Skip to content

PyPI name benchcommons-tools-dataset is unregistered: reserve it or document uv-only installs #10

Open

Description

@matbrgz

Raised in the review of BenchCommons/dataset-names#41 (adoption of the toolkit, ADR 0013 there; ADR 0004 here).

Dataset repos declare benchcommons-tools-dataset==X.Y.Z in [project] dependencies and resolve it through a uv git source ([tool.uv.sources]). Any installer that ignores [tool.uv.sources] (plain pip install ., pip install of a built dataset wheel, Poetry, pip-tools) looks the name up on PyPI, where benchcommons-tools-dataset is not registered. Someone could register it and have their code installed in place of the toolkit (dependency confusion / name squatting).

Options:

  • Reserve the name on PyPI under the BenchCommons organisation (a placeholder release or a real release of the same version), or
  • Document in ADR 0004 and the README that installs are uv-only (or pip with the explicit @ git+https://...@vX.Y.Z URL), and say so in the consumers' docs
  • Update ADR 0004 with the decision
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions