Create proposal for PyPI organization

[nathan-weinberg]

Now that we are publishing several PyPI packages we should officially propose creating a PyPI org to own them all: https://pypi.org/manage/organizations/

cc @tiran @russellb curious y'alls thoughts

[russellb]

seems like a good idea. I went ahead and requested an instructlab org

[nathan-weinberg]

Once the new org is approved, we should moving all of our libs to the new org: https://pypi.org/search/?q=instructlab

Current owners are:

• @russellb
• @nathan-weinberg
• @tiran
• @bjhargrave
• @fabianlim

[nathan-weinberg]

It has been pointed out that it may be better to create a user owned by the @instructlab/oversight-committee to be the package owner

[jjasghar]

I've had some conversations with pypi about this as a "whole," and organizations are still in "progress" and will only be available to the sponsoring organizations any time soon.

Unless our project can start sponsoring the PSP and pypi, this should be either completely back burner'd or closed as can't be done.

[nathan-weinberg]

So shouldn't we go the user route I've suggested then @jjasghar? Otherwise all these packages will just be owned by a smattering of Red Hat and IBM engineers

We can create a user just called instructlab and have the credentials shared somewhere amongst the OC

[jjasghar]

Yep, that seems like the best path forward.

[bjhargrave]

have the credentials shared somewhere amongst the OC

Ooooh, a 1password vault :-)

[tiran]

We can create a user just called instructlab and have the credentials shared somewhere amongst the OC

No, shared accounts are a bad idea. Don't do this. You want to be able to audit account activity and remove access of a person in case they leave the project or their work machine gets compromised.

[nathan-weinberg]

We can create a user just called instructlab and have the credentials shared somewhere amongst the OC

No, shared accounts are a bad idea. Don't do this. You want to be able to audit account activity and remove access of a person in case they leave the project or their work machine gets compromised.

What we have now is bad. So what do you propose?

[tiran]

Use individual, personal accounts in combination with strong 2FA (FIDO). Select a few people (3-4) to be project owners.

InstructLab is using trusted publishing for releases anyway. Project admin access is only needed to yank a bad release or to add/remove another maintainer. You could make an argument that people should create a new work account with their work email address and not use their personal PyPI account. I don't think that's necessary.

[nathan-weinberg]

Use individual, personal accounts in combination with strong 2FA (FIDO). Select a few people (3-4) to be project owners.

InstructLab is using trusted publishing for releases anyway. Project admin access is only needed to yank a bad release or to add/remove another maintainer. You could make an argument that people should create a new work account with their work email address and not use their personal PyPI account. I don't think that's necessary.

We now have two Release Engineers on the team - @courtneypacheco and @ktdreyer - I reckon they would be good people for this

[mairin]

Oversight Committee member here. 🫡

Christian's last post seems the best approach, let's do that and I approve Ken and Courtney to be added.

[tiran]

ey ey, ma'am!

I have invited cpacheco and ktdreyer as maintainers of the following packages

• https://pypi.org/project/instructlab/
• https://pypi.org/project/instructlab-quantize
• https://pypi.org/project/ilab/

Could you please make sure that you have 2FA enabled? PyPI doesn't show your 2FA status.

The following packages also have a sole owner

• https://pypi.org/project/instructlab-dolomite/
• https://pypi.org/project/instructlab-schema/

[ktdreyer]

Thanks @tiran !

I do have 2FA enabled on my ktdreyer PyPI account.

I have accepted all my pending invites for the Instructlab repos. @bjhargrave has invited me to https://pypi.org/manage/project/instructlab-schema .

I don't have access to https://pypi.org/project/instructlab-dolomite/ .

[bjhargrave]

I think you also need to setup testpypi accounts so you can be invited to the packages on testpypi.

[ktdreyer]

Thanks @bjhargrave . I've done that today. https://test.pypi.org/user/ktdreyer/ is my account.