Reachability

The user of the Package Index is solely responsible for being reachable by the Package Index maintainers for matters concerning projects that the user owns. In every case where contacting the user is necessary, the maintainers will try to do so at least three times, using the following means of contact:

• the e-mail address on file in the user’s profile on the Package Index;
• the e-mail address listed in the Author field for a given project uploaded to the Index; and
• any e-mail addresses found in the given project’s documentation on the Index or on the listed Home Page.

The maintainers stop trying to reach the user after six weeks.

Abandoned projects

A project is considered abandoned when ALL of the following are met:

• owner not reachable (see Reachability above);
• no releases within the past twelve months; and
• no activity from the owner on the project’s home page (or no home page listed).

All other projects are considered active.

Continued maintenance of an abandoned project

If a candidate appears willing to continue maintenance on an abandoned project, ownership of the name is transferred when ALL of the following are met:

• the project has been determined abandoned by the rules described above;
• the candidate is able to demonstrate their own failed attempts to contact the existing owner;
• the candidate is able to demonstrate improvements made on the candidate’s own fork of the project;
• the candidate is able to demonstrate why a fork under a different name is not an acceptable workaround; and
• the maintainers of the Package Index don’t have any additional reservations.

Under no circumstances will a name be reassigned against the wishes of a reachable owner.

Removal of an abandoned project

Projects are never removed from the Package Index solely on the basis of abandonment. Artifacts uploaded to the Package Index hold inherent historical value.

An abandoned project can be transferred to a new owner for purposes of reusing the name when ALL of the following are met:

• the project has been determined abandoned by the rules described above;
• the candidate is able to demonstrate their own failed attempts to contact the existing owner;
• the candidate is able to demonstrate that the project suggested to reuse the name already exists and meets notability requirements;
• the candidate is able to demonstrate why a fork under a different name is not an acceptable workaround;
• download statistics on the Package Index for the existing package indicate project is not being used; and
• the maintainers of the Package Index don’t have any additional reservations.

Name conflict resolution for active projects

The maintainers of the Package Index are not arbiters in disputes around active projects. There are many possible scenarios here, a non-exclusive list describing some real-world examples is presented below. None of the following qualify for package name ownership transfer:

1. User A and User B share project X. After some time they part ways and each of them wants to continue the project under name X.
2. User A owns a project X outside the Package Index. User B creates a package under the name X on the Index. After some time, User A wants to publish project X on the Index but realizes name is taken. This is true even if User A’s project X gains notability and the User B’s project X is not notable.
3. User A publishes project X to the Package Index. After some time User B proposes bug fixes to the project but no new release is published by User A. This is true even if User A agrees to publish a new version and later doesn’t, even if User B’s changes are merged to the source code repository for project X.

Again, the list above is not exclusive. The maintainers of the Package Index recommend users to get in touch with each other and solve the issue by respectful communication (see the PSF Code of Conduct [6]).

Invalid projects

A project published on the Package Index meeting ANY of the following is considered invalid and will be removed from the Index:

• project does not conform to Terms of Use;
• project is malware (designed to exploit or harm systems or users directly, to facilitate command-and-control attacks, or perform data exfiltration);
• project is spam (designed to advertise or solicit goods or services);
• project contains illegal content;
• project violates copyright, trademarks, patents, or licenses;
• project is name squatting (package has no functionality or is empty);
• project name, description, or content violates the Code of Conduct;
• project uses obfuscation to hide or mask functionality; or
• project is abusing the Package Index for purposes it was not intended.

The Package Index maintainers pre-emptively declare certain package names as unavailable for security reasons.

Intellectual property policy

It is the policy of Python Software Foundation and the Package Index maintainers to be appropriately responsive to claims of intellectual property infringement by third parties. It is not the policy of the Python Software Foundation nor the Package Index maintainers to pre-screen uploaded packages for any type of intellectual property infringement.

Possibly-infringing packages should be reported to legal@python.org and counsel to the Python Software Foundation will determine an appropriate response. A package can be removed or transferred to a new owner at the sole discretion of the Python Software Foundation to address a claim of infringement.

A project published on the Package Index meeting ANY of the following may be considered infringing and subject to removal from the Index or transferral to a new owner:

• project contains unlicensed copyrighted material from a third party, and is subject to a properly made claim under the DMCA;
• project uses a third party’s trademark in a way not covered by nominal or fair use guidelines;
• project clearly implicates a patented system or process, and is the subject of a complaint; or
• project is subject to an active lawsuit.

In the event of a complaint for intellectual property infringement, a copy of the complaint will be sent to the package owner. In some cases, action may be taken by the Package Index maintainers before the owner responds.

The role of the Python Software Foundation

The Python Software Foundation [7] is the non-profit legal entity that provides the Package Index as a community service.

The Package Index maintainers can escalate issues covered by this document for resolution by the Packaging Workgroup if the matter is not clear enough. Some decisions require additional judgement by the Board, especially in cases of Code of Conduct violations or legal claims. Recommendations made by the Board are sent to the Packaging Workgroup [8] for review.

The Packaging Workgroup has the final say in any disputes covered by this document and can decide to reassign or remove a project from the Package Index after careful consideration even when not all requirements listed here are met.