python-poetry / python-poetry/poetry

Add support for reading `~/.pypirc` if no other authentication information is found

Open
#10,234 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

kind/feature status/triage
Dominant language
Python
Stars
34.3k
Forks
2.5k
Avg merge
2d 19h
Merged PRs (30d)
30

Description

Issue Kind

Change in current behaviour

Description

Mentioned in #6320

Poetry currently does not support pypirc (though it could be added and might be a nice addition once the authenticator code is further cleaned up). It's worth nothing that poetry publish does not think it has credentials, but instead can no longer prompt due to changes in Poetry's dependencies. Interactive use was considered niche and thus only got a changelog callout in a beta version of 1.2 -- so it may fly under the radar for some.

Originally posted by @neersighted in #6320

Originally mentioned in #111

I recently switched to poetry to manage a project, published to PyPI. Because I had already been using setuptools and twine to build / publish the project, I had just gone to the effort of storing my tokens in a newly created ~/.pypirc file, for [testpypi] and [pypi].

When switching to poetry, and then attempting to publish using:

poetry publish --build

My package is built successfully, but fails to push to PyPI with an unhelpful (IMO) message:

HTTP Error 403: Invalid or non-existent authentication information. See https://pypi.org/help/#invalid-auth for more information.

I think that the error message could be improved, as the current one implies that there is a problem with the user's PyPI account, or something to do with the token being invalid (as opposed to the real issue: the user not yet setting the poetry-specific config or environment variables that store ther PyPI tokens).

Perhaps the user could be interactively prompted for their token if this is the first time using the poetry publish command, similar to what twine does if no token is found in ~/.pypirc?

Additionally, I think that if no poetry config value exists for the PyPI token, poetry should at least attempt to read ~/.pypirc before failing to publish - as has been suggested in the issues mentioned above. I would be happy to submit a PR if people still think this would be useful!

Impact

This will hopefully make poetry more usable and friendly to new users, and particularly users who already have published to PyPI with alternative tools.

Workarounds

None

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the authenticator code and the poetry publish --build entry point, then trace how existing configuration and environment credentials are selected. Done means that, when no other authentication information exists, publishing can read credentials for the relevant repository from ~/.pypirc without overriding higher-priority credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.