What is the most powerful part of the Python ecosystem?
Well, the ability to say pip install magic library has to be right near the top.
But what powers the Python package index and who are the people behind it?
Did you know that they ship over 300 terabytes of traffic each month these days?
Join me as we chat with Donald Stuffed to look inside Python's packaging infrastructure.
This is Talk Python to Me, episode 64, recorded Wednesday, June 22, 2016.
Welcome to Talk Python to Me, a weekly podcast on Python, the language, the libraries, the
ecosystem, and the personalities.
This is your host, Michael Kennedy.
Follow me on Twitter where I'm @mkennedy.
Keep up with the show and listen to past episodes at talkpython.fm.
And follow the show on Twitter via at Talk Python.
This episode has been brought to you by SnapCI and Rollbar.
Hey, everyone.
I have a really fabulous look inside the Python package index on deck for you.
Donald and I just scratched the surface, but there are a ton of fascinating topics that
we cover.
Before we get to our talk with Donald, I have one announcement for you.
I've released my second online course called Write Pythonic Code Like a Seasoned Developer.
It's over four hours and 50 concrete examples of how you can write more Pythonic code.
It's jam-packed with tips that you can incorporate into your projects immediately.
Topics covered include the expansive use of dictionaries, hacking Python's memory usage
via slots, using generators to comprehend and generate expressions, creating subsets of collections
via slices all the way to the database, and much more.
Several of these topics are Python 3-only features, so you'll have even more reason to adopt Python
3 for your next project.
The response to the first two days has been super positive.
I hope you'll take a moment to see what the course is all about at talkpython.fm/pythonic.
Now, let's get to Donald.
Donald, welcome to the show.
Yes, hi.
Hey, thanks for coming today.
It's going to be really fun to talk about packaging and PyPI and all these sorts of things.
But, of course, like always, before we get into the details, let's hear your story.
How did you get started in programming in Python?
Yeah, so programming in general.
I was playing a video game back in high school on EverQuest, and I started to get into hacking
that video game.
And there was a tool called MacReQuest that I started writing add-ons for and such, and it
sort of got me involved in programming at all.
And then I started to get jobs in programming.
My first job was with PHP.
And when I was working with Drupal at the time, I kept hearing about this cool framework called
Django, but it was written in Python.
So I picked up a Python book and sort of taught myself Python over a week or so, so that I could
then use Django to do websites instead of Drupal.
So I was feeling constrained by the sort of CMS aspects of Drupal.
Yeah, okay, that's cool.
Drupal's PHP, right?
Yes, Drupal's a PHP CMS that's sort of got some framework-y aspects to it, or at least it
did back then.
That was 2007 or so.
I haven't really looked at it.
I did recently.
Yeah, it's definitely still going.
So was it refreshing to get into Python from PHP?
Yes, I found Python to be incredibly useful.
concise and great to work with.
I like the enforced white space coming from, you know, somewhere where PHP attends.
And particularly at the time, a lot of the examples you would find online didn't always have the
greatest formatting.
So that sort of enforced formatting helped a lot with me reading other people's code to
figure out what they were doing and how it worked.
And sort of just a general grogking of the code bases to help me learn over time.
Yeah, yeah.
That's really cool.
I'm sure it was.
It was nice.
So I think maybe a good place to start this conversation would be to talk about what you
do for your day job.
Yeah, so my day job is I'm employed by Hucule Packard Enterprise, full-time employee.
And my sort of mandate is basically make Python packaging better.
So from there, you know, I work on PyPI.
I work on PIP.
I work on a project called Warehouse, which is essentially PyPI 2.0.
The Warehouse theme is not really going to be exposed to end users other than if they start
to work on the backend.
But we call it Warehouse just to distinguish it.
Then there's other little small tools like Twine and, you know, sort of a lot of the background
efforts, you know, writing peps and coordinating things and whatnot sort of all falls under my
banner of what I do for my day job.
Yeah, so that's really awesome that HP is making that investment to more or less fund a developer
to continuously work on Python packaging.
Yeah, you know, you know, I think it's great.
You know, they are a big contributor to the OpenStack community.
And OpenStack is, I think it's not entirely written in Python now, but it's largely written
in Python.
So they're heavy users of, you know, Python and PyPI and pip and whatnot.
You know, so HP felt that, you know, they're depending on these things, you know, made sense
to invest in these things to make sure that they continue to be running and work and whatnot.
Yeah, that's cool.
So is this a position that you somehow managed to create or was there like a job announcement
hiring packaging support person?
Yeah.
So it was created for me.
At the time there was somebody named Monty Taylor inside the HPE who sort of led the effort
to convince the higher ups that this was something that they should do.
And, you know, he's the one who reached out to me and offered this to me.
You know, prior to this, I was working at Rackspace where they gave me half time.
You know, 50% time to work on packaging, 50% time to work on their own projects.
You know, so he sort of took that idea and just amped it up to the next level.
And, you know, we're really pushed for getting that done in HPE and convinced me to come over.
Yeah, that's awesome.
Yeah.
I think we'll dig in a little bit more later on how companies are supporting PyPI and so on.
But let's keep it high level for a little bit.
So I've had a lot of interesting conversations with people basically around the pronunciation
of P-Y-P-I.
And I've heard a lot of people say PyPI.
And I've heard a fair number of people say PyPI.
What's the official way to say it?
The official way to say it is PyPI.
It's Python package index.
So, you know, you put the emphasis on the PyPI.
A lot of people do call it PyPI.
I've heard Pippi and PeePee and all sorts of pronunciations.
I really don't like the name.
