That's very annoying that distutils asks to save your pass when uploading to PyPI, but refuses to upload if you refuse. So you end up with storing your password in cleartext.

Try the next command to see what I mean:

setup.py register sdist upload

> python setup.py build sdist register upload
...
Save your login (y/N)?n
running upload
Submitting dist\review-r585.zip to http://pypi.python.org/pypi
Upload failed (401): You must be identified to edit package information

Do you have a list of more important tasks than this one. I'd like to elaborate, because for me alone it could take a lot of time. What I need now is SVN URL to checkout distutils code and some advice where to start. No guarantees though - if the code is too complicated, I won't be able to dedicate much time for exploration.

Fix attached. Also on Rietveld - http://codereview.appspot.com/2874041

Could you also backport it to other Python distributions to avoid questions like these:

http://stackoverflow.com/questions/3773613/pypi-issues-upload-failed-401-you-must-be-identified-to-edit-package-informa
http://stackoverflow.com/questions/1750186/weird-pypi-authentication-behavior

Thanks for the patch.  Review on Rietveld.

What are “other Python distributions”?

This fix is needed for 2.6 releases also to be able to upload packages from Linux.

Security issues are for example buffer overflows that can be used to cause rights escalation or system corruption.  They’re typically discovered by third parties who publish notices like CVE or DSA.  What your patch is addressing is a behavior bug, not a security issue.

Eric, interested parties will not fill CVE or DSA requests. They will just steal the pass of PyPI uploaders and use it to inject malicious code into popular packages.

If you need a CVE or DSA to evaluate if an issue imposes a security risk, then better leave this task to somebody else.

Please stop changing this flag. If you want to have a more secure PyPI transaction, you should first send a feature request on Catalog-SIG so pypi.python.org forces https.

Thanks for the editions.  Further comments on rietveld.

Miscellaneous things:

1) Storing passwords in an hashed form is false security.  An attacker that can read a config file with plain text passwords can also just run commands that use hashed passwords from the config file, so the security focus should be in forbidding access to your files, not worrying about passwords in plain text.

2) http://wiki.python.org/moin/Distutils/FixingBugs has the guidelines you’re asking for.

3) I do not need a CVE to evaluate if an issue is a security risk, because http://www.python.org/dev/workflow/ tells me that it’s when “somehow someone is able to gain escalated privileges when they shouldn't be able to.”

4) Could you remove report@bugs.python.org from the issue Cc?  It goes to the wrong bug report.


Comment from Tarek (which does not address my specific question about None vs. empty string):

Looks good to me:

the upload command will get the credentials from the session instead of using the existing config at all.

I remember that we changed the behavior to you'd had to set ONLY the user in the rc file, but allowing to pass the user is better since it make the config file optional

Instead of using http over TCP and basic auth to upload stuff to PyPI, you can also use SSH. In this case, no password is needed at all.

If someone else is looking for the PyPI SSH support, it's there.
http://pypi.python.org/pypi/pypissh
(I did not find it mentioned in the tutorial)

Thanks Martin.

Distutils is now deprecated (see PEP 632) and all tagged issues are being closed. From now until removal, only release blocking issues will be considered for distutils.

If this issue does not relate to distutils, please remove the component and reopen it. If you believe it still requires a fix, most likely the issue should be re-reported at https://github.com/pypa/setuptools