PEP 541 Request: Requests for projects owned by user etingof #2420

lextm · 2022-11-23T08:20:33Z

Project to be claimed

See below

Your PyPI username

lextm: https://pypi.org/user/lextm

Reasons for the request

Grouping of 13 PEP 541 requests for projects:

pysnmp-mibs
pysnmp-apps
pysnmpcrypto
snmpfwd
snmpreceiver
snmpdiscoverer
snmpresponder
pysmi
snmpsim
snmpsim-data
snmpsim-control-plane
snmpclitools
pysnmp

All of them owned by the same user Ilya Etingof (@entingof). But sadly he passed away a few months ago, as announced here.

The packages are dependencies for many open source software or tools used by many of my clients and a broader community. I'd like to take ownership of the packages and keep them up-to-date.

I have contacted owners of several forks, but either no reply or they are not interested in taking over the ecosystem. I also contacted Yeray who has previously requested project ownership in ticket #1104.

Please add me as admin to the projects on PyPI and Test PyPI.

pysnmp-mibs: https://pypi.org/project/pysnmp-mibs
pysnmp-apps: https://pypi.org/project/pysnmp-apps
pysnmpcrypto: https://pypi.org/project/pysnmpcrypto
snmpfwd: https://pypi.org/project/snmpfwd
snmpreceiver: https://pypi.org/project/snmpreceiver
snmpdiscoverer: https://pypi.org/project/snmpdiscoverer
snmpresponder: https://pypi.org/project/snmpresponder
pysmi: https://pypi.org/project/pysmi
snmpsim: https://pypi.org/project/snmpsim
snmpsim-data: https://pypi.org/project/snmpsim-data
snmpsim-control-plane: https://pypi.org/project/snmpsim-control-plane
snmpclitools: https://pypi.org/project/snmpclitools
pysnmp: https://pypi.org/project/pysnmp

Maintenance or replacement?

Replacement

Source code repositories URLs

Ilya's repos

new repos owned by me

Contact and additional research

The previous owner Ilya Etingof (@entingof) passed away a few months ago, as announced here.

I already outlined the complete plan to take over the ownership of the entire ecosystem, as documented

etingof/pysnmp#429

and contacted parties that might be interested in owning the pieces,

Splunk (limited interest in taking over all the pieces)
inexio (no response)

Code of Conduct

I agree to follow the PSF Code of Conduct

The text was updated successfully, but these errors were encountered:

lextm · 2023-01-31T06:35:23Z

My team have published several new releases of lextudio/pysnmp and lextudio/snmpsim in the past two months.

Now this request long passed the six-week reachability phase, so any update on whether to move on to next phase?

yeraydiazdiaz · 2023-02-11T21:13:40Z

Hi @lextm, I don't feel comfortable simply assigning you as owner of all these projects. As explained by @tiran these are critical security projects so I'm going to defer to a @pypi/warehouse-admins.

lextm · 2023-02-11T22:11:39Z

@yeraydiazdiaz Thanks for at least responding with the progress.

di · 2023-02-13T16:57:44Z

inexio (no response)

I think this person (@Lostboi on GitHub) previously filed PEP 541 requests which have been aggregated here: #1104

lextm · 2023-02-13T22:51:16Z

@di I was writing about the company of inexio GmbH, which was once the sponsor of Ilya, and was trying to fork and maintain the documentation site as well as some repos that their products depend on, such as snmpsim.

I wrote to both support@inexio.net and info@inexio.net in Nov 2022, but never got a reply.

It is not clear to me what's the relationship between inexio GmbH and @Lostboi except what you might find under #802, where @Lostboi seemed to request package ownership on behalf of inexio.

Lostboi · 2023-02-14T13:41:19Z

Hey guys,
yes i was trying to get the ownership of the packages on behalf of inexio, since Ilya did not answer us anymore, and the project seems not to be continued.
So we decided to try to maintain the whole snmpsim project.
Sadly we didnt got the time to maintain the project further, and i am not working for inexio anymore.

I know that support@inexio.net does not answer because they dont know whom they could address the task.

Since Ilya has unfortunately passed away, I would think it best that the co-worker (e.g. https://github.com/tiran) of Ilya maintain the project as far as they can, because of the security relevant topics.

lextm · 2023-02-14T16:21:58Z

While this request is being further reviewed, I'd like to ask for clarity on how the security risks are being evaluated.

