Right now you HAVE to store a clear text password in .pypirc.

But this should not be necessary since the "register" command does a
getpass.getpass call to get the password from the prompt and use it to
authenticate to pypi.

So what do we miss ? 

We miss a bit of persistency for the upload command to get that password
when register + upload have been called in the same command line, typically:

$ python setup.py register sdist upload

this patch does it, and adds a test for it.

I am wondering though if upload wouldn't be better not to depend on a 
previous call to register (basically by adding a getpass.getpass call
there too), but this can be a second patch.

According to my tests, something is hosed with password saving in the
register command for 3.0 already: the saved password doesn't seem to be
used. Before this patch is considered, the other problem should be
resolved (but isn't yet reported to roundup, AFAICT).

can you provide me a scenario to reproduce it ? 

-> did you have a .pypirc already with no password, or no .pypirc, etc..

Here is what I did:
1. I started with no pypirc
2. I ran register, it asked me for username, password
3. I chose to save it, it created a .pypirc
4. I ran register again, it asked me again for username, password, even
though this was saved already.

Looking at the code, it seems the problem is that the pypirc has a
section pypirc that lists the server, but the code reading it wants a
section distutils.

I could reproduce it under 2.6, 

the problem is located at distutils.config.DEFAULT_PYPIRC

the default structure is wrong there, I'll add a ticket with a patch
and a test right away

Ok, I wrote a patch for the problem you mentioned in 

http://bugs.python.org/issue4400

I have fixed issue4400, and I am back at work for this feature. 

I will propose it in Distutils-SIG to see what people think.

Ok, I had one +1 from distutils-SIG, so I am updating this patch to
commit it in 2.7 and 3.1.

done in r68415