PyPI now supports uploading via API token

We're further increasing the security of the Python Package Index with another new beta feature: scoped API tokens for package upload. This is thanks to a grant from the Open Technology Fund, coordinated by the Packaging Working Group of the Python Software Foundation.

Over the last few months, we've added two-factor authentication (2FA) login security methods. We added Time-based One-Time Password (TOTP) support in late May and physical security device support in mid-June. Now, over 1600 users have started using physical security devices or TOTP applications to better secure their accounts. And over the past week, over 7.8% of logins to PyPI.org have been protected by 2FA, up from 3% in the month of June.

Now, we have another improvement: you can use API tokens to upload packages to PyPI and Test PyPI! And we've designed the token to be a drop-in replacement for the username and password you already use (warning: this is a beta feature that we need your help to test).

PyPI interface for adding an
API token for package upload

How it works: Go to your PyPI account settings and select "Add API token". When you create an API token, you choose its scope: you can create a token that can upload to all the projects you maintain or own, or you can limit its scope to just one project.


The token management screen shows you when each of your tokens were created, and last used. And you can revoke one token without revoking others, and without having to change your password on PyPI and in configuration files.

PyPI API token management interface

Uploading with an API token is currently optional but encouraged; in the future, PyPI will set and enforce a policy requiring users with two-factor authentication enabled to use API tokens to upload (rather than just their password sans second factor). Watch our announcement mailing list for future details.

Immediately after creating the API token,
PyPI gives the user one chance to copy it

Why: These API tokens can only be used to upload packages to PyPI, and not to log in more generally. This makes it safer to automate package upload and store the credential in the cloud, since a thief who copies the token won't also gain the ability to delete the project, delete old releases, or add or remove collaborators. And, since the token is a long character string (with 32 bytes of entropy and a service identifier) that PyPI has securely generated on the server side, we vastly reduce the potential for credential reuse on other sites and for a bad actor to guess the token.


Help us test: Please try this out! This is a beta feature and we expect that users will find minor issues over the next few weeks; we ask for your bug reports. If you find any potential security vulnerabilities, please follow our published security policy. (Please don't report security issues in Warehouse via GitHub, IRC, or mailing lists. Instead, please directly email security@python.org.) If you find an issue that is not a security vulnerability, please report it via GitHub.

We'd particularly like testing from:

• Organizations that automate uploads using continuous integration
• People who save PyPI credentials in a .pypirc file
• Windows users
• People on mobile devices
• People on very slow connections
• Organizations where users share an auth token within a group
• Projects with 4+ maintainers or owners
• People who usually block cookies and JavaScript
• People who maintain 20+ projects
• People who created their PyPI account 6+ years ago

What's next for PyPI: Next, we'll move on to working on an advanced audit trail of sensitive user actions, plus improvements to accessibility and localization for PyPI (some of which have already started). More details are in our progress reports on Discourse.

Thanks to the Open Technology Fund for funding this work. And please sign up for the PyPI Announcement Mailing List for future updates.

Written by Sumana Harihareswara, published initially to https://pyfound.blogspot.com/2019/07/pypi-now-supports-uploading-via-api.html

Python 3.7.4 is now available

Python 3.7.4 is now available. 3.7.4 is the next maintenance release of Python 3.7, the latest feature release of Python.  You can find the release files, a link to the changelog, and more information here:

    https://www.python.org/downloads/release/python-374/

See the What’s New In Python 3.7 document for more information about the many new features and optimizations included in the 3.7 series.  Detailed information about the changes made in 3.7.4 can be found in its change log.

Thanks to all of the many volunteers who help make Python Development and these releases possible!  Please consider supporting our efforts by volunteering yourself or through organization contributions to the Python Software Foundation.

Python 3.8.0b2 is now available for testing

After a few days of delay, but somewhat cutely timed with the US Independence Day, I present you Python 3.8.0b2:

https://www.python.org/downloads/release/python-380b2/ 

This release is the second of four planned beta release previews. Beta release previews are intended to give the wider community the opportunity to test new features and bug fixes and to prepare their projects to support the new feature release. The next pre-release of Python 3.8 will be 3.8.0b3, currently scheduled for 2019-07-29.

Call to action

We strongly encourage maintainers of third-party Python projects to test with 3.8 during the beta phase and report issues found to the Python bug tracker as soon as possible. While the release is planned to be feature complete entering the beta phase, it is possible that features may be modified or, in rare cases, deleted up until the start of the release candidate phase (2019-09-30). Our goal is have no ABI changes after beta 3 and no code changes after 3.8.0rc1, the release candidate. To achieve that, it will be extremely important to get as much exposure for 3.8 as possible during the beta phase.

Please keep in mind that this is a preview release and its use is not recommended for production environments.

No more non-bugfixes allowed on the “3.8” branch

The time has come, team. Please help make Python 3.8 as stable as possible and keep all features not currently landed for Python 3.9. Don’t fret, it’ll come faster than you think.

Python 3.7.4rc2 is now available for testing

Python 3.7.4rc2 is now available. 3.7.4rc2 is the second release preview of the next maintenance release of Python 3.7, the latest feature release of Python. Assuming no further critical problems are found prior to 2019-07-08, no code changes are planned between this release candidate and the final release. The release candidate is intended to give you the opportunity to test the new security and bug fixes in 3.7.4. Because of the small number of changes between rc1, the original release preview, and rc2, we are planning on an abbreviated exposure cycle so we can get the final release to you as soon as possible.  We strongly encourage you to test your projects and report issues found to bugs.python.org as soon as possible.  Please keep in mind that this is a preview release and, thus, is not recommended for production environments.

You can find the release files, a link to the changelog, and more information here:

    https://www.python.org/downloads/release/python-374rc2/

    

Python 3.6.9 security-fix release is now available

Python 3.6.9 is now available. 3.6.9 is the first security-only-fix release of Python 3.6. Python 3.6 has now entered the security fix phase of its life cycle. Only security-related issues are accepted and addressed during this phase. We plan to provide security fixes for Python 3.6 as needed through 2021, five years following its initial release. Security fix releases are produced periodically as needed and only provided in source code form; binary installers are not provided.  We urge you to consider upgrading to the latest release of Python 3.7, the current fully-supported version.

You can find the release files, a link to the changelog, and more information here:

    https://www.python.org/downloads/release/python-369/