I think it's a confusing name that has this big sort of problem with pronunciation.
Everyone pronounces it a little bit differently.
And one of the most common pronunciations, PyPI,
clashes with PyPI as P-Y-P-Y.
The alternative Python implementation, however,
I've sort of thus far been unsuccessful at convincing people that it's worth it to change the name
since P-Y-P-I is so ingrained and everywhere across the ecosystem.
Yeah, it's deeply ingrained, but it's also an insider term, right?
Like, you can't walk up to somebody who's very barely familiar with Python and say PyPI and have them,
oh, yeah, of course, right?
But, you know, that's true, I think, with lots of the packaging systems.
Like, if you said NPM to somebody, they wouldn't know.
If you said Gems, they wouldn't know.
You know, NuGet.
Like, there's all these packaging systems.
They all seem to have poor names, but PyPI, okay, that's great.
So I'm glad to hear that I've been saying it right, but I've been following Guido's lead,
and I figured that's a pretty safe lead to follow.
Yeah, yep.
And, you know, PyPI is what it is, although I do slip up every once in a while and pronounce it wrong.
Yeah.
Okay, cool.
So PyPI, one thing I always wondered about, maybe you can explain this for me.
If I type pypi.python.org and hit enter, I get pypi.python.org slash pypi.
Like, why does it appear on both ends?
Is it just, like, really beloved?
There's a long history there, and I'm, you know, I don't fully know it
because a lot of it comes from before my time.
But I believe PyPI was originally deployed under just python.org slash pypi,
and then they eventually moved it to its own domain name.
It's pypi.python.org, and they just kept the slash pypi because that prefix was baked into scripts,
and it was easier to just change the domain name rather than changing the whole path.
Oh, right.
So it's just a compatibility thing.
Yeah.
And it was actually just recently we,
and I knew that because we just recently, within the last year,
broke compatibility for people who were still using python.org slash pypi,
and apparently there were still people who had scripts and whatnot pointing to that
because when we broke that, we got people yelling at us for it.
You heard about it, huh?
Yes.
Well, that's the quickest, easiest way to tell if a service or a database
or something like that is required is like,
turn it off and see if anyone screams, right?
Yes.
And with PyPI, that's one of our main ways we figure out what's needed or not
because it's never been documented well what you can depend on in PyPI,
and sort of the entire history of PyPI has been someone depended on something weird in it,
some sort of implementation detail, and suddenly that became the API.
So a lot of things in PyPI are we have no idea what people are depending on,
so we just change things and pray.
Yeah.
So you step very lightly making changes, I suspect.
Yeah.
Particularly on what we call legacy PyPI, which is what's running now
because it's a very old code base.
It's like 15 years old or so, and it's got no tests.
It doesn't run locally very easily.
Like, to actually run it locally, you have to modify the code
and comment things out to get it to start up.
So it's fun.
Yeah.
I'm sure this is really an interesting experience and long-lived Python code.
So maybe it's a good place to start talking about the history.
Like, PyPI is not as old as Python, right?
And so there was a while where Python was just a thing.
There was no packaging, right?
And then PyPI came along.
What's the story there?
So, again, this predates me.
So this is what my understanding is from what people have told me.
So Python did originally have no packaging story.
So people started sort of making their own story with make files.
Make files obviously are not super repeatable.
They had to write a whole new make file every time you switched to a different project.
They don't run by default on Windows, you know, et cetera, et cetera.
So someone whose name escapes me right now came up with distruteels to replace all these make files with a Python script that will run everywhere and it will sort of do all that stuff for you.
So, which at the time, great.
It was, you know, a really big step forward for Python and packaging in general.
And I think roughly around that same time, maybe a little bit after, there were several sort of efforts to create sort of a CPAN, but for Python, one name that I know of was Vaults of Parnassus.
I don't fully know all the names or what their specific implementations were.
But then Richard Jones, I believe, came up with the idea of PyPI and sort of implemented a proof of concept of what PyPI could be.
And they deployed it to Python.org.
And we're still running that today.
That proof of concept that was originally designed to be replaced quickly with the real thing.
I'm always a little suspicious or leery of proof of concepts, showing them to people who are like, oh, this is amazing.
Let's use this.
We don't even have to.
We're almost done.
Let's go.
Right.
Yes.
It can be a shifty, soft foundation, I suppose.
Yes.
And an important thing to realize about PyPI's code quality, it's not great.
It was written 15, mostly 15 years ago with people hacking on it since then.
And it predates much of what consists of the modern web stack.
Django didn't exist.
Pyramid didn't exist.
Flask didn't exist.
I think WSGI might have existed barely, or they were like contemporaries.
So the original PyPI didn't use WSGI.
It just sort of wrote its own Python handler.
I think it used CGI.
So a lot of that code is still there.
And a lot of what we've done to try and semi-modernize it has been how do we hack in WSGI support into this thing that expects CGI?
How do we deploy this?
We're using a modern web server instead of this little script that just happens to sit inside the thing.
Yeah.
So it's got a lot of soap in it because it was big 15 years ago.
Right.
Of course.
A lot of its problems really just stemmed from the fact it was written before we knew how to do good websites.
Yeah.
What year was that when the prototype was created?
I believe it was 2003.
Okay.
So there were some examples of serious web activity, serious websites, right?
That's .com, just post .com days.
But still, Python was not nearly as polished around the web story there, was it?
Yeah.
Correct.
Cool.
Yeah.
Okay.
So that's really interesting.
So what's the relationship with easy install these days?
Easy install lets you install packages.
PIP lets us install packages.
It's all pip these days, right?
