pypa/warehouse
Warehouse
Warehouse is a web application designed for hosting, storing, and distributing Python software packages to a global community of users. It functions as a centralized package repository and index server that manages software versions, metadata, and package classification.
The project implements secure package attestation by verifying distribution integrity through cryptographic signatures and transparency logs. It manages user identity via an OAuth provider that integrates with third-party identity services using secure tokens.
The system covers a broad range of infrastructure capabilities, including asynchronous task processing for background jobs and email dispatch, versioned database schema migrations with concurrent indexing, and access control based on user group memberships. It also includes tools for interface localization and package activity tracking through sequential event journals.
Development utilities are provided for request simulation, database seeding, and internal application state inspection.
Features
- Python Ecosystem Distributions - Hosts and distributes Python software packages through a centralized web repository for a global community.
- Package Attestation Verifiers - Validates the authenticity and integrity of software distributions using cryptographic signatures and transparency logs.
- Python Packages - Operates a centralized system for managing Python software distributions and version metadata.
- Package Metadata Indexing - Manages a searchable catalog of software versions, metadata, and classifiers to help users find libraries.
- Package Index Hosting - Operates a centralized web application for uploading, storing, and distributing software packages.
- Identity Federation Providers - Integrates with third-party identity providers using standardized protocols like OAuth for user authentication.
- Identity Providers - Provides an authentication system that handles user sessions and integrates with third-party identity services via OAuth2.
- Third-Party Identity Integrations - Integrates external identity providers using secure tokens to manage user authentication without storing credentials.
- Asynchronous Task Processors - Employs a background processor to handle long-running tasks and email dispatch without blocking the main thread.
- Asynchronous Task Queues - Implements a background job execution system to offload long-running operations and maintain interface responsiveness.
- Database Schema Migrations - Provides automated versioning and updating of database structures to maintain consistency across environments.
- Package Index Servers - Functions as a web application for hosting, storing, and distributing Python software packages.
- Identity Provider Integration - Connects user profiles to third-party identity services using secure tokens to verify identity.
- Classifier-Based Filtering - Provides the ability to list software packages that match specific classification strings.
- Group-Based Access Controls - Implements access restrictions based on a user's membership in specific security groups.
- Authentication Enforcement Policies - Evaluates a sequence of security policies to verify identity and enforce access control across sessions.
- Identity Verification - Checks account status to invalidate sessions regardless of token validity.
- Multi-Method API Authentication - Verifies identity by evaluating a sequence of security policies and maintaining consistent authorization.
- Security Verification Gates - Blocks authorized actions unless users meet security criteria like verified emails or active two-factor authentication.
- Event Journals - Maintains a sequential journal of project changes and version updates using serial identifiers to track activity.
- Background Job Queues - Offloads long-running operations to an asynchronous worker queue to prevent blocking the request response cycle.
- Background Task Execution - Executes asynchronous jobs via a queue to handle long-running operations without blocking the user interface.
- Sistemas de compilación - Server software powering the official PyPI package repository.
- Package Repositories - Next-generation PyPI implementation.
- Business Applications - Next-generation platform for managing software package repositories.
