Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The PyPI ignore words filter is... not a good idea #213

Closed
freakboy3742 opened this issue Apr 13, 2023 · 1 comment
Closed

The PyPI ignore words filter is... not a good idea #213

freakboy3742 opened this issue Apr 13, 2023 · 1 comment

Comments

@freakboy3742
Copy link

The spelling_ignore_pypi_package_names setting turns on an ignore words filter that includes every package name registered on PyPI. This has multiple problems, in both the concept and implementation.

  1. It uses the XML-RPC API, which was deprecated 2 years ago.
  2. It uses xmlrpc.client, which is based on httplib; on macOS, this uses the system certificate store, which as of today, fails with an SSL CERTIFICATE_VERIFY_FAILED due to a stale root certificate.
  3. As of today, it returns 446264 packages names for use on the exclude list.
  4. I sure am glad nobody could register a PyPI name of speeling... :-)

At the very least, I'd suggest the filter as-implemented should be deprecated/removed. It's a footgun waiting to go off.

It could possibly be replaced with a list of packages defined in the local environment (populated by pip list or equivalent); but IMHO, software package names should be either (a) automatically excluded because they're being quoted as literals, or (b) should be explicitly included in a spelling list, rather than trying to autodetect every package in the Python ecosystem.

@dhellmann
Copy link
Member

See #214

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants