Skip to content

Validate release-file URL metadata#3014

Open
e-q wants to merge 1 commit into
python:mainfrom
e-q:release-file-url-validation
Open

Validate release-file URL metadata#3014
e-q wants to merge 1 commit into
python:mainfrom
e-q:release-file-url-validation

Conversation

@e-q
Copy link
Copy Markdown

@e-q e-q commented Jun 2, 2026

Description

  • Validate release-file sidecar URLs against the artifact URL they describe,
    including existing mismatched sidecars edited through unrelated metadata
    changes.
  • Reject new or changed non-HTTPS release-file URL values.
  • Apply the validation in model forms, DRF writes, and Tastypie writes.
  • Keep unchanged legacy HTTP URL rows editable while rejecting sidecar mismatches
    and new invalid values.
  • Add focused model and v1/v2 API regression tests for create and update paths.

Closes

Testing

  • Focused model and v1/v2 API regression tests for release-file URL validation,
    including create and update paths: passed.
  • Focused Ruff lint and format checks on touched files: passed.
  • Whitespace check: passed.
  • No migrations generated.

Reject new or changed non-HTTPS release-file URLs and reject sidecar
URLs that do not extend the artifact URL they describe.

Apply the validation in model forms, DRF writes, and Tastypie writes
while leaving unchanged legacy HTTP rows editable. Add model and API
regression coverage for create and update paths.
@e-q e-q requested a review from JacobCoffee as a code owner June 2, 2026 18:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: Release-file API accepts new HTTP python.org URLs Bug: Release-file sidecar URLs can reference different artifacts

1 participant