The original comment left by @tiran contains several key points,

"I'm confident that he will be back in the future". At that time June 2021, likely the original owner could be back. Now we know that's not the case.
"https://pypi.org/user/inexio was created less than a year ago". I wonder if that's a fair way to evaluate a company account. inexio GmbH was founded in 2007 according to file, but only started to publish PyPI packages in 2020. I am in a similar situation that I entered the SNMP business in 2008, founded my company in 2018, and just started to publish PyPI packages in 2020.
The claim of "packages are used in security critical infrastructure" is also interesting. While pyasn1 related packages might have bigger impact on security side as their consumer base is much larger, the packages listed here for pysnmp have much smaller impact. While "SNMP is typically used in enterprise environments to control and monitor hardware like routers and switches", my question is how many of them are using PySNMP but not other SNMP implementations out there? Personally I have been managing the most popular C# SNMP open source library with more than 1.2 million downloads since 2008, so I do understand how to run an open source project in this field.

juliakreger · 2023-04-25T15:08:19Z

Greetings!

I'm curious if there is an update or if any consensus has been reached? Ilya was on my team when he went on leave to never return, and I can say with certainty that he wouldn't want to see pysnmp fragment. Pysnmp for Ilya was much more a project out of passion instead of work funded by any specific employer. As someone who is looking for the next logical path with pysnmp because I have partners using it in driver code today, I really hope a forward path can be reached. One aspect which comes to mind is passion. To me, it seems like @lextm is approaching this with passion, which reminds me so very much of Ilya. 😢

…mp-mibs The original author of pysnmp passed away and the lextudio folks took over maintenance [1]. A request to take over the pysnmp PyPi project is pending [2]. Let's move the the maintained fork rather now than later. While at it, drop the pysnmp-mibs dependency altogether, because this is no longer required for pysnmp>=4.3 [3]. [1] etingof/pysnmp#429 [2] pypi/support#2420 [3] https://github.com/lextudio/pysnmp-mibs/blob/master/README.md Signed-off-by: Bastian Krause <bst@pengutronix.de>

neirbowj · 2023-07-21T01:43:31Z

As a casual, interested observer, this request appears to be stalled, to our collective detriment. In the interests of the PySNMP project and its constituent components, the projects that depend on them, and the broader PyPI community, I would seek greater clarity on the status of this request relative to the PEP 541 process.

Starting from the top, the section on Reachability stipulates that "the maintainers" (meaning those who operate PyPI) "will try to [contact the user] at least three times" (where "the user" is evidently one who is able to publish material to a PyPI project, and "contact" is by email according to one of three defined addresses). I have to identify evidence linked from this request to show that the maintainers have carried out this step. If this step has been completed, could a maintainer please post evidence here? If not, what is preventing progress?

I welcome enlightenment on points I have failed to sufficiently grasp.

geofft · 2024-01-08T21:31:35Z

Hi - I'd like to re-raise this request. I think passing ownership to @lextm makes sense, for a few reasons. There appear to be two active forks of PySNMP; besides https://github.com/lextudio/pysnmp (currently pip install pysnmp-lextudio), the other is https://github.com/pysnmp/pysnmp (pip install pysnmplib). But that one has pointed people at Lex's fork for feature requests (e.g., pysnmp/pysnmp#40), and they have not raised a request to take over the PyPI name pysnmp.

Furthermore, the pysnmp GitHub organization also has its own fork of pyasn1, published as pip install pysnmp-pyasn1. This was necessary because Ilya Etingof was also the maintainer of pyasn1, and in fact Lex also had forked it (as pip install pyasn1-lextudio). But ownership of pyasn1 was transferred in #2090 and maintenance has been continued, and Lex's project now depends on the standard one (lextudio/pysnmp@924a022), whereas pysnmplib continues to depend on their fork.

If I understand correctly, you cannot have both pysnmplib and the standard pyasn1 in your transitive requirements, because both pysnmp-pyasn1 and the standard pyasn1 use the same importable name import pyasn1. So, the other fork is essentially not usable in the broader ecosystem. This was reported as pysnmp/pysnmp#51 but there has not been any response.

But you can have pysnmp-lextudio and pyasn1 coinstalled. So, I think transferring the ownership to @lextm is consistent with the PyPI project's previous decision in #2090 and is the best thing for the ecosystem.

I also agree with the point above that @tiran's statement about security sensitivity is more about pyasn1 than pysnmp - yes, pysnmp is used in security-sensitive contexts, but pyasn1 is very widely used and the risk of passing it to someone untrustworthy is much, much higher.

To the most recent question about contact: the user cannot be contacted due to his death, and so this step is moot.

But I don't know what the next step is, then. Can a PyPI maintainer comment on what needs to be done, please?

(@tiran, since you specifically requested a hold on transferring Ilya's projects in #1104, would you mind sharing thoughts on what should happen with pysnmp and more generally the non-pyasn1 projects?)

lextm · 2024-02-06T04:41:30Z

While this request remains pending, projects have migrated to the *-lextudio forks in the past few months. Below is not intended to be a complete list but the momentum is clear.

