Description

woodruffw

opened on Nov 6, 2026

Issue body actions

Right now PyPI rejects per-member comments on uploaded ZIPs (wheels), but not on the archive-wide comment. The latter is not as differential prone (since it's a trailer), but rejecting it would prevent someone from stuffing ZIP control structures into it, which would confuse a ZIP parser that works from the end of the file rather than the front.

See #18846 for some context.

Reacted by Seth Larson and Victor Murithi

Activity

1. woodruffw commented on Nov 6, 2026

   

   woodruffw

   on Nov 6, 2026

   MemberAuthor

   More actions

   CC @sethmlarson since I think you have context on this/what the compat tradeoff was here 🙂

   Reacted by Seth Larson
2. sethmlarson commented on Nov 9, 2026

   

   sethmlarson

   on Nov 9, 2026

   Contributor

   More actions

   We'll probably have some number of hits from folks using CLI tools to create a wheel manually, there are at least 2 tools that previously left a generic comment here. I think it's still fine to do this, though: the goal is to minimize places where unchecked data can hide within an archive and comments is the easiest place.
3. woodruffw commented on Nov 9, 2026

   

   woodruffw

   on Nov 9, 2026

   MemberAuthor

   More actions

   Yeah, I think it probably makes sense to start with some metrics here. I can work on that.

   Then, after a month or so, if the metrics point in the right direction, we could flip towards rejection here 🙂
4. woodruffw commented on Nov 9, 2026

   

   woodruffw

   on Nov 9, 2026

   MemberAuthor

   More actions

   #20952 will do the first part of this (rejecting sketchy archive comments + metrics on everything else). We should keep this open for another month or so and then close after rejecting archive comments entirely.
5. woodruffw

   self-assigned this

   on Nov 9, 2026
6. woodruffw

   added

   APIs/feeds

   on Nov 9, 2026

Issue actions