Include most recent upload metadata when uploading to PyPI

[pganssle]

It seems that for the upload command, we're delegating entirely to distutils, which has metadata_version hard-coded as "1.0", and only uploads the 1.0 metadata. I think this is one reason that Requires-Python data isn't showing up on PyPI.

Although setup.py upload is basically deprecated, I think we should probably still make these improvements, even if as part of this we also add DeprecationWarning telling people to start using twine.

[di]

It seems that for the upload command, we're delegating entirely to distutils, which has metadata_version hard-coded as "1.0", and only uploads the 1.0 metadata. I think this is one reason that Requires-Python data isn't showing up on PyPI.

Indeed, this is true.

However, I'm not sure it's worth doing what it would take to support Metadata 2.1 on upload. I think it makes more sense just to deprecate setup.py upload entirely and direct folks to use twine instead.

[pganssle]

I'll take a look at how difficult it would be to do next week. One big problem is that this is creating a lot of bad and immutable data on PyPI and a lot of people are just running scripts they wrote a long time ago or copying from some old "how to make a release" guide someone made.

If we're going to say that the new upload metadata is just not supported in setuptools, we should probably start throwing an actual error rather than a warning.

I think the options are:

1. Decide we don't support this and throw an error whenever >1.0 metadata is detected on upload.
2. Build whatever basic support for it we can and start raising a warning that you should really be using twine.
3. Try shelling out to twine and raising a warning if successful ("Hey, use twine directly!") and throwing an error if unsucccessful.

I think 3 is too clever and from the cursory look I made at the code before I created this issue, I think 2 is a feasible path forward.

[benoit-pierre]

I'm for 1: we should deprecate and remove support for upload, sooner rather than later. Same with a bunch of other stuff.

[di]

#1410 is merged/released, I think this issue can be closed.

[benoit-pierre]

I think we should keep this open until the upload/register commands are completely removed.

[di]

Fair enough, we should probably revise the original issue in that case.

[pganssle]

I'm actually planning on fixing this at some point, because it's currently polluting PyPI with bad packages in a very insidious way, as a major driver of this issue.

If we proactively remove the upload command, a lot of people will just pin to an older version of setuptools rather than take the time to fix their build system, and unless pypi/warehouse#3889 is actually implemented, that will continue to cause problems.

The patch was decently simple last time I checked, it's just that the bug is in distutils, which complicates things slightly. Even after deprecation, I'd like to have a version that works properly to avoid the python-requires problem.

[jpurviance]

looking at this