Changing the default `source:` URLs for PyPI archives to `files.pythonhosted.org`

[mgorny]

Currently, the documentation and tools default to download PyPI distributions via pypi.org. However, according to the upstream documentation, the canonical "predictable" URL should be:

https://files.pythonhosted.org/packages/source/{name[0]}/{name}/{name}-{version}.tar.gz

Now, I don't think switching is critical here, as it is unlikely that upstream will disable the old URLs anytime soon. However, using the current URL involves an additional 301 redirect:

$ wget https://pypi.org/packages/source/f/flit-core/flit_core-3.12.0.tar.gz
--2026-07-01 15:10:52--  https://pypi.org/packages/source/f/flit-core/flit_core-3.12.0.tar.gz
Resolving pypi.org (pypi.org)... 151.101.128.223, 151.101.64.223, 151.101.0.223, ...
Connecting to pypi.org (pypi.org)|151.101.128.223|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://files.pythonhosted.org/packages/source/f/flit-core/flit_core-3.12.0.tar.gz [following]
--2026-07-01 15:10:52--  https://files.pythonhosted.org/packages/source/f/flit-core/flit_core-3.12.0.tar.gz
Resolving files.pythonhosted.org (files.pythonhosted.org)... 151.101.192.223, 151.101.0.223, 151.101.128.223, ...
Connecting to files.pythonhosted.org (files.pythonhosted.org)|151.101.192.223|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://files.pythonhosted.org/packages/69/59/b6fc2188dfc7ea4f936cd12b49d707f66a1cb7a1d2c16172963534db741b/flit_core-3.12.0.tar.gz [following]
--2026-07-01 15:10:52--  https://files.pythonhosted.org/packages/69/59/b6fc2188dfc7ea4f936cd12b49d707f66a1cb7a1d2c16172963534db741b/flit_core-3.12.0.tar.gz
Reusing existing connection to files.pythonhosted.org:443.
HTTP request sent, awaiting response... 200 OK
Length: 53690 (52K) [application/octet-stream]
Saving to: ‘flit_core-3.12.0.tar.gz’

flit_core-3.12.0.tar.gz           100%[============================================================>]  52,43K  --.-KB/s    in 0,02s   

2026-07-01 15:10:52 (2,10 MB/s) - ‘flit_core-3.12.0.tar.gz’ saved [53690/53690]

And while both domains are currently resolving to the same addresses, I suppose using the canonical CDN URL runs a lower risk of hitting a more "expensive" server.

This is also what others are doing, per:

• Arch Linux Python package guidelines
• Gentoo pypi.eclass implementation (looks like one of the mirrors is unhealthy, you may need a few attempts)
• Fedora Referencing Source documentation

So what I'd like to propose is default to files.pythonhosted.org, and slowly work towards migrating existing feedstocks to use it.

xrefs:

• conda-smithy hint: Update PyPI URL hints to ref files.pythonhosted.org conda-smithy#2604
• conda-forge-bot migrator: Migrate PyPI URLs to files.pythonhosted.org conda-forge-bot#6275
• grayskull defaults: Switch PyPI sources to use files.pythonhosted.org conda/grayskull#663
• rattler-build generate defaults: fix: switch PyPI sources to use files.pythonhosted.org prefix-dev/rattler-build#2586
• docs: Update snippets to use files.pythonhosted.org for PyPI sources #2874
• staged-recipes: Update examples to use files.pythonhosted.org instead of pypi.org staged-recipes#34117

[h-vetinari]

This is fine by me; it will be quite a noisy warning though (in terms of how many feedstocks it affects; not longterm), and a fair bit of churn to transition. I'm sure that's why you also have mini migrator proposed as part of the whole package, which should keep this manageable, just as the pypi.io -> pypi.org transition (which we'd effectively be redoing here) was.

CC @conda-forge/core for viz.

[mgorny]

Precisely. If you think that would help, I suppose I could split the smithy PR into two parts:

1. Update the existing hint to suggest files.pythonhosted.org without touching existing pypi.org URLs, so people don't have to update things again in the future.
2. Extend the check to pypi.org URLs (to be committed sometime later, when the migrator has done the bulk of the work).

[jaimergp]

I reviewed the remaining PRs. We should probably also check the docs and examples in this repo (edit: hadn't seen #2874), plus the example recipes in staged-recipes (edit: added conda-forge/staged-recipes#34117).