PyPI packages ownership

[jGaboardi]

@ljwolf @sjsrey @weikang9009

Should all PySAL federated packages have more than 1 owner in pypi? It seems that most packages at least have multiple maintainers listed but still only have one owner, spaghetti for example. This could simply be a lead maintainer from another package to serve a backup owner holding the password.

[weikang9009]

I think maintainers can release the package on pypi. Having at least one maintainer in addition to the owner should be OK?

[jGaboardi]

I think maintainers can release the package on pypi.

I fully agree with this. However, my concern is more about having an extra pysal-dev with absolute rights simply as a fail-safe. I believe adopting this model would provide a smooth transition in case responsibilities/circumstances change suddenly.

[ljwolf]

It might be good to have a common account with shared credentials that all maintainers as a failsafe.

[jGaboardi]

@knaaptime Do you have any thoughts on this?

[knaaptime]

i think its a good idea, and a shared account might be the best way to administer it

[jGaboardi]

@martinfleis Can you add the information mentioned in today's meeting about the GH<-->PyPI org credentials?

[martinfleis]

https://docs.pypi.org/trusted-publishers/