flit publish fails: this api is no longer supported

[jwkvam]

Running flit publish results in the following. Last time I did this, May 24 (withflit wheel --upload) it worked. I'm not sure what it means by simply upload the file.

Copying package file(s) from bowtie                                                                       I-flit.wheel
Writing metadata files                                                                                    I-flit.wheel
Writing the record of files                                                                               I-flit.wheel
Built wheel: dist/bowtie-0.4.0-py2.py3-none-any.whl                                                       I-flit.wheel
Found 62 files tracked in git                                                                             I-flit.sdist
Writing generated setup.py                                                                                I-flit.sdist
Built sdist: dist/bowtie-0.4.0.tar.gz                                                                     I-flit.sdist
Using repository at https://upload.pypi.org/legacy/                                                      I-flit.upload
Install keyring to store passwords securely                                                              W-flit.upload
Server  : https://upload.pypi.org/legacy/
Username: jwkvam
Password:
Uploading dist/bowtie-0.4.0-py2.py3-none-any.whl...                                                      I-flit.upload
Uploading forbidden; trying to register and upload again                                                 W-flit.upload
Traceback (most recent call last):
  File "/Users/jacques/miniconda/lib/python3.6/site-packages/flit/upload.py", line 256, in do_upload
    upload_file(file, metadata, repo)
  File "/Users/jacques/miniconda/lib/python3.6/site-packages/flit/upload.py", line 225, in upload_file
    resp.raise_for_status()
  File "/Users/jacques/miniconda/lib/python3.6/site-packages/requests/models.py", line 937, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Invalid or non-existent authentication information. for url: https://upload.pypi.org/legacy/

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/jacques/miniconda/bin/flit", line 11, in <module>
    sys.exit(main())
  File "/Users/jacques/miniconda/lib/python3.6/site-packages/flit/__init__.py", line 123, in main
    main(args.ini_file, args.repository, formats=set(args.format or []))
  File "/Users/jacques/miniconda/lib/python3.6/site-packages/flit/upload.py", line 276, in main
    do_upload(built.wheel.file, built.wheel.builder.metadata, repo_name)
  File "/Users/jacques/miniconda/lib/python3.6/site-packages/flit/upload.py", line 262, in do_upload
    register(metadata, repo)
  File "/Users/jacques/miniconda/lib/python3.6/site-packages/flit/upload.py", line 237, in register
    resp.raise_for_status()
  File "/Users/jacques/miniconda/lib/python3.6/site-packages/requests/models.py", line 937, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 410 Client Error: This API is no longer supported, instead simply upload the file. for url: https://upload.pypi.org/legacy/

[jwkvam]

Workaround

I installed flit 0.10 and used flit wheel --upload.

[takluyver]

Is it possible that you typed your password in wrong?

The first error that occurs is Invalid or non-existent authentication information. When flit gets a 403 error on package upload, it tries to register the package first and then upload again. This is necessary for a totally new package on old PyPI (https://pypi.python.org/pypi), but new PyPI (https://pypi.org/) has got rid of the register step altogether, so that fails.

I should write some code to tell if the upload is going to new PyPI and behave differently.

[jwkvam]

I'm almost sure I typed it in correctly at least once, unless pypi.org has different credentials. That part confused me too though. I tried it several times to guard against that. Then the first time I ran flit wheel --upload it worked.

[takluyver]

Weird. Credentials should be the same. I don't think the upload code has changed much in the newest version of flit. The code for getting your password has changed, and it might also have changed to use the new pypi by default if you don't have it configured in .pypirc .

…

On 17 Jun 2017 10:59 p.m., "Jacques Kvam" ***@***.***> wrote: I'm almost sure I typed it in correctly at least once, unless pypi.org has different credentials. That part confused me too though. I tried it several times to guard against that. Then the first time I ran flit wheel --upload it worked. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#112 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAUA9eMSrBtmbSCigHsCT0lRbX5LI1Rlks5sFExdgaJpZM4N9VXx> .

[choldgraf]

I've got the same error as well. Credentials definitely work since they work fine when logging into the pypi website.

[choldgraf]

updating my pypirc file following the defaults given on the pypi website seems to have fixed this

[jwkvam]

I don't remember ever creating a pypirc file but it just has.

[pypi]
username = jwkvam

Is this correct?