Is there still a reason to use easy install?
So easy install still exists.
It does a few things that pip doesn't do.
And pip largely doesn't do them on purpose.
Like easy install supports multi-version installs where you have a single Python environment and you can install multiple versions of, say, requests into that single Python environment.
And then at runtime, it will generate a sys.path that has the correct version for whatever thing you're running on that sys.path.
PIP doesn't do that, which I believe is a good thing pip prefers to use.
Is that because pip really assumes the presence of virtual environments and it's like, if that's what you want, just create a virtual environment, it's a different version?
Yes.
Correct.
So pip says use virtual environments, create explicit environments, and install things into there.
Easy install while it works with virtual environments because there's a way virtual environments work.
Virtual environments, it sort of says you declare in your script or in your script wrappers, et cetera, what you depend on.
And we will sort of create a dynamic virtual environment in memory by munging the sys.path, whereas virtual environments are you create an explicit named environment, a name by your file system path.
And then, you know, pip will install things flat, you know, just a single version into that environment.
That's a cool feature that you could hack it together and have multiple versions, but it seems like it's almost more trouble than it's worth.
Yeah, so it's certainly an interesting feature.
I don't think one is necessarily better than the other.
They each have their trade-offs.
We've sort of settled around using the virtual environment, a single flat install system, and I don't think there's enough of a reason to go back to the easy install sort of multi-version install system.
Just because, you know, I think everyone's sort of figured out how to use the virtual environments.
And, you know, I think trying to change gears now would just be a big disruption for not a whole lot of benefit.
But if we had never done that, I think we would be in a perfectly fine place now.
We just have a different mechanism for doing things.
Okay, cool.
So what's the relationship between the Python Packaging Authority and the Python Software Foundation?
Yeah, so the PyPA is sort of not a real thing, sort of is a real thing.
You know, it's not an official organization.
We don't have a 5013C or whatever they're called.
So Python Packaging Authority is like a shadow organization pulling the strings of Python packaging.
Yeah, sort of.
Yeah, yeah.
You can think of it that way.
You know, it sort of came around because pip was putting itself on GitHub and they needed an organization name.
So they just kind of jokingly called it PyPI or PyPA.
And I have too many things in my head.
It's good.
P-Y-P something.
I confuse them.
Yeah, so they sort of jokingly called it PyPA.
And then as we sort of, this sort of push in the past couple of years to really standardize around these things and fix things and get moved forward, we just sort of started to take that name and say, okay, we're going to really take this name that started out as a sort of joke.
And we're going to use this for a real thing.
And it's sort of just an umbrella organization where it's like, okay, you're working on something that's packaging in Python.
You can bring your project into PyPA.
We don't have very many rules.
I think the only rule we really have is that you have to, your project has to be governed by our code of conduct.
And beyond that, you know, you can run your project however you want, use whatever VCS you want, et cetera, et cetera.
But it sort of provides a central location for someone who's, okay, I want to work on packaging stuff.
You know, go to the PyPA, you know, pages.
You know, you can see the list of projects.
And then since there's a lot of cross-pollination between people who work on these projects, kind of makes managing permissions and stuff a bit easier.
But, like, funding, we're starting to try and get funding and stuff available for that.
So that's largely going through the PSF.
You know, so the PSF is sort of the legal entity that we hang our stuff off of.
But the PyPA is sort of, you know, just our little unofficial organization.
You can think of it similar to Python Dev, how Python Dev manages CPython.
But, you know, the legal trademarks and stuff sort of hang off of the PSF.
Right.
Okay.
So since the Packaging Authority is just, like, a loose group of people who work together on packaging, there's no legal component there.
Like, for example, I made a donation to PyPI when you guys announced, like, hey, we need some supporters and whatnot.
Small one, but still, to do that, I actually went to, through the PSF website.
And I sort of donated it to them.
And then they forwarded it on, right?
So for things like that, where you need an entity, PSF is kind of there to support you.
Yeah, exactly.
It frees us up from having to deal with, you know, getting the board of directors and dealing with the mundane legalities.
PSF already does that.
And I believe they call it fiscal sponsorship or something along that lines.
But, you know, it's basically, you know, they manage being the legal entity behind this stuff.
And we manage actually doing the, you know, the code work and, you know, the roadmaps about how this is going to go forward and, you know, making those sort of decisions.
SnapCI is a continuous delivery tool from ThoughtWorks that lets you reliably test and deploy your code through multi-stage pipelines in the cloud without the hassle of managing hardware.
Automate and visualize your deployments with ease and make pushing to production an effortless item on your to-do list.
Snap also supports Docker and M browser debugging, and they integrate with AWS and Heroku.
Thanks, SnapCI for sponsoring this episode by trying them with no obligation for 30 days by going to snap.ci slash talkpython.
So I kind of want to focus on three themes around PyPI.
One is looking inside the infrastructure and the traffic and all that.
One is about this new version you called warehouse.
And then also, like, the funding and support and that kind of thing.
So let's start with the traffic and infrastructure.
You wrote a cool blog post called Powering the Python Package Index.
In there, you really laid out a lot of the underlying technology.
You talked about some of the bandwidth requirements.
Like, I felt like I had bandwidth requirements until I saw what you guys are doing.
Like, you had a comment where you said,
We had 293 terabytes of traffic serving 3 billion requests in April, for example.
Yes.
Can you want to talk a little bit about that?
I mean, that's pretty darn impressive.
Like, you know, you've got to go talking to the video places, the Vimeos, the YouTubes, and the Netflixes to get more traffic than that or more bandwidth than that in some sense, right?
