This PEP proposes an extension to the Terms of Use [1] of the Package Index [2], clarifying expectations of package owners regarding ownership of a package name on the Package Index, specifically with regards to conflict resolution.
Existing package repositories such as CPAN [3], NPM [4], and GitHub [5] will be investigated as prior art in this field.
Given that package names on the Index are sharing a single flat namespace, a unique name is a finite resource. The growing age of the Package Index causes a constant rise of situations of conflict between the current use of the name and a different suggested use of the same name.
This document aims to provide general guidelines for solving the most typical cases of such conflicts.
As the application of this policy has potential legal ramifications for the Python Software Foundation, the approval process used is more formal than that used for most PEPs.
Rather than accepting the PEP directly, the assigned BDFL-Delegate will instead recommend its acceptance to the PSF’s Packaging Working Group. After consultation with the PSF’s General Counsel, adoption of the policy will then be subject to a formal vote within the working group.
This formal approval process will be used for both initial adoption of the policy, and for adoption of any future amendments.
The main idea behind this document is that the Package Index serves the community. Every user is invited to upload content to the Package Index under the Terms of Use, understanding that it is at the sole risk of the user.
While the Package Index is not a backup service, the maintainers of the Package Index do their best to keep that content accessible indefinitely in its published form. However, in certain edge cases the greater community’s needs might overweigh the individual’s expectation of ownership of a package name.
The use cases covered by this document are:
The proposed extension to the Terms of Use, as expressed in the Implementation section, will be published as a separate document on the Package Index, linked next to existing Terms of Use in the front page footer.
The user of the Package Index is solely responsible for being reachable by the Package Index maintainers for matters concerning projects that the user owns. In every case where contacting the user is necessary, the maintainers will try to do so at least three times, using the following means of contact:
The maintainers stop trying to reach the user after six weeks.
A project is considered abandoned when ALL of the following are met:
All other projects are considered active.
If a candidate appears willing to continue maintenance on an abandoned project, ownership of the name is transferred when ALL of the following are met:
Under no circumstances will a name be reassigned against the wishes of a reachable owner.
Projects are never removed from the Package Index solely on the basis of abandonment. Artifacts uploaded to the Package Index hold inherent historical value.
An abandoned project can be transferred to a new owner for purposes of reusing the name when ALL of the following are met:
The maintainers of the Package Index are not arbiters in disputes around active projects. There are many possible scenarios here, a non-exclusive list describing some real-world examples is presented below. None of the following qualify for package name ownership transfer:
Again, the list above is not exclusive. The maintainers of the Package Index recommend users to get in touch with each other and solve the issue by respectful communication (see the PSF Code of Conduct [6]).
A project published on the Package Index meeting ANY of the following is considered invalid and will be removed from the Index:
The Package Index maintainers pre-emptively declare certain package names as unavailable for security reasons.
It is the policy of Python Software Foundation and the Package Index maintainers to be appropriately responsive to claims of intellectual property infringement by third parties. It is not the policy of the Python Software Foundation nor the Package Index maintainers to pre-screen uploaded packages for any type of intellectual property infringement.
Possibly-infringing packages should be reported to legal@python.org and counsel to the Python Software Foundation will determine an appropriate response. A package can be removed or transferred to a new owner at the sole discretion of the Python Software Foundation to address a claim of infringement.
A project published on the Package Index meeting ANY of the following may be considered infringing and subject to removal from the Index or transferral to a new owner:
In the event of a complaint for intellectual property infringement, a copy of the complaint will be sent to the package owner. In some cases, action may be taken by the Package Index maintainers before the owner responds.
The Python Software Foundation [7] is the non-profit legal entity that provides the Package Index as a community service.
The Package Index maintainers can escalate issues covered by this document for resolution by the Packaging Workgroup if the matter is not clear enough. Some decisions require additional judgement by the Board, especially in cases of Code of Conduct violations or legal claims. Recommendations made by the Board are sent to the Packaging Workgroup [8] for review.
The Packaging Workgroup has the final say in any disputes covered by this document and can decide to reassign or remove a project from the Package Index after careful consideration even when not all requirements listed here are met.
If you want to take over an existing project name on PyPI, these are the steps to follow:
NPM contains a separate section linked from the front page called Package Name Disputes. It is described as a “living document”, as of January 2017 its contents might be summarized as follows:
CPAN lets any user upload modules with the same name. PAUSE, a related index, only lists modules uploaded by the primary maintainer or listed co-maintainers. CPAN documentation doesn’t address disputes otherwise.
GitHub’s terms of service contain an exhaustive list of behavior not meeting general conditions of use. While not codified anywhere, GitHub does agree for users to reclaim abandoned account names by archiving the abandoned account and letting the other user or organization rename their account. This is done on a case-by-case basis.
The original approach was to hope for the best and solve issues as they arise without written policy. This is not sustainable. The lack of generally available guidelines in writing on package name conflict resolution is causing unnecessary tensions. From the perspective of users, decisions made by the Package Index maintainers without written guidelines may appear arbitrary. From the perspective of the Package Index maintainers, solving name conflicts is a stressful task due to risk of unintentional harm due to lack of defined policy.
This document has been placed in the public domain.
The many participants of the Distutils and Catalog SIGs for their ideas over the years.
Source: https://github.com/python/peps/blob/main/peps/pep-0541.rst
Last modified: 2025-02-01 08:59:27 UTC