Name
OpenStack
Checkmk
Home Assistant
Genie libs
brother
Proliantutils
labgrid
snimpy

ambv · 2024-05-03T12:32:33Z

We could not reach Ilya, and we consider his projects abandoned per PEP 541. We recommend that the PyPI Administrators assign @lextm as the new owner of the following projects, and we confirm that the community is already using Lex's forks in considerable numbers:

Please note that Ilya used two accounts on PyPI. The main one's https://pypi.org/user/etingof/ and the other is https://pypi.org/user/ilya/. We determined this is the same person, as corroborated by the fact multiple projects list both accounts as an owner, and the remaining projects use the ilya account but also list the etingof@gmail.com address in the package metadata.

Disclaimer: We are providing support to the PyPI Administrators to validate this request and make a recommendation on the outcome and actions to be taken. Final determination will be made by the PyPI Administrators when our process is complete.

ewdurbin · 2024-07-16T14:00:59Z

PyPI

Added 'lextm' as 'Owner' on 'pysnmp-mibs'
Added 'lextm' as 'Owner' on 'pysnmp-apps'
Added 'lextm' as 'Owner' on 'pysnmpcrypto'
Added 'lextm' as 'Owner' on 'snmpfwd'
Added 'lextm' as 'Owner' on 'snmpreceiver'
Added 'lextm' as 'Owner' on 'snmpdiscoverer'
Added 'lextm' as 'Owner' on 'snmpresponder'
Added 'lextm' as 'Owner' on 'pysmi'
Added 'lextm' as 'Owner' on 'snmpsim'
Added 'lextm' as 'Owner' on 'snmpsim-data'
Added 'lextm' as 'Owner' on 'snmpsim-control-plane'
Added 'lextm' as 'Owner' on 'snmpclitools'
Added 'lextm' as 'Owner' on 'pysnmp'

TestPyPI

None of the listed projects exist.

lextm added the PEP 541 Package name support requests label Nov 23, 2022

lextm mentioned this issue May 9, 2023

Call for your help to revive the PySNMP ecosystem together etingof/pysnmp#429

Closed

13 tasks

Bastian-Krause mentioned this issue May 19, 2023

pyproject.toml: move pysnmp -> pysnmp-lextudio, drop unnecessary pysnmp-mibs labgrid-project/labgrid#1186

Merged

1 task

m-erhardt mentioned this issue Dec 5, 2023

TypeError: decodeMessageVersion.<locals>.<lambda>() takes 3 positional arguments but 4 were given m-erhardt/check-synology-plugins#9

Open

ambv assigned ewdurbin, di and dstufft Jun 28, 2024

ewdurbin closed this as completed Jul 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PEP 541 Request: Requests for projects owned by user etingof #2420

PEP 541 Request: Requests for projects owned by user etingof #2420

lextm commented Nov 23, 2022 •

edited

Loading

lextm commented Jan 31, 2023

yeraydiazdiaz commented Feb 11, 2023

lextm commented Feb 11, 2023

di commented Feb 13, 2023

lextm commented Feb 13, 2023

Lostboi commented Feb 14, 2023

lextm commented Feb 14, 2023 •

edited

Loading

juliakreger commented Apr 25, 2023

neirbowj commented Jul 21, 2023

geofft commented Jan 8, 2024

lextm commented Feb 6, 2024

ambv commented May 3, 2024

ewdurbin commented Jul 16, 2024

PEP 541 Request: Requests for projects owned by user etingof #2420

PEP 541 Request: Requests for projects owned by user etingof #2420

Comments

lextm commented Nov 23, 2022 • edited Loading

Project to be claimed

Your PyPI username

Reasons for the request

Maintenance or replacement?

Source code repositories URLs

Ilya's repos

new repos owned by me

Contact and additional research

Code of Conduct

lextm commented Jan 31, 2023

yeraydiazdiaz commented Feb 11, 2023

lextm commented Feb 11, 2023

di commented Feb 13, 2023

lextm commented Feb 13, 2023

Lostboi commented Feb 14, 2023

lextm commented Feb 14, 2023 • edited Loading

juliakreger commented Apr 25, 2023

neirbowj commented Jul 21, 2023

geofft commented Jan 8, 2024

lextm commented Feb 6, 2024

ambv commented May 3, 2024

ewdurbin commented Jul 16, 2024

PyPI

TestPyPI

lextm commented Nov 23, 2022 •

edited

Loading

lextm commented Feb 14, 2023 •

edited

Loading