Hacker News Reader

Comment by postfuturist | Hacker News Reader

We do this, but also add a couple layers of safety between us and PyPI:

1. Run your own secure, local pypi clone with exact source versions of the packages you use.

2. The packages for production are built into RPMs from the local pypi.

PyPI is great for discovery, getting things running quickly, and testing new versions, but you never want to rely on it, even for development.

View on HN

I'd really enjoy reading about how to setup a PyPI mirror like the one you use in your development/deployment workflow. It seems like a really good idea, considering I've had problems with PyPI at really inconvenient times in the past.

I've used ClueReleaseManager to great effect in the past. It lazy loads from an upstream PyPI so you don't need to maintain a full mirror. If you use the same instance as your main PyPI mirror for developing and CI/deployment you never have to worry about syncing manually: any package you develop with will be in the cache by the time your code hits the CI server.

I think we use this: http://pypi.python.org/pypi/chishop/

You just set it up on a local server, and upload packages the same way they are uploaded to real PyPI.

    python setup.py register sdist upload

You can specify alternate PyPI server with a ~/.pypirc. There are probably other ways to do this. What's nice about this is you can upload your own private packages or your own personal forks of packages. We do both.

Yeah, plus it speeds package building up and protects against not-so-occasional pypi outages.

Reply on news.ycombinator.com