Renaming packages about apm HOT 21 CLOSED

This should probably be opened on github/atom.io

from apm.

It has implications in apm too, right? What about a rename command? If it were renamed, and it was updated, the folks who installed the old one should get the new version, right? Or would all that be transparent to apm if this were in atom.io?

from apm.

It does have apm implications, but it needs API support from atom.io which I'm assuming doesn't exist yet.

If the API already exists, then yeah, this is the right place to implement the client-side portion of it.

from apm.

I'm not sure how I feel about this. Let's discuss it here since it's a public repo.

Since we use the package name as the primary key (which is typical for package managers), to support renames seamlessly we'd need to redirect from old names to new names. How long a rename history do we redirect from? In other words, how much of the namespace can a single package eat up? Would we have some kind of policy about redirecting for only a certain amount of time or for only the most recent rename? If we do that, we end up in a situation where an attacker can take over an old name at the right moment and have users install new packages via update that they didn't intend to install.

I'd prefer to stick with owners changing the name and republishing, and leaving it to the package owner to inform users of the new name, probably via the description field in package.json.

Another possibility is providing for a key in package.json that indicates a package has been moved, but that allows for the same kind of namespace spamming.

I took a look at npm and rubygems, and neither of those seem to provide for package renaming. I really don't think this feature is a common enough need to add to the API given it would need support for redirects, but the steps for manual "renaming" should be added to the documentation somewhere.

I'm not drawing a line in the sand here, just raising my concerns. Happy to hear out counterpoints.

from apm.

A convenience command in apm would be nice. It could effectively unpublish and republish under a different name.

It might be nice to have something that notifies people who have it installed that it has moved, or somehow trigger an update and download the package with the new name. This could go away once someone published something to the original package's name. I dont think we need to redirect on atom.io.

I agree that if nothing new is done here, that there should at least be docs on how to rename something. Right now, it's unclear what the best way to do this is.

from apm.

I dont think we need to redirect on atom.io

I was using 'redirect' to include the API recognizing the old package name as well, not just a 302 on the site. A little vague, sorry. I like the idea of triggering an update, perhaps with some verification on the API side that the content of the package hasn't changed.

Actually, come to think of it, I really like the idea of that verification. We could temporarily recognize old package names if we are sure to confirm that the file contents and repo owner are the same.

from apm.

👍

from apm.

I am leaning toward adding an endpoint that works just like creating a new version, but allows the name of the package to change, and checks that if the owner's login has changed, that the user ID has not, and then updates the various urls and such.

from apm.

@thedaniel that sounds great.

from apm.

I have been transferred ownership of a project on GitHub and now users cannot download updates: Glavin001/atom-beautify#42

I have read that if you transfer ownership back to the original owner, then unpublish, then transfer to new owner, and then re-publish, it will work, however I worry that this will reset the download streak of the package and/or not work at all.

Is there any way to move a repo that you know of / recommend? I ask hoping that there's something we can do sooner than later for the Atom package users, while this issue is developed.

Thanks in advance!

Update:
I see the Atom REST API docs here: https://atom.io/docs/latest/apm-rest-api
Looks like the package_name is bound to the repository parameter as used when the package was initially published (POST /api/packages). So I'd want to update the repository field in my case. No endpoint for that yet, I see, @thedaniel are you presently developing that? Anything I can do to help? :)

Also, I notice that the package_name is used for both creating package Versions (POST /api/packages/:package_name/versions) and Starring (POST /api/packages/:name/star). I presume (read: hope) the Downloads count would be the same, and that a DELETE (or unpublish) request for a package would not cascade and also delete the Star and Download records (assuming they are modelled as separate records in the database); and if it does delete them (or they are modelled as embedded documents/fields to the Package record itself) then the ideal would be being able to update specific fields (such as the repository field) instead of effectively unpublishing and re-publishing.

Let me know if there's anything I can do to help / expedite this issue! Awesome work on Atom so far. Now for polishing up a few edge and corner cases ;).

from apm.

Fixed by #167

from apm.

Sorry, @kevinsawicki. I don't quite understand how #167 fixes this. Maybe I missed something. Could you please elaborate a little? Thank you :).

from apm.

@Glavin001 I suspect he meant to link #161 instead 😉

Also, thanks! This will be useful 🎊

from apm.

@smashwilson Thanks for the the right link, sorry @Glavin001 for the confusion.

from apm.

Not a problem. Great to see this feature being released! Thank you!

from apm.

I have deleted the original github account I used for publishing language-svg and now apm publish fails to work, same thing with apm --rename, not sure how to make it work again, please help.

from apm.

@erikdahlstrom I'll take a look at that and let you know.

from apm.

@erikdahlstrom just out of curiosity, did you move the repo from one account to the other with github, or just create an entirely new repository and push to it?

from apm.

@thedaniel just used github to move it over, as described in the howto for how to merge accounts, then changed the repo link in the packages file and pushed to the new location, then apm publish -> fail.

from apm.

@erikdahlstrom oh my, I'm so sorry that I let this sit for months - I think I missed it because the issue was closed. Since your last comment some changes were made to the backend that either should a) make it just work or b) make it easy for me to fix it up for you

from apm.

@thedaniel no worries, it seems to work now, just published an updated package, thank you.

from apm.