Yeah, you know, and I mean, the vast bulk of that bandwidth is taken up by the package files themselves, although a not insignificant amount of that is taken up by API requests and stuff.
I was actually curious.
I looked at May's numbers, and May's numbers are 343 terabytes and, you know, 3 billion and change HTTP requests again.
That's really amazing.
And so it sounds like May had, I don't know, what is that, like 10% more traffic in terms of bandwidth than it did in April.
So does that mean, how do you interpret it?
Does that mean that we have more popularity of Python, like the popularity and usage of Python is growing?
Or does that mean people are spinning up more little tiny VMs and pip install requirements.txt more often?
Like, is this a use case variation or is this a adoption variation, you think, as these numbers are going up?
Yeah, so I actually don't have a whole lot of insight into exactly what it is.
It's something that I've tried to get some insight into, but it's kind of hard.
I will say one thing is that as of pip 6, which was released in, I want to say, the end of 2014, I think.
Don't quote me on that, though.
Pip sort of aggressively caches locally.
So you type pip install requests and you get request version 3.0 or 2.0 or whatever.
It only downloads that file once per computer, basically.
It uses HTTP caching.
We have 10-year-long cache headers on those.
So it's basically once per 10 years per file.
It's basically once per machine, right?
Like, probably the machine goes away before the cache does.
Yeah, unless you blow away the cache or something along that lines.
So we're definitely, I believe, not seeing increase in people doing pip install on their own machine multiple times.
Or rather, I shouldn't say we're not seeing increase.
We don't know if that's increasing or not because they download once and then we never see that download again from them.
No matter how many times.
Right.
It's probably not reflected in those numbers.
Yeah.
So this is going to be either new users or new machines, cloud machines.
You know, I think probably more people switching to cloud-based workflows, you know, have an impact on this.
You know, because each time you bring up a new cloud, you know, Docker containers, yes.
Each time you bring up a new Docker container, a new cloud, you know, you start with a fresh cache that downloads again.
I think people are doing CI more and particularly things like Travis and such.
Unless you go out of your way to cache things between runs, Travis is going to give you a brand new cache each time.
You know, so I think a lot of it is things like that.
Yeah, I use SynapseEye and every time I check in something, it definitely pip installs a bunch of stuff.
I'm not sure if it has the cache populated before that or not.
But yeah, you're right.
Every check-in in some sense triggers that kind of behavior.
Yeah.
You know, and plus I do think we are – I don't know if Python itself is growing in usage, but I think pip is particularly since there's been a lot more push from the Python doc side and things.
Say, hey, you know, here's a thing that you can use to download other packages.
I think particularly for Python 2.6 and 2.7, they're getting kind of long-handed too.
And people are wanting some of the new features from Python 3 without actually switching to Python 3.
So they're installing backports and stuff or they're reaching out for things that aren't included in the standard library as much more than they used to be.
You know, I also think there is a – previously, PyPI wasn't very reliable.
You know, we went down fairly regularly, sometimes even in the middle of file downloads.
And sort of in the past three to five years, I believe it's gotten to a point where you can pip install something and be pretty confident you're going to download something and install it.
So I think just usability overall has made people more willing to use PyPI than they were in the past.
Yeah, and kudos to you guys for that, right?
Yeah, although, I mean, I would admit a vast amount of that has been Fastly.
I say Fastly is our secret scaling sauce because, you know, we really would not be able to do near the amount of traffic with the skeleton crew we have without offloading a lot of that to the CDN.
Right.
You guys don't have, like, a massive data center in San Antonio or something that's, like, in a bunker that you manage.
You're pushing this to the cloud like all the modern companies, right?
Yep, yep.
And we actually have PyPI Legacy runs.
We have three web nodes for all of that.
And we have a Heroku database server.
And, you know, we store our files in S3.
And that's really about it for the infrastructure for PyPI itself.
Okay, excellent.
And can you give us a sense of what it costs to run PyPI?
Yeah, so for us, the cost is zero.
But besides the people's time, but, like, right, of course.
Yeah, because we are lucky to have all these companies donate services.
I think I clocked it at where somewhere around $35,000 a month.
You know, some of those numbers are a little fuzzy because, like, Fastly, the billing numbers we have are for all of our use of Fastly and Python.
Right.
But you probably represent the vast majority of traffic.
Yeah, well, like, in May, we said we have 340-some terabytes for PyPI.
For Fastly in general, we had 399 terabytes.
You know, and our Fastly bill in May was $33,000.
You know, we have $6,000-some dollars in Rackspace for all of Python.
And then we have, you know, DNS and such there.
So not counting people time, you know, we're roughly $35,000, maybe a little bit more a month for just PyPI.
Okay.
This is not something that you could just run if you wanted to, right?
This takes the support of the community and companies like HP that are really backing it and Fastly.
Oh, absolutely.
Because there's no person that's going to go, you know, I really believe in this project, so here's $35,000 a month to pay for bandwidth.
Yeah, you know, I mean.
I guess there could be people.
Maybe you can find, you know, Bill Gates or someone.
You could have been to them.
That's almost $400,000 a year.
That's, you know, that's more than most people make.
But outside that, yeah.
Let's talk about the people involved.
So we know that HP is basically supporting you to do what needs to be done for Python packaging, mostly around PyPI, but in the general sense.
How many people work on these projects?
And how many people would you say are responsible for keeping pip install a thing a possibility?
Ernest Durbin helps a lot with PyPI itself.
He is not paid for that.
He's completely volunteer.
He's sort of the ops side of things.
I do a little bit of ops.
I'm not great at it.
