Hacker News Reader

Kinda curious why releases just aren't fully immutable? Sane semver would dictate any update should at least be a new patch release.

View on HN

The files in a release are immutable, but a release on pypi consists of multiple files for binaries that is a cross of architecture, os, and python version. Per other comments the upload api is stateless. The consideration is an attacker adding new files to an old release

GP wasn't asking about the files being immutable, whatever a mutable file would mean. They were asking about the releases. I'm curious too.

The way it's done with rubygems, if you messed something up with the gem (pushed secrets, etc.), you "yank" (remove) the release and push a new one (different version). You can't work with the files in a release once it's been pushed.

Reply on news.ycombinator.com