search

meshy / pythonwheels

Adoption analysis of Python Wheels: https://pythonwheels.com/
BSD 2-Clause "Simplified" License
102 stars 26 forks source link

page recommends use of “python setup.py upload” #111

Closed Lx closed 5 years ago

Lx commented 5 years ago

From the Python Wheels homepage:

…and when you'd normally run python setup.py sdist upload, run instead python setup.py sdist bdist_wheel upload.

This is a security risk according to the Python Packaging User Guide:

Warning: In other resources you may encounter references to using python setup.py register and python setup.py upload. These methods of registering and uploading a package are strongly discouraged as it may use a plaintext HTTP or unverified HTTPS connection on some Python versions, allowing your username and password to be intercepted during transmission.

and may therefore warrant at least a mention that the use of something else is encouraged.

ghickman commented 5 years ago

@Lx – thanks for raising this!

Would you consider a PR to reword this section? @meshy and myself are, unfortunately, tied up this week and unable to look into it.

Lx commented 5 years ago

Sorry, but I'm not knowledgeable enough on Python packaging at this point to do so comfortably. I hope this/next week is a little less hectic for you!