search

pypa / packaging-problems

An issue tracker for the problems in packaging
151 stars 34 forks source link

Programmatic access to yanking releases #633

Open jefftlin123 opened 1 year ago

jefftlin123 commented 1 year ago

Problem description

I would like to make an http request to yank a release. For example, I can yank https://pypi.org/project/example-package-jefftlin/ through the UI on the webpage for that package. But when attempting to use curl from my linux terminal to yank it, I receive:

curl --request POST https://pypi.org/manage/project/example-package-jefftlin/release/0.0.1 -L --data-binary yanked_reason="to test" -b cookies.txt

400 Bad CSRF Origin

400 Bad CSRF Origin

Access is denied. This server can not verify that the origin or referrer of your request matches the current site. Either your browser supplied the wrong Origin or Referrer or it did not supply one at all.

Origin checking failed - missing Origin or Referer. % I've attempted to provide the cookie using curl -b, or via including CSRF in the payload --data-binary . I get the CSRF token using a GET request to the same url. What can I do differently to be able to make a POST request to yank my release from the command line?
merwok commented 1 year ago

Cand you report this to https://github.com/pypi/warehouse/ if there isn’t already a ticket for it?

jefftlin123 commented 1 year ago

Done.

jefftlin123 commented 1 year ago

@merwok any chance you know the answer to my question of if programmatically yanking is currently possible? I feel like it's not and a day of research is behind that, but I may have missed something.

woodruffw commented 1 year ago

@apefaceddog programmatic yanking is not currently possible, to the best of my knowledge.

warsaw commented 6 days ago

This is important to us as well, so I am actually working on it, although I don't have anything to share atm. Hopefully I can put up a PR next week.