warehouse: Friendlier token "username", prefix

[woodruffw]

Changes the token username to __token__ and the prefix to pypi-.

Preserves the original @token username and pypi: token prefix for backwards compatibility during the beta.

Closes #6287.

[woodruffw]

cc @di @ewdurbin

[ewdurbin]

Isn't $ as a username prefix going to cause headaches for some shells?

Aside from that I'd just like to see us file an issue preemptively of merge and reference it for removal of backward compatibility for beta "grammar" of these.

[woodruffw]

Isn't $ as a username prefix going to cause headaches for some shells?

Yeah, hadn't thought of that. I'll change it to ^; that shouldn't interfere with most things.

Aside from that I'd just like to see us file an issue preemptively of merge and reference it for removal of backward compatibility for beta "grammar" of these.

👍

[woodruffw]

Alright, opened #6345 to track removal.

[pradyunsg]

Caret (^) is an escape character in Windows batch scripts.

https://stackoverflow.com/questions/20342828/what-does-symbol-mean-in-batch-script

Is there a reason that we aren't using the "token" username here?

[woodruffw]

Caret (^) is an escape character in Windows batch scripts.

😞

Maybe 'token or +token?

Is there a reason that we aren't using the "token" username here?

I listed some reasons in this comment: #6345 (comment)

[graingert]

I had a look at the regex used in warehouse for validating usernames and came up with some potentially nicer options:

_token, -token, .token
token_, token-, token.

and my personal favorite, because dunder magic has that feel of "this is a name specifically reserved for a specific use by PyPI"
__token__

[di]

FYI, 'token and -token would both require quoting in YAML as well.

[woodruffw]

I like __token__! Will update the PR to reflect it while we continue to discuss.

[ewdurbin]

Looks good to me, any concerns with the selected prefix or username of __token__ @di @dstufft ?

[ZaxR]

Just made the change, and __token__ is working well with Travis, but just an FYI that the hyphen in the token (pypi-xxx...) still needs to be escaped for Travis.