So he does a lot of the operation stuff and is super helpful with that.
You know, Richard Jones does things on a volunteer basis also.
He's largely stepped back lately.
Just because his time has been taken up by other things.
But he still comes around and helps with support requests and stuff, which I don't have the time to do.
You know, then we start getting like setup tools, which you need for pip install to do source disks.
You know, that's largely Jason Combs, Jericho.
That's largely his baby now.
You know, then you start talking about PIP.
You know, I'm there as well.
You know, there's like a Paul Moore and Marcus is there and a few other people, you know, but you know, their time is all limited based on because they're doing it in their spare time, which I do in my spare time as well on top of the HP time.
But most people outside of myself have a lot more limitations to the time they can spend on it just because they're completely volunteer based.
Yeah.
So just a handful of people full time.
Oh, yeah.
And everyone else is just a little here and a little there as they can.
Yeah.
Do you feel like PIPI is underfunded?
Yeah.
You know, I do believe PIPI is underfunded.
You know, it's sort of the tragedy of the commons.
You know, it's used by a lot of people, you know, as evidenced by our traffic numbers.
That or someone's using it a lot.
While we do get support from, you know, a number of companies, you know, realistically, I forget the exact number off the top of my head, but we're less than 10 companies who support us.
And I'm pretty sure more than they use PIPI.
They could be just installing a lot of stuff.
Of course, I mean, everybody uses it.
It's absolutely one of the foundational things, right?
It is the thing that facilitates batteries included in the broad sense of Python, right?
Yeah.
You know, I absolutely believe so.
You know, I think, you know, it's one of the most important things, if not the most important things provided by the PSF infrastructure.
It's debatable with, you know, you know, HG or HG instances and stuff.
I think it's one of the most important things that, you know, the PSF infrastructure does provide.
You know, and certainly when it goes down, people are very quick to notice that, you know, they, I get notifications through Twitter and email and IRC before our monitoring even notices it's down.
People are telling me it's down.
A lot of people depend on it.
Is it stressful to you to be responsible for it?
So there's definitely stress.
Over the years, I've gotten better at dealing with it.
You know, a lot of people, it's one of those things where, you know, when it's working, people don't think about it.
And when it's not working, they're out in droves to tell you it's not working.
You know, and I've never actually been technically on call for PyPI.
Ernest has been, Nova Kanchowitz has been, been technically on call.
But I say, you know, it's basically impossible for me to not be on call unless I completely unplug myself from the internet.
You have to go into the forest and not look for sky riding airplanes.
Yeah, because, you know, I'm so publicly known and associated with PyPI that, you know, people are reaching out to me as soon as it's down.
And to their credit, they're mostly trying to be helpful to let me know it's down.
But, you know, so it becomes a flood of communication anytime it suffers serious downtime.
Now we've sort of engineered it so that pip install very, very rarely goes down.
But uploads and stuff kind of go down more often than that.
But that affects a much smaller percentage of people.
So that doesn't get as bad.
Absolutely.
I'm really excited to tell you about a new sponsor of the show, Rollbar.
One of the frustrating things about being a developer is dealing with errors.
Relying on users to report errors, digging through log files, trying to debug issues, or a million alerts just flooding your inbox and ruining your day.
With Rollbar's full stack error monitoring, you get the context, insights, and control you need to find and fix bugs faster.
It's easy to install.
Start tracking production errors and deployments in eight minutes or less.
Rollbar works with all the major languages and framework, including the Python ones.
Django, Flask, Pyramid, as well as Ruby, JavaScript, Node, iOS, and Android.
You can integrate Rollbar into your existing workflow.
Send error alerts to Slack or HipChat, or automatically create new issues in Jira, Pivotal Tracker, and lots more.
We have a special offer for Talk Python listeners.
Visit Rollbar.com slash Talk Python to me and get the bootstrap plan for free for 90 days.
That's 300,000 errors tracked for free.
But hey, just between you and me, I really hope you don't need that many errors.
Rollbar is loved by developers at awesome companies like Heroku, Twilio, Kayak, Instacart, Zendesk, Twitch, and more.
Give them a try today.
Go to Rollbar.com slash Talk Python to me.
If we had more people working on it and more people whose time was more seriously dedicated to it like yours is,
we could probably do some amazing stuff, right?
So there's a way to donate to this.
You could actually have a donate.pypi.io as like the landing domain, I guess you would call it, because it redirects.
But that allows people to donate.
Like how if people are working for a company and they're like, yeah, our whole company does $100 million of revenue, depends upon this thing.
And we've actually not even helped support it.
Maybe we should.
Like how would they get involved?
Maybe those would be the biggest bang for the bucks if we could get some big companies to step up.
Yeah, so obviously they can donate.
If that's the way that they want to get involved, donations are easy.
And there are tax write-off in the U.S.
But if they want to donate developer time, one of the easiest things to do would be to contribute to Warehouse,
which is on GitHub at github.com/PyPA slash Warehouse.
That is deployed now to PyPI.io.
That's where you're going to live in the future.
And, you know, my big push right now is trying to get Warehouse to the point where we can say, okay, this is ready enough.
Let's start directing people here by default.
Because PyPI is sort of an old code base.
It's slowly falling apart.
Uploads, we get a sort of base 10% error rate on uploads right now.
You know, it's just falling apart.
It's sort of a full-time job to keep it from not falling apart, which doesn't give me any time to work on other things.
All your fingers plugging holes in the dam rather than, like, building the dam.
Yeah?
Yeah.
So I've sort of ignored some of the holes willfully to try and free up time to get Warehouse ready to launch.
