导航|地址|刷新
Help









Skip to main contentSwitch to mobile version












Search PyPIsearch-focus#focusSearchField" data-search-focus-target="searchField"> Search



Help

Docs

Sponsors

Log in

Register
Menu
Help

Docs

Sponsors

Log in

Register





Search PyPISearch



Common questions


Basics

What's a package, project, or release?

How do I install a file (package) from PyPI?

How do I package and publish my code for PyPI?

What's a trove classifier?

What's a "yanked" release?

What's an archived project?



My Account

Why do I need a verified email address?

Why is PyPI telling me my password is compromised?

What should I do if I notice suspicious activity on my account?

Why is PyPI telling me my API token is compromised?

What is two-factor authentication and how does it work on PyPI?

How does two-factor authentication with an authentication application (TOTP) work? How do I set it up on PyPI?

How does two-factor authentication with a security device (e.g. USB key) work? How do I set it up on PyPI?

What devices (other than a USB key) can I use as a security device?

How does two-factor authentication with a recovery code work? How do I set it up on PyPI?

How can I use API tokens to authenticate with PyPI?

Why do certain actions require me to confirm my password?

How do I change my PyPI username?

How can I use Trusted Publishers to publish to PyPI?



Integrating

Does PyPI have APIs I can use?

How can I run a mirror of PyPI?

How do I get notified when a new version of a project is released?

Where can I see statistics about PyPI, downloads, and project/package usage?

What are the file hashes used for, and how can I verify them?



Administration of projects on PyPI

How can I publish my private packages to PyPI?

Why isn't my desired project name available?

How do I claim an abandoned or previously registered project name?

What collaborator roles are available for a project on PyPI?

How do I become an owner/maintainer of a project on PyPI?

How can I upload a project description in a different format?

How do I get a file size limit exemption or increase for my project?

How do I get a total project size limit exemption or increase for my project?

Where does PyPI get its data on project vulnerabilities from, and how can I correct it?

How can I restore a deleted project, release or file?



Troubleshooting

Why am I getting "the description failed to render" error?

Why can't I manually upload files to PyPI, through the browser interface?

I forgot my PyPI password. Can you help me?

I've lost access to my PyPI account. Can you help me?

Why am I getting an "Invalid or non-existent authentication information." error when uploading files?

Why am I getting "No matching distribution found" or "Could not fetch URL" errors during pip install?

I am having trouble using the PyPI website. Can you help me?

Why did my package or user registration get blocked?

Why am I getting a "Filename or contents already exists" or "Filename has been previously used" error?

How do I request a new trove classifier?

Where can I report a bug or provide feedback about PyPI?

I'm having trouble setting up two factor authentication with an authentication application (TOTP). Can you help me?

My project or release says it's in quarantine. What does that mean?



About

Who maintains PyPI?

What powers PyPI?

Can I depend on PyPI being available?

How can I contribute to PyPI?

How do I keep up with upcoming changes to PyPI?

How can I get a list of PyPI's IP addresses?

What does the "beta feature" badge mean? What are Warehouse's current beta features?

How do I pronounce "PyPI"?



Basics

What's a package, project, or release?

We use a number of terms to describe software available on PyPI, like "project", "release", "file", and "package". Sometimes those terms are confusing because they're used to describe different things in other contexts. Here's how we use them on PyPI:

A "project" on PyPI is the name of a collection of releases and files, and information about them. Projects on PyPI are made and shared by other members of the Python community so that you can use them.

A "release" on PyPI is a specific version of a project. For example, the requests project has many releases, like "requests 2.10" and "requests 1.2.1". A release consists of one or more "files".

A "file", also known as a "package", on PyPI is something that you can download and install. Because of different hardware, operating systems, and file formats, a release may have several files (packages), like an archive containing source code or a binary wheel.

How do I install a file (package) from PyPI?

To learn how to install a file from PyPI, visit the installation tutorial on the Python Packaging User Guide.

How do I package and publish my code for PyPI?

For full instructions on configuring, packaging and distributing your Python project, refer to the packaging tutorial on the Python Packaging User Guide.

What's a trove classifier?

Classifiers are used to categorize projects on PyPI. See the classifiers page for more information, as well as a list of valid classifiers.

What's a "yanked" release?

A yanked release is a release that is always ignored by an installer, unless it is the only release that matches a version specifier (using either == or ===). See the user documentation for more information, including how to yank a release.

What's an archived project?

An archived project is a project that is no longer receiving any updates. A project maintainer can mark a project as archived to signal to users that future updates should not be expected. Archived projects are publicly visible and can still be resolved from the index by default, unlike deleted or yanked releases. An archived project cannot make new releases and will not appear in PyPI's search results.



