
 Requires-Dist: ruamel.yaml
 Dynamic: license-file
 
-=============================================================================
-devpi-server: server for private package indexes and PyPI caching
-=============================================================================
+====================================================================================
+devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors
+====================================================================================
 
 
-PyPI cache
-==========
+PyPI on-demand package mirror
+=============================
 
-You can point ``pip or easy_install`` to the ``root/pypi/+simple/``
-index, serving as a transparent cache for pypi-hosted packages.
+You can point ``uv``, ``pip`` or another Python package installer to the ``root/pypi/+simple/`` index,
+serving as a transparent on-demand mirror for PyPI-hosted packages.
 
 
 User specific indexes
 =====================
 
-Each user (which can represent a person, project or team) can have
-multiple indexes and upload packages and docs via standard ``twine`` or
-``setup.py`` invocations.  Users and indexes can be manipulated through
-`devpi-client`_ and a RESTful HTTP API.
+Each user (which can represent a person, project or team) can have multiple indexes,
+and can upload packages and documents to these indexes via standard ``twine`` or ``setup.py`` invocations.
+Users and indexes can be manipulated through `devpi-client`_ and a RESTful HTTP API.
 
 
 Index inheritance
@@ -80,19 +80,16 @@ index using ``root/pypi`` as a parent is a good place to test out a
 release candidate before you push it to PyPI.
 
 
-Good defaults and easy deployment
-=================================
+Sensible defaults for a low friction deployment
+===============================================
 
-Get started easily and create a permanent devpi-server deployment
-including pre-configured templates for ``nginx`` and process managers.
+Get started easily and deploy a devpi-server instance with pre-configured templates for ``nginx`` and process managers.
 
 
 Separate tool for Packaging/Testing activities
 ==============================================
 
-The complementary `devpi-client`_ tool
-helps to manage users, indexes, logins and typical setup.py-based upload and
-installation workflows.
+The complementary `devpi-client`_ tool helps to manage users, indexes, logins and typical package upload and installation workflows.
 
 See https://doc.devpi.net on how to get started and further documentation.
 
@@ -105,9 +102,9 @@ Support
 
 If you find a bug, use the `issue tracker at Github`_.
 
-For general questions use `GitHub Discussions`_ or the `devpi-dev@python.org mailing list`_.
+For general questions, use `GitHub Discussions`_ or the `devpi-dev@python.org mailing list`_.
 
-For support contracts and paid help contact ``mail at pyfidelity.com``.
+For support contracts and paid help, contact ``mail at pyfidelity.com``.
 
 .. _issue tracker at Github: https://github.com/devpi/devpi/issues/
 .. _devpi-dev@python.org mailing list: https://mail.python.org/mailman3/lists/devpi-dev.python.org/
@@ -124,6 +121,39 @@ Changelog
 
 .. towncrier release notes start
 
+6.19.3 (2026-04-13)
+===================
+
+Bug Fixes
+---------
+
+- Fix #1112: Parse simple JSON reply even with wrong content-type in reply if the body seems to contain JSON.
+
+- Return stale project list for mirrors when the lock can't be acquired within the timeout.
+
+- Fix importing of toxresults from devpi-server 6.5.0 to 6.9.0 where the wrong hash was stored.
+
+
+6.19.2 (2026-03-17)
+===================
+
+Bug Fixes
+---------
+
+- Preserve log for documentation uploads in export.
+
+- Any missing file on mirrors will be ignored during event processing as is already the case in other places.
+
+- Use short timeout when project list is requested for ``has_project`` call on mirrors instead of the long one used for ``list_projects``. This prevents installers from timing out and retrying several times.
+
+- Fix error handling for proxy requests from replica to primary.
+
+Other Changes
+-------------
+
+- Removed limit of reported missing files for devpi-fsck.
+
+
 6.19.1 (2026-02-09)
 ===================
 
@@ -134,6 +164,7 @@ Bug Fixes
 
 - Always allow replicas to access deleted releases to get the proper ``410 Gone`` instead of ``403 Forbidden`` when ``devpi-lockdown`` is in use.
 
+
 6.19.0 (2026-02-06)
 ===================
 
@@ -193,72 +224,3 @@ Other Changes
 
 - The filenames of some exported doczip files change due to normalization of the project name caused by changing the internals during export to allow ``--hard-links`` to work.
 
-
-6.17.0 (2025-08-27)
-===================
-
-Deprecations and Removals
--------------------------
-
-- Dropped support for migrating old password hashes that were replaced in devpi-server 4.2.0.
-
-- Removed support for basic authorization in primary URL. The connection is already secured by a bearer token header.
-
-- Removed the experimental ``--replica-cert`` option. The replica is already using a token via a shared secret, so this is redundant.
-
-- Removed ``--replica-max-retries`` option. It wasn't implemented for async_httpget and didn't work correctly when streaming data.
-
-Features
---------
-
-- Use httpx for all data fetching for mirrors and fetch projects list asynchronously to allow update in background even after a timeout.
-
-- Use httpx instead of requests when proxying from replicas to primary.
-
-- Use httpx for all requests from replicas to primary.
-
-- Use httpx when pushing releases to external index.
-
-- Added ``mirror_ignore_serial_header`` mirror index option, which allows switching from PyPI to a mirror without serials header when set to ``True``, otherwise only stale links will be served and no updates be stored.
-
-- The HTTP cache information for mirrored projects is persisted and re-used on server restarts.
-
-- Added ``--file-replication-skip-indexes`` option to skip file replication for ``all``, by index type (i.e. ``mirror``) or index name (i.e. ``root/pypi``).
-
-Bug Fixes
----------
-
-- Correctly handle lists for ``Provides-Extra`` and ``License-File`` metadata in database.
-
-- Fix traceback by returning 401 error code when using wrong password with a user that was created using an authentication plugin like devpi-ldap which passes authentication through in that case.
-
-- Fix #1053: allow users to update their passwords when ``--restrict-modify`` is used.
-
-- Fix #1097: return 404 when trying to POST to +simple.
-
-Other Changes
--------------
-
-- Changed User-Agent when fetching data for mirrors from just "server" to "devpi-server".
-
-
-6.16.0 (2025-06-25)
-===================
-
-Deprecations and Removals
--------------------------
-
-- Dropped support for Python 3.7 and 3.8.
-
-Features
---------
-
-- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
-
-Bug Fixes
----------
-
-- Preserve hash when importing mirror data to prevent unnecessary updates later on.
-
-- Keep original metadata_version in database.
-

