You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
PyPI name benchcommons-tools-dataset is unregistered: reserve it or document uv-only installs #10
Dataset repos declare benchcommons-tools-dataset==X.Y.Z in [project] dependencies and resolve it through a uv git source ([tool.uv.sources]). Any installer that ignores [tool.uv.sources] (plain pip install ., pip install of a built dataset wheel, Poetry, pip-tools) looks the name up on PyPI, where benchcommons-tools-dataset is not registered. Someone could register it and have their code installed in place of the toolkit (dependency confusion / name squatting).
Options:
Reserve the name on PyPI under the BenchCommons organisation (a placeholder release or a real release of the same version), or
Document in ADR 0004 and the README that installs are uv-only (or pip with the explicit @ git+https://...@vX.Y.Z URL), and say so in the consumers' docs
Activity
docs(adr): tag integrity check and PyPI name risk in ADR 0013