My account

Why do I need a verified email address?

Currently, PyPI requires a verified email address to perform the following operations:

Register a new project.

Upload a new version or file.

The list of activities that require a verified email address is likely to grow over time.

This policy will allow us to enforce a key policy of PEP 541 regarding maintainer reachability. It also reduces the viability of spam attacks to create many accounts in an automated fashion.

You can manage your account's email addresses in your account settings. This also allows for sending a new confirmation email for users who signed up in the past, before we began enforcing this policy.

Why is PyPI telling me my password is compromised?

PyPI itself has not suffered a breach. This is a protective measure to reduce the risk of credential stuffing attacks against PyPI and its users.

Each time a user supplies a password — while registering, authenticating, or updating their password — PyPI securely checks whether that password has appeared in public data breaches.

During each of these processes, PyPI generates a SHA-1 hash of the supplied password and uses the first five (5) characters of the hash to check the Have I Been Pwned API and determine if the password has been previously compromised. The plaintext password is never stored by PyPI or submitted to the Have I Been Pwned API.

PyPI will not allow such passwords to be used when setting a password at registration or updating your password.

If you receive an error message saying that "This password appears in a breach or has been compromised and cannot be used", you should change it all other places that you use it as soon as possible.

If you have received this error while attempting to log in or upload to PyPI, then your password has been reset, and you cannot log in to PyPI until you reset your password.

What should I do if I notice suspicious activity on my account?

All PyPI user events are stored under security history in account settings. If there are any events that seem suspicious, take the following steps:

Reset your password

Contact the PyPI admins about the event at admin@pypi.org

Why is PyPI telling me my API token is compromised?

A PyPI API token linked to your account was posted on a public website. It was automatically revoked, but before regenerating a new one, please check the email you received and attempt to determine the cause. The suspicious activity section applies too.

What is two-factor authentication and how does it work on PyPI?

Two-factor authentication (2FA) makes your account more secure by requiring two things in order to log in: something you know and something you own.

In PyPI's case, "something you know" is your username and password, while "something you own" can be an application to generate a temporary code, or a security device (most commonly a USB key).

Two-factor authentication is required on your PyPI account.

During the web login process, users will be asked to provide their second method of identity verification.

How does two-factor authentication with an authentication application (TOTP) work? How do I set it up on PyPI?

PyPI users can set up two-factor authentication using any authentication application that supports the TOTP standard.

TOTP authentication applications generate a regularly changing authentication code to use when logging into your account.

Because TOTP is an open standard, there are many applications that are compatible with your PyPI account. Popular applications include:

Google Authenticator for Android or iOS(proprietary)

Microsoft Authenticator (proprietary)

Duo Mobile for Android or iOS(proprietary)

Authy (proprietary)

FreeOTP+ (open source)

FreeOTP (open source)

Some password managers (e.g. 1Password) can also generate authentication codes. For security reasons, PyPI only allows you to set up one application per account.

To set up 2FA with an authentication application:

Open an authentication (TOTP) application

Log in to your PyPI account, go to your account settings, and choose "Add 2FA with authentication application"

PyPI will generate a secret key, specific to your account. This is displayed as a QR code, and as a text code.

Scan the QR code with your authentication application, or type it in manually. The method of input will depend on the application you have chosen.

Your application will generate an authentication code - use this to verify your set-up on PyPI

The PyPI server and your application now share your PyPI secret key, allowing your application to generate valid authentication codes for your PyPI account.

Next time you log in to PyPI you'll need to:

Provide your username and password, as normal

Open your authentication application to generate an authentication code

Use this code to finish logging into PyPI


Note: If you lose your authentication application and can no longer log in, you may permanently lose access to your account. You should generate and securely store recovery codes to regain access in that event..

We recommend that all PyPI users set up at least two supported two-factor authentication methods and provision recovery codes.

If you've lost access to all two factor methods for your account and do not have recovery codes, you can request help with account recovery.


How does two-factor authentication with a security device (e.g. USB key) work? How do I set it up on PyPI?

A security device is a USB key or other device that generates a one-time password and sends that password to the browser. This password is then used by PyPI to authenticate you as a user.

To set up two-factor authentication with a USB key, you'll need:

To use a browser that supports WebAuthn and PublicKeyCredential, as this is the standard implemented by PyPI.

To be running JavaScript on your browser

To use a USB key that adheres to the FIDO U2F specification:
Popular keys include Yubikey, Google Titan and Thetis.

