disable file deletion

[ewdurbin]

Originally reported by: Mike Bayer (Bitbucket: zzzeek, GitHub: zzzeek)

---

the "delete" feature of a file now does something completely different than it has done for many years, because that filename is permanently stored in the pypi system and can never be replaced. Users who have for years known they can just press "remove" on a package and try their upload again are in for a surprise now that it's been turned off. The flow of "Removal" should be highly modified so that it is clear that nothing is really being "deleted" here, the filename is forever and it is simply being taken off the list as something that can be downloaded.

---

• Bitbucket: https://bitbucket.org/pypa/pypi/issue/252

[ewdurbin]

Original comment by Will Bond (Bitbucket: wbond, GitHub: wbond):

---

It seems that removing a release file is now "dangerous" and should have that big huge red warning that deleting a package does. Once a release file is deleted, it is gone forever and can't ever be reposted.

[ewdurbin]

Original comment by Armin Ronacher (Bitbucket: mitsuhiko, GitHub: mitsuhiko):

---

It should not be possible in the first place to delete files if you cannot put them back.

I have three proposals:

1. Remove that button
2. Do not delete the file, hide it, add an unhide button
3. Delete the file, but keep the checksum, allow reupload if it matches

To be frank, I think only option 2 is a possible one. Imagine you accidentally delete a release and your build script is not stable, so now your user's pinned dependencies are broken forever.

The current behavior is terrible will cause problems. I can't be the only person that accidentally deleted the wrong releases in the past.

[ewdurbin]

Original comment by Donald Stufft (Bitbucket: dstufft, GitHub: dstufft):

---

I think number 2 is reasonable. I can add that.

[ewdurbin]

Original comment by Mike Bayer (Bitbucket: zzzeek, GitHub: zzzeek):

---

+1 for #2

[di]

The new PyPI at pypi.org still has the ability to delete releases and release files, but it has some mechanisms to make sure this is not done accidentally or unintentionally:

• big red buttons and danger box
• confirm modal
• user must type the project name or release version to confirm

The new PyPI also has no notion of "hiding" a release, but adding the ability to "deprecate" a release is being considered in pypi/warehouse#345.