Because, you know, the idea is that hopefully Warehouse will get slotted into place and a lot of things will be better.
I'm sure it's going to break things for a lot of people.
But it will become more joyous to work on, and maybe you'll get more contributors using stuff that people understand, right?
Yeah.
Oh, absolutely.
Like, PyPI Legacy is largely two files, both over 4,000 lines long.
And I think I'm the only person left that actually understands it.
Richard hasn't touched it recently enough, and things have changed that he would have to get ramped back up.
And so far, I've personally had 100% failure rate on getting new people involved in that just because they take one look at the code and then it just kind of didn't disappear.
It's not a fun code base to work on.
You know, it's particularly because you can't really run it locally.
So a lot of times, changes are make a change, push it to production, maybe to test PyPI, which is sort of a staging slash sandbox instance we have, depending on what the exact problem is.
And then just sort of pray and who the century is and start yelling at us.
Yep.
All right.
So Warehouse is a huge topic that people are interested in.
I want to get to that.
But before we move off this topic, you also heard another blog post called A Year of PyPI Downloads.
And there was a lot of insight that could be gleamed from those numbers.
Can you talk about that really quick?
Yeah.
So sort of in general, in January of 2014, we started saving and archiving all of our download logs.
In 2014 and again in 2015, I believe it was, I sort of pulled those all down and crunched some numbers on those and pulled out some what I thought were interesting numbers largely around, you know, what versions of Python are being used, you know, what versions of packaging tools are being used, things like that.
And those blog posts were sort of very widely received.
So what I've done in the mean since then is I've sort of improved our metrics stream to the point where now every single download generates a row in a BigQuery database.
And, you know, which is got all sorts of information like, you know, what version of Python downloaded it, you know, what tool downloaded it, what country it came from, stuff like that.
And as of, let's say, a month ago, that data is now completely public for anyone to go and query as long as they have a Google account.
Nice.
Yeah.
Give me the link to where that is and I'll put it in the show notes.
Yeah.
So I'm not really that great at data visualization or pulling information from data.
You know, I tried to do my best with my year of PyPI downloads posts.
But I'm hoping that by making that completely public, A, people can do, can make data-driven decisions about what versions of Python they support.
Because you can very easily, using an SQL-esque language, say what versions of Python are downloading X package over some period of time.
You know, I'm hoping that people who are actually good at data visualization and pulling meaning from data can take a look at it and come up with some interesting information.
Particularly maybe as it relates to, you know, correlating that with, you know, GitHub data or Bitbucket data or, you know, some other kind of data.
Yeah, that sounds really cool.
And if you give me a link to the details, I'll be sure to put it in the show notes.
Yep, yep.
It's not greatly documented right now.
It's basically a post to Disutil SIG telling people about it.
The historical data is not in there yet.
You know, so that data starts, I want to say, March-ish, sometime late March.
That data starts, I'm backfilling from January of 2016 right now.
And then I have to backfill back beyond that.
But that takes a bit more effort because the logs aren't in the correct format.
So I have to come up with something to munch those logs into the new correct format.
Yeah, okay.
Well, that sounds really promising.
And, you know, there's a lot of data scientists and data visualization professionals that listen to my show.
And when I put data out, they seem to do amazing stuff with it in a surprisingly short amount of time.
So maybe someone will come up with something cool for that.
Let's talk about Warehouse because that's a really interesting project.
And I sent some messages out on Twitter.
I said, hey, what should I ask Donald while we're talking?
And everybody came back with some variation of talking about Warehouse.
So Warehouse can be found at PyPI.io.
What is it?
Yeah, so PyPI.io is the production-ish.
I say ish because we're not monitoring it or anything.
Deployment of Warehouse, which is PyPI 2.0.
It is backed by the same PostgreSQL database, the same S3 instance, et cetera.
So anything that changes on PyPI changes on Warehouse, and the reverse is true.
Right.
So they're watching the same data stores.
It's more of the front-end and API implementation, right?
Correct.
So right now, the read-only portions of it, which is 90-some percent of our traffic, are pretty much done.
There are a few.
If you go through the UI, you'll see a few to-do stuff that we have to either finish or comment out before we make it official.
A lot of the author UI stuff is not done yet.
Okay.
The client side, the read-only UI bit is really nice.
It looks, you know, I feel like I'm going from SourceForge to GitHub equivalent of experience.
It's much better than current story.
So I think that's going to be delightful.
That's cool.
Yeah, yeah.
And, you know, I think that was Nicole Harris who's done the design for that, which I think she's done a phenomenal job on that so far.
You know, particularly going from what we had to what this is, you know, it really does feel like you're jumping forward an era or two, you know, as far as what modern design looks like.
Oh, yeah, absolutely.
No, I was just saying, you know, she's put a big focus on, you know, trying to get the usability of PyPI to be a whole lot nicer and better to use, you know, and surfacing the information people care about and, you know, hiding information that people really don't care about or maybe admitting it completely if it's, you know, just confusing information or information that maybe really needs to tend to know.
Yeah, nice.
So can you talk a little bit about what frameworks and internals use to create it?
Yeah, so Warehouse is written in Pyramid.
Now it is.
Warehouse has got sort of a sordid history where I've gone from, I started out using just WordZig and making my own framework to then it went to Flask, then it went to Django.
Now I've finally settled on Pyramid.
Why do you make those changes?
Like, what kept moving you along?
Yeah, so one of the things I wanted to do with Warehouse was to 100% test coverage across the board.
You know, coming from with PyPI where, you know, we had zero test coverage.