Note that some older Yubico USB keys do not follow the FIDO specification, and will therefore not work with PyPI


Follow these steps:

Log in to your PyPI account, go to your account settings, and choose "Add 2FA with security device (e.g. USB key)"

Give your key a name. This is necessary because it's possible to add more than one security device to your account.

Click on the "Set up security device" button

Insert and touch your USB key, as instructed by your browser

Once complete, your USB key will be registered to your PyPI account and can be used during the log in process.

Next time you log in to PyPI you'll need to:

Provide your username and password, as normal

Insert and touch your USB key to finish logging into PyPI


Note: If you lose your security device and can no longer log in, you may permanently lose access to your account. You should generate and securely store recovery codes to regain access in that event..

We recommend that all PyPI users set up at least two supported two-factor authentication methods and provision recovery codes.

If you've lost access to all two factor methods for your account and do not have recovery codes, you can request help with account recovery.


What devices (other than a USB key) can I use as a security device?

There is a growing ecosystem of devices that are FIDO compliant, and can therefore be used with PyPI.

Emerging solutions include biometric (facial and fingerprint) scanners and FIDO compatible credit cards. There is also growing support for mobile phones to act as security devices.

As PyPI's two-factor implementation follows the WebAuthn standard, PyPI users will be able to take advantage of any future developments in this field.

How does two-factor authentication with a recovery code work? How do I set it up on PyPI?

If you lose access to your authentication application or security device, you can use these codes to log in to PyPI.

Recovery codes are one time use. They are not a substitute for an authentication application or a security device and should only be used for recovery. After using a recovery code to sign in, it becomes inactive.

To provision recovery codes:

Log in to your PyPI account, go to your account settings, and choose "Generate recovery codes"

Securely store the displayed recovery codes! Consider printing them out and storing them in a safe location or saving them in a password manager.

If you lose access to your stored recovery codes or use all of them, you can get new ones by selecting "Regenerate recovery codes" in your account settings.

To sign in with a recovery code:

Provide your username and password, as normal

When prompted for two-factor authentication, select "Login using recovery codes"

As each code can be used only once, you might want to mark the code as used

If you have few recovery codes remaining, you may also want to generate a new set using the "Regenerate recovery codes" button in your account settings.

How can I use API tokens to authenticate with PyPI?

API tokens are used to authenticate when uploading packages to PyPI.

You can create a token for an entire PyPI account, in which case, the token will work for all projects associated with that account. Alternatively, you can limit a token's scope to a specific project.

When using an API token from a CI provider, we recommend scoping the token down to the minimum necessary projects.

If you are publishing to PyPI from a CI provider that supports Trusted Publishing, we strongly recommend using Trusted Publishing instead.

To make an API token:

Verify your email address (check your account settings)

In your account settings, go to the API tokens section and select "Add API token"

To use an API token:

Set your username to __token__

Set your password to the token value, including the pypi- prefix

Where you edit or add these values will depend on your individual use case. For example, some users may need to edit their .pypirc file, while others may need to update their CI configuration file (e.g. .travis.yml if you are using Travis).

Advanced users may wish to inspect their token by decoding it with base64, and checking the output against the unique identifier displayed on PyPI.

Why do certain actions require me to confirm my password?

PyPI asks you to confirm your password before you want to perform a sensitive action. Sensitive actions include things like adding or removing maintainers, deleting distributions, generating API tokens, and setting up two-factor authentication.

You'll only have to re-confirm your password if it's been more than an hour since you last confirmed it.

We strongly recommend you only perform such actions on your personal, password-protected computer.

How do I change my PyPI username?

PyPI does not currently support changing a username.

Instead, you can create a new account with the desired username, add the new account as a maintainer of all the projects your old account owns, and then delete the old account, which will have the same effect.

How can I use Trusted Publishers to publish to PyPI?

PyPI users and projects can use Trusted Publishers to delegate publishing authority for a PyPI package to a trusted third party service, eliminating the need to use API tokens.



Integrating

Does PyPI have APIs I can use?

Yes, including RSS feeds of new packages and new releases. See the API reference.

How can I run a mirror of PyPI?

If you need to run your own mirror of PyPI, the bandersnatch project is the recommended solution. Note that the storage requirements for a PyPI mirror would exceed 1 terabyte—and growing!

How do I get notified when a new version of a project is released?

You can subscribe to the project releases RSS feed. Additionally, there are several third-party services that offer comprehensive monitoring and notifications for project releases and vulnerabilities listed as
…(内容过长已截断)

------
导航页 打开网址