Cannot upload to test.pypi

[mdbenito]

See this error: https://github.com/aai-institute/pyDVL/actions/runs/12468880329/job/34800937561#step:6:705

@janosg do you know who has access? The password I have for user appliedAI doesn't work any more (if it ever did, I'm not sure it's the same account as for the regular pypi?)

[janosg]

Hi @mdbenito, I don't have access yet but will try to get it.

Looking at the pyDVL page on pypi you are also listed as a maintainer with your personal account. Can you try to upload via that account for now?

[mdbenito]

Looking at the pyDVL page on pypi you are also listed as a maintainer with your personal account. Can you try to upload via that account for now?

Note that this runs in CI. I don't think it's a good idea to use a personal account for it. But also, this is their test repo and my credentials do not work.

[AdrianoKF]

We've attempted a password reset to see if the account was associated with any of the "official" info@ addresses, but to no avail. Did you by chance receive an email somewhere, @mdbenito?

Otherwise, there seems to be a predicament in how to move forward. The error message in the publish CI job indicates that 2FA needs to be enabled on the account, but that requires logging in manually first:

400 User 'appliedAI' does not have two-factor authentication
enabled. Please enable two-factor authentication before attempting to
upload to PyPI.

That also precludes moving the package out of the personal account, since this can only be done by a maintainer, and subsequently prevents a package with the same name from being re-published under a different maintainer (e.g., a yet-to-be-created org account for the Institute).

Getting a PyPI package name transferred is possible under PEP-541, but our scenario possibly does not qualify.

In any case, once the above has been settled, it is highly advisble to move to trusted publishing (for both PyPI and TestPyPI).

[mdbenito]

Hi @AdrianoKF,

thanks for looking into this.

We've attempted a password reset to see if the account was associated with any of the "official" info@ addresses, but to no avail. Did you by chance receive an email somewhere, @mdbenito?

I'm afraid not. If at all, that would have been to my aai address, which I no longer have access to. But I believe the test.pypi account must have been set up by @MischaPanch when he created pymetrius and set up package testing for other projects. Quite likely he created it with his aai address. If he did, one solution might be to ask IT to temporarily reactivate it for you guys.

In any case, once the above has been settled, it is highly advisable to move to trusted publishing (for both PyPI and TestPyPI).

I suppose for the time being we can deactivate testpypi. As to pypi, there is an admin account besides our own ones, so this problem won't happen there. Also, IIRC we already moved to trusted publishing, but I'll have to check