One of the things that was very painful to me to make any change was, you know, figuring out what the impact was going to be, where I'm going to break code that I thought was unrelated but was really related.
So I really wanted to make sure we had great test coverage.
Unfortunately, a lot of the web frameworks out there tend to use a fair amount of globals.
There's some argument about whether it's threat globals or technically globals or not, but I call them globals too.
I think they're globals.
You know, and, you know, that makes it more difficult to test things.
So I really created my own framework on top of Workazig that was heavily influenced by Gary Bernhardt's boundaries talk where there was very few of these sort of bag of items.
There wasn't a user class that had, well, that was a data model and it had, you know, all these sorts of things you could do to a user hanging off of it.
So that makes it hard to test because you have to pass through a huge interface.
It's sort of like a miniature global.
They kind of have to pass through this huge interface and actually test things.
You have to provide an object, implement all those things or else, you know, your tests are not actually really testing things.
And so we didn't have a ORM, you know, it was using SQL Alchemist expression layer to some degree.
It was also using just raw SQL in some places.
And one of the things that we, that I discovered doing that was, A, I was reinventing a lot of things, which, while fun, wasn't necessarily the best use of my time.
You know, two, it brought us back to the same problem we had with PyPI where other people found it hard to contribute to it because it was using something that, well, it fit my headspace quite well.
It didn't necessarily fit other people's headspaces.
And, you know, three.
Right.
Nobody had experience with it, right?
Yeah.
And, you know, and three, it, a lot of decisions were bottlenecked on me because it was, well, how, how do we do X thing in this completely custom framework?
Well, nobody knows except Donald because Donald has to invent it.
And so a lot of things were bottlenecked on me.
So, you know, me and Richard sort of talked about it and we decided, you know, we need to move to something more standard.
And I can't recall exactly if it was Flask or Django that came first.
I know it was ported to Flask and I wasn't really too fond of that because one of Flask's big API things is thread locals as part of the API.
And my experience with that is it becomes hard to then do anything in Flask without adding increasing amounts of thread locals.
And so I kind of mixed that because I just didn't like the third locals.
I went to Django and Django is a great code base.
You know, I've used Django a lot.
I just started with Django.
I started porting it to that and I discovered that the Django ORM is not really powerful enough to handle all of the things that PyPay does in its database that it's sort of accumulated over time.
We have, you know, we have tables with composite keys.
We have composite foreign keys.
We have tables without any primary keys.
You know, we have, you know, a number of things.
And, you know, I did get the user things ported over to Django.
Then I just sort of gave up and said, you know, this is too much work to actually get this to slot it into the shape that Django wants it to be.
And I said, I'm going to just have to use SQLAlchemy for this, which is another great ORM.
But then once you sort of throw away the Django ORM, you'll lose a lot of the power of Django.
And I also wasn't using the Django template language because prior to all of this happening, I worked on a sort of another alternative front end to PyPI called crate.io.
Back before I was a PyPI administrator, which was written in Django.
I used the Django template language in that.
And that became a bottleneck because of how big some of our HTML pages were to list all the packages.
That became a serious bottleneck.
So then we're sitting there.
So we use Jinja2.
So then I'm sitting there looking, okay, we have Django.
It's kind of hard to fit our database into Django's ORM.
So we can't use that.
The DTL was too slow at the time.
I don't know if it is now to really use that.
So we've sort of paired Django down to a glorified request router.
And we've thrown away a lot of the power of Django.
There's no third-party apps.
There's no admin.
So then I took a look at Pyramid.
And Pyramid had a lot of the things I liked about Django.
There was really no thread locals.
There is a thread local, but it's optional whether you use it or not.
And, you know, it had enough flexibility in it to sort of use whatever tools we wanted to do.
So I could bring in SQLAlchemy and use that.
I could bring in, you know, sort of change things around to sort of suit my purposes better than I could with Django.
Now, the flip side of that is it doesn't do as much out of the box.
You have to kind of configure it and make it do what you want to do.
But, you know, given the long history of PyPI and all the sorts of little weird things that's grown over time,
that fell a lot nicer to what we needed to do than sort of Django does.
Because while Django is great, once you sort of get out of the Django workflow,
you start fighting in the framework a lot more than you do with Pyramid.
Yeah, okay.
That kind of makes sense to me.
The testing part with Flask, that I didn't know about.
But I can imagine the stuff with Django.
You know, I think you and I settled on, for very different projects,
the same technology stack, more or less, like for all my web properties,
I'm using SQLAlchemy and Pyramid and whatnot.
So, yeah, very interesting.
Let's see, we have just a few minutes left,
and I have a couple of questions from the listeners,
and then maybe one more thing I wanted to make sure we touch on.
Mahmoud Hashemi, who's also been a guest on the show,
asks if real-time download counters are coming back.
Yeah, they are.
So, the old metric stack sort of fell apart and died.
because it was sort of hacked onto the side of PyPI,
like a lot of what PyPI does has been.
The new metric stack, which is based around BigQuery and such,
is sort of designed to allow us to bring that back,
as well as give us this sort of archival ability to query all sorts of things.
I disabled them just because they were zero all the time,
because the thing had broken, and I didn't have time to fix it.
But we are planning on bringing those back,
and hopefully they'll actually work this time, and it'd be nice.
Yeah, would they reappear in the warehouse time frame,
or would you bring them back to the legacy version?
It'll probably be in the warehouse time frame.
Might not be until after launch of warehouse,
unless someone feels like coming around and figuring out how to do all that beforehand.
I'm new to BigQuery.
So far, I really enjoy using it, and it seems to work really great.
But one of its constraints is that queries can take a couple seconds to a minute or two to run,
which is fine if you're just looking at it for data archival.
Not great to do in the middle of a request-response cycle.
Yeah, that's for sure.
So we need to do some work around figuring out, okay, how do we take this data that's in BigQuery
and put it in a format that we can look at in warehouse in the request-response cycle,
and then just take someone to sit down and figure that out.
I just haven't had the time to do that.
Sure.
So final thing on warehouse.
Nicola Kentar asks, what's the time frame for shipping that?
So I've given a few dates before.
We've passed them all so far.
We're not historically been great at estimating how long until it's ready to go.
I think we're pretty close, though.
I've started – I just recently told people on District Till Sig to start switching their uploads to using warehouse,
largely because we have a 10% standard failure rate on uploads to legacy.
So far, everyone who's done that has said it's worked great.
We just recently committed to Twine, which is a tool to replace setup.py upload.
We switched in the master branch to default to using warehouse that's not been released yet.
But I'm hoping that that will be released in the next couple weeks.
And if that works out great, hopefully we will get Cpythron itself switched to the warehouse for uploads.
And, you know, then that will hopefully propagate out and people will use that and that will solve a big problem.
As far as switching the actual, you know, like redirecting the old domain, I think it's soon.
I don't have a good target for exactly when.
But hopefully – I'm really, really hoping it'll be in 2016 because I'm tired of the old code base.
I want it to die a thousand deaths.
Yeah, I can imagine.
That sounds like a really cool new version.
And it sounds like it's going to be great for everybody when it's working and it's the default.
Certainly, my playing around with it, you know, it seems like a nice place to be.
So I have a bunch of other questions I'd love to talk to you about.
But we're just running out of time.
So maybe we'll have to leave it there.
Maybe when you guys do ship it, when it flips, maybe we can come back and do some kind of celebratory show.
Sure.
To celebrate the actual flipping of the DNS or the redirect.
Cool.
So a couple of questions I always ask people before they end at the end of the show is – and I think this question is particularly interesting to you given your relationship.
But I ask this to all my guests is, you know, there are over 80,000 packages on PyPI these days.
And like we talked about, there's so many amazing little packages people can grab and make their programs awesome.
Like what one do you think is amazing you like to call attention to that's maybe not requests that everybody knows?
You know, something like that.
Yeah.
I would have to say Bpython.
It's sort of an alternative REPL for Python.
It's got the, you know, syntax highlighting.
You know, it's got autocomplete as you type things out.
It really works well and I install it on all my virtual M's because it just works a lot nicer than the building one, I think.
I use it a lot.
Okay.
That's awesome.
And when you write Python code, what editor do you use?
So lately I've been using Atom.
I've been trying it out for the past two or three months.
So far I've liked it.
You know, previously I was using Sublime Text 3.
Lately it's been Atom.
Okay, cool.
Yeah.
It seems like Sublime and Atom are working at the same level.
They have kind of a similar, they appeal to a similar group of people.
That's cool.
All right.
Any final call to action while you've got the mic?
Yeah, you know, I just, you know, I would love it if anyone who uses PyPI could come and, you know, contribute to that or to pip or, you know, talk to your companies, see about contributing to developer resources or even just some money.
Anything helps.
And, you know, hopefully we can keep moving things forward and everyone will be happy and stop yelling at me when things go down.
That would be amazing.
I just want to second that as well.
Like, try to convince your companies, if they depend heavily on Python, to contribute just a little bit.
Because imagine a world where pip install basically didn't work.
You had to go piece that all back together.
That's something we don't want to see happen.
And it would be really great if we could make it a much more stable, supported, active thing instead of putting all the weight on you, Donald.
And the few other guys we mentioned, right?
Yep.
And remember, donations are tax deductible in the U.S.
Awesome.
So there's just so many more things we could talk about, but we're going to have to leave it here just for the sake of time.
So, Donald, thanks for being on the show.
It was great to talk to you.
Yep.
Thanks for having me.
Yeah.
Bye-bye.
This has been another episode of Talk Python to Me.
Today's guest was Donald Stuffed, and this episode has been sponsored by SnapCI and Rollbar.
Thank you both for supporting the show.
SnapCI is modern, continuous integration and delivery.
Build, test, and deploy your code directly from GitHub, all in your browser with debugging, Docker, and parallels included.
Try them for free at snap.ci slash talkpython.
Rollbar takes the pain out of errors.
They give you the context and insight you need to quickly locate errors that might have otherwise gone unnoticed, until your users complain to you, of course.
As Talk Python to Me listeners, you can track a ridiculous number of errors for free.
Just go to rollbar.com slash talkpython to me to get started.
Are you or a colleague trying to learn Python?
Have you tried books and videos that left you bored by just covering topics point by point?
Well, check out my online course, Python Jumpstart by Building 10 Apps, at talkpython.fm/course, to experience a more engaging way to learn Python.
You can find the links from this episode at talkpython.fm/episodes slash show slash 64.
Be sure to subscribe to the show.
Open your favorite podcatcher and search for Python.
We should be right at the top.
You can also find the iTunes feed at /itunes, Google Play feed at /play, and direct RSS feed at /rss on talkpython.fm.
Our theme music is Developers, Developers, Developers by Corey Smith, who goes by Smix.
You can hear the entire song at talkpython.fm/music.
This is your host, Michael Kennedy.
Thanks so much for listening.
I really appreciate it.
Smix, let's get out of here.
Stating with my voice, there's no norm that I can feel within.
Haven't been sleeping.
I've been using lots of rest.
I'll pass the mic back to who rocked it best.
Thank you.