[choldgraf]

I also added repository: https://pypi.python.org/pypi

[Carreau]

it should be something like:

[distutils]
index-servers =
    pypi

[pypi]
repository:https://upload.pypi.io/legacy/
username: mbussonn
password: mysupersecretpasswordincleartext

the repository: https://pypi.python.org/pypi line should be optional. I for example uses https://upload.pypi.io/legacy/ as it is a more recent backend server that has been rewritten, is faster, but may not have the exact same behavior as https://pypi.python.org/pypi.

[takluyver]

@choldgraf thanks for the info. That sounds like the new server (pypi.org) is rejecting your password for some reason, but the old one (pypi.python.org) is accepting it. It might be a bug on the server side, since they're supposed to run from the same database. Or maybe we need to send the authentication information differently somehow. Unfortunately, I don't have a good way to test this without uploading a package.

@jwkvam When you tried uploading with the newer version of flit, it would have created that file automatically to record your username.

[takluyver]

For clarity, one of the changes in the 0.11 release was to switch the default upload URL (if you haven't specified the address of PyPI in your .pypirc file), from the old system to the new one. The line @choldgraf added to .pypirc overrides the default and tells it to use the old server for uploads.

[takluyver]

@Carreau have you published any packages recently using either pypi.org or pypi.io?

[Carreau]

pypi.io

Yes. For me it just works (on PyPI.io 5 minutes ago. – published a 0.0.6 of undefined just to test). We had some similar issues with setup.py upload on classic PyPI with @stefanv and had to switch to pypi.io. We tried to publish skimage (non existing package at the time that now just raises please install scikit-image and not skimage) and were unable to upload ("Please register first") nor register ("Please upload directly"). We avoided flit explicitly because we wanted setup.py to actually fail, and not a shim package. It might be related I guess ?

[jwkvam]

Using Carreau's example pypirc allows me to upload, thanks. The issue is resolved for me. 👍

[choldgraf]

omg I hadn't heard of pypi.io...you mean to tell me that the python community for once decided not to have a highly-public website that looks like it was created in the early 90s? Incredible!

I was able to login fine with pypi.io, so if that's the new server then the same login credentials still work for me

[Carreau]

omg I hadn't heard of pypi.io...you mean to tell me that the python community for once decided not to have a highly-public website that looks like it was created in the early 90s? Incredible!

Yeah, it's still in development, but it's only the free time of 1/2 a dev. The backend database is shared between PyPI.io and pypi.python.org, so modification on any of these two will be reflected immediately on the other.

[choldgraf]

ah I wish there were money to pay people to make things more user-friendly and pretty...

[takluyver]

At least for me, pypi.io redirects to pypi.org. So either it was a temporary glitch which is now fixed again, or there's something weird happening when you upload directly to pypi.org rather than requesting pypi.io.

[takluyver]

I found the problem: when you entered the password in the terminal, it wouldn't actually use it for the upload (a return was missing). It's fixed in 0.11.3.

They're going to stop old PyPI accepting uploads on July 3rd, so if you have https://pypi.python.org/pypi in your .pypirc file, you'll want to remove that or update it to https://upload.pypi.org/legacy/.

Finally, if you install the keyring package, flit will store your password in your system's native password store, so you don't need to type it each time. It doesn't currently support changing the stored password, though - for now, you have to do that in whatever interface the OS provides.

[choldgraf]

ah - nice! thanks for the heads up on pypi switching...and the note about keyring. I think all of that should be in the docs :-)

[Carreau]

They're going to stop old PyPI accepting uploads on July 3rd

Oh, where did you saw that ? Will there be a redirect ? If they announced it they should announce it more broadly.

[takluyver]

It was just announced on distutils sig as I was fixing this today. I think they're planning to make it produce an informative error message. I suspect it's still going to be annoying for many people, but I don't think that would improve much by waiting longer.

…

On 22 Jun 2017 6:49 p.m., "Matthias Bussonnier" ***@***.***> wrote: They're going to stop old PyPI accepting uploads on July 3rd Oh, where did you saw that ? Will there be a redirect ? If they announced it they should announce it more broadly. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#112 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAUA9XBT4_tk8IwPweKBc1vGpUx2XT1vks5sGqkegaJpZM4N9VXx> .