ARTIFACTORY: How to mark a pypi package in a remote repository as yanked?

Artifactory supports yanking packages, or marking a version as deleted so that it will be ignored by installers. This is mainly useful when your project or the system have restrictions in using particular versions. 

If the required package is available in an upstream repository, then Artifactory will be downloading it using a remote repository.  Since the remote repository caches files for a limited time, the changes won’t be retained after the metadata cache time expires. Hence it is recommended to use the local repository to “add the yanked files”.

Steps to mark a pypi package as yanked

1. Create a virtual repository, say, test-pypi and aggregate it with the remote repository in question, here ‘test-pypi-remote’ and a local repository say, ‘test-pypi-local’.
2. Now download the pypi package which needs to be yanked using the virtual repository.
3. You could find that it is cached under the remote repository cache “test-pypi-remote-cache”.
4. Select the package and click the Properties tab.
5. Click Add Property. Enter pypi.yanked as the property name, and a description as the property value- for example, "bad version".
6. Then do a right click on the package and  copy this file to the local repository “test-pypi-local”
7. Do zap cache on the virtual repo “test-pypi”
8. Now, download the package again using the virtual repository, and you will see that the package is marked as yanked and if you do not specify a version, another version will be downloaded.

Reference Snippets

Here, we are going to see an example with the package ‘jq’, where you want to yank the latest version 1.5.0. 

1. Download latest version of the pypi package “jq” using the virtual repo “test-pypi”

$ pip download jq --platform=manylinux1_x86_64 --no-deps
Looking in indexes: http://admin:****@localhost/artifactory/api/pypi/test-pypi/simple
Collecting jq
  Downloading http://localhost/artifactory/api/pypi/test-pypi/packages/packages/18/fa/560202b0ec4d0b49d312679797536207406862c9c8f50a82e4ad8b4664d2/jq-1.5.0.tar.gz (2.7 MB)━━━━━━━━━━━━━━━━━━━━━━━━ 2.7/2.7 MB 719.2 kB/s eta 0:00:00  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Saved ./jq-1.5.0.tar.gz

2. Mark the downloaded package as yanked


3. Copy the package to the local repository test-pypi-local



4. Download the latest package again.

$ pip download jq --platform=manylinux1_x86_64 --no-deps
Looking in indexes: http://admin:****@localhost/artifactory/api/pypi/test-pypi/simple
Collecting jq
  Downloading http://localhost/artifactory/api/pypi/test-pypi/packages/packages/6e/b1/44632550d22e1a151273ad0555c8149656c6fd019f5fad0b9cd789059a2b/jq-1.4.1.tar.gz (2.7 MB) ---2.7/2.7 MB 913.3 kB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Saved ./jq-1.4.1.tar.gz
Successfully downloaded jq

NOTE: Now the latest version got downloaded is jq-1.4.1.tar.gz instead of jq-1.5.0.tar.gz

5. If you try to specify and download the yanked version, it will show you a warning.

$ pip download jq==1.5.0 --platform=manylinux1_x86_64 --no-deps
Looking in indexes: http://admin:****@localhost/artifactory/api/pypi/test-pypi/simple
Collecting jq==1.5.0
  Downloading http://localhost/artifactory/api/pypi/test-pypi/18/fa/560202b0ec4d0b49d312679797536207406862c9c8f50a82e4ad8b4664d2/jq-1.5.0.tar.gz (2.7 MB)━━━━━━━━━━━━━━━2.7/2.7 MB 821.9 kB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
WARNING: The candidate selected for download or install is a yanked version: 'jq' candidate (version 1.5.0 at http://localhost/artifactory/api/pypi/test-pypi/18/fa/560202b0ec4d0b49d312679797536207406862c9c8f50a82e4ad8b4664d2/jq-1.5.0.tar.gz#sha256=47695d97c300b6a5c36731d9cab12f6bf1cee35f01b3374063b87f868f2131d1 (from http://localhost/artifactory/api/pypi/test-pypi/simple/jq/) (requires-python:>=3.5))
Reason for being yanked: "bad version"
Saved ./jq-1.5.0.tar.gz

NOTE: Tested and verified on Artifactory 7.41.x, 7.84.x and higher.

Reference:
https://peps.python.org/pep-0592/
https://jfrog.com/help/r/jfrog-artifactory-documentation/pypi-repositories