search

pypi / warehouse

The Python Package Index
https://pypi.org
Apache License 2.0
3.54k stars 952 forks source link

Verify `Home-page` and `Download-URL` URLs #16540

Closed facutuesca closed 2 weeks ago

facutuesca commented 3 weeks ago

What's the problem this feature will solve? Currently, only URLs specified via Project-URL are verified (as part of the work for https://github.com/pypi/warehouse/issues/8635).

However, the Home-page and Download-URL URLs are not verified. These are currently stored in the backend inside the Release object as plain strings, as opposed to the URLs from Project-URL which have their own type (ReleaseURL) and are stored in their own table along with their verification status.

Since these two URLs are not verified, they are always returned as unverified (via https://github.com/pypi/warehouse/pull/16531).

Describe the solution you'd like We can change the backend so that these two URLs are verified during upload, and their verification status is stored, similar to what we do for URLs in Project-URL fields.

/cc @di @woodruffw

miketheman commented 3 weeks ago

Since these two URLs are not verified, they are always returned as unverified (via #16531).

They are also no longer displayed at all.

facutuesca commented 3 weeks ago

They are also no longer displayed at all.

@miketheman That's what https://github.com/pypi/warehouse/pull/16531 fixes

di commented 3 weeks ago

Part of me wonders if we should just store these as ReleaseURLs on upload and stop special-casing the metadata fields... but I think that would probably complicate things when we return project_urls in the API results.

miketheman commented 3 weeks ago

They are also no longer displayed at all.

@miketheman That's what #16531 fixes

@facutuesca thanks, I confirmed the fix is there after a page cache re-render.