pypi / warehouse

The Python Package Index
https://pypi.org
Apache License 2.0
3.6k stars 964 forks source link

Be slightly more strict in checking for distribution file contents #17107

Closed ewdurbin closed 3 days ago

ewdurbin commented 4 days ago

This improves our validation of distribution file contents by being more precise in checking for sdist's to have one top level directory, this allows us to be more precise in checking for PKG-INFO and License-File files that should exist in a given sdist.

Also improves error messages for users if an invalid distribution is attempted to be uploaded.

ewdurbin commented 4 days ago

In an ideal world, the top-level directory name inside an sdist would have consistent normalization like wheels to enable us to skip the heuristic that's applied here with os.path.commonprefix, but the upshot of that is that it does start to enforce the "one top level directory" spec for sdists.