{devpi_server-6.19.1 → devpi_server-6.19.3}/README.rst

@@ -1,22 +1,21 @@
-=============================================================================
-devpi-server: server for private package indexes and PyPI caching
-=============================================================================
+====================================================================================
+devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors
+====================================================================================
 
 
-PyPI cache
-==========
+PyPI on-demand package mirror
+=============================
 
-You can point ``pip or easy_install`` to the ``root/pypi/+simple/``
-index, serving as a transparent cache for pypi-hosted packages.
+You can point ``uv``, ``pip`` or another Python package installer to the ``root/pypi/+simple/`` index,
+serving as a transparent on-demand mirror for PyPI-hosted packages.
 
 
 User specific indexes
 =====================
 
-Each user (which can represent a person, project or team) can have
-multiple indexes and upload packages and docs via standard ``twine`` or
-``setup.py`` invocations.  Users and indexes can be manipulated through
-`devpi-client`_ and a RESTful HTTP API.
+Each user (which can represent a person, project or team) can have multiple indexes,
+and can upload packages and documents to these indexes via standard ``twine`` or ``setup.py`` invocations.
+Users and indexes can be manipulated through `devpi-client`_ and a RESTful HTTP API.
 
 
 Index inheritance
@@ -28,19 +27,16 @@ index using ``root/pypi`` as a parent is a good place to test out a
 release candidate before you push it to PyPI.
 
 
-Good defaults and easy deployment
-=================================
+Sensible defaults for a low friction deployment
+===============================================
 
-Get started easily and create a permanent devpi-server deployment
-including pre-configured templates for ``nginx`` and process managers.
+Get started easily and deploy a devpi-server instance with pre-configured templates for ``nginx`` and process managers.
 
 
 Separate tool for Packaging/Testing activities
 ==============================================
 
-The complementary `devpi-client`_ tool
-helps to manage users, indexes, logins and typical setup.py-based upload and
-installation workflows.
+The complementary `devpi-client`_ tool helps to manage users, indexes, logins and typical package upload and installation workflows.
 
 See https://doc.devpi.net on how to get started and further documentation.
 
@@ -53,9 +49,9 @@ Support
 
 If you find a bug, use the `issue tracker at Github`_.
 
-For general questions use `GitHub Discussions`_ or the `devpi-dev@python.org mailing list`_.
+For general questions, use `GitHub Discussions`_ or the `devpi-dev@python.org mailing list`_.
 
-For support contracts and paid help contact ``mail at pyfidelity.com``.
+For support contracts and paid help, contact ``mail at pyfidelity.com``.
 
 .. _issue tracker at Github: https://github.com/devpi/devpi/issues/
 .. _devpi-dev@python.org mailing list: https://mail.python.org/mailman3/lists/devpi-dev.python.org/

devpi_server-6.19.3/devpi_server/__init__.py

@@ -0,0 +1 @@
+__version__ = "6.19.3"

{devpi_server-6.19.1 → devpi_server-6.19.3}/devpi_server/auth.py

@@ -1,12 +1,15 @@
 from __future__ import annotations
 
 from .log import threadlog
+from .markers import notset
 from passlib.context import CryptContext
+from typing import TYPE_CHECKING
 import itertools
 import itsdangerous
 
 
-notset = object()
+if TYPE_CHECKING:
+    from .main import XOM
 
 
 class AuthException(Exception):
@@ -19,7 +22,7 @@ class Auth:
     class Expired(Exception):
         """ proxy authentication expired. """
 
-    def __init__(self, xom, secret):
+    def __init__(self, xom: XOM, secret: str) -> None:
         self.xom = xom
         self.serializer = itsdangerous.TimedSerializer(secret)
         self.hook = xom.config.hook.devpiserver_auth_request
@@ -56,7 +59,7 @@ class Auth:
             return dict(status="ok", groups=sorted(
                 set(itertools.chain.from_iterable(groups))))
 
-    def _autocreate_user(self, authuser):
+    def _autocreate_user(self, authuser: str) -> None:
         if self.model.get_user(authuser) is None:
             # Autocreated users will be authenticated via plugin, and so no
             # valid password should be stored.

{devpi_server-6.19.1 → devpi_server-6.19.3}/devpi_server/cfg/nginx-devpi-caching-http.conf.template

@@ -9,6 +9,7 @@ map $http_user_agent $devpi_installer_agent {
         ~*setuptools/   1;
         ~*pip/          1;
         ~*pex/          1;
+        ~*uv/           1;
 }
 
 map $http_accept $devpi_installer_accept {