Use packaging.metadata to parse and validate upload metadata

requirements/deploy.txt

@@ -113,9 +113,8 @@ opentelemetry-api==1.20.0 \
     --hash=sha256:06abe351db7572f8afdd0fb889ce53f3c992dbf6f6262507b385cc1963e06983 \
     --hash=sha256:982b76036fec0fdaf490ae3dfd9f28c81442a33414f737abc687a32758cdcba5
     # via ddtrace
-packaging==23.2 \
-    --hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \
-    --hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7
+packaging @ https://github.com/dstufft/packaging/archive/refs/heads/warehouse-temporary.zip \
+    --hash=sha256:bd9c63b01eecceab4aef18f6e83976077d6b3a93fad49075fd3bd221a573d258
     # via gunicorn
 protobuf==4.24.3 \
     --hash=sha256:067f750169bc644da2e1ef18c785e85071b7c296f14ac53e0900e605da588719 \

requirements/docs-blog.txt

@@ -298,9 +298,8 @@ mkdocs-rss-plugin==1.8.0 \
     --hash=sha256:0fa13c99730c1d3ad9ec05102ff3d148c9849396c40b30be789339d38722fa8f \
     --hash=sha256:475bf4ea05cbe786af38d519b55352b1b2eb87597ad680fcbc309056864ed5c4
     # via -r requirements/docs-blog.in
-packaging==23.2 \
-    --hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \
-    --hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7
+packaging @ https://github.com/dstufft/packaging/archive/refs/heads/warehouse-temporary.zip \
+    --hash=sha256:bd9c63b01eecceab4aef18f6e83976077d6b3a93fad49075fd3bd221a573d258
     # via mkdocs
 paginate==0.5.6 \
     --hash=sha256:5e6007b6a9398177a7e1648d04fdd9f8c9766a1a945bceac82f1929e8c78af2d

requirements/docs-dev.txt

@@ -214,9 +214,8 @@ myst-parser==2.0.0 \
     --hash=sha256:7c36344ae39c8e740dad7fdabf5aa6fc4897a813083c6cc9990044eb93656b14 \
     --hash=sha256:ea929a67a6a0b1683cdbe19b8d2e724cd7643f8aa3e7bb18dd65beac3483bead
     # via -r requirements/docs-dev.in
-packaging==23.2 \
-    --hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \
-    --hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7
+packaging @ https://github.com/dstufft/packaging/archive/refs/heads/warehouse-temporary.zip \
+    --hash=sha256:bd9c63b01eecceab4aef18f6e83976077d6b3a93fad49075fd3bd221a573d258
     # via sphinx
 pygments==2.16.1 \
     --hash=sha256:13fc09fa63bc8d8671a6d247e1eb303c4b343eaee81d861f3404db2935653692 \

requirements/docs-user.txt

@@ -211,9 +211,8 @@ mkdocs-material-extensions==1.2 \
     --hash=sha256:27e2d1ed2d031426a6e10d5ea06989d67e90bb02acd588bc5673106b5ee5eedf \
     --hash=sha256:c767bd6d6305f6420a50f0b541b0c9966d52068839af97029be14443849fb8a1
     # via mkdocs-material
-packaging==23.2 \
-    --hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \
-    --hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7
+packaging @ https://github.com/dstufft/packaging/archive/refs/heads/warehouse-temporary.zip \
+    --hash=sha256:bd9c63b01eecceab4aef18f6e83976077d6b3a93fad49075fd3bd221a573d258
     # via mkdocs
 paginate==0.5.6 \
     --hash=sha256:5e6007b6a9398177a7e1648d04fdd9f8c9766a1a945bceac82f1929e8c78af2d

requirements/lint.txt

@@ -266,9 +266,8 @@ mypy-zope==1.0.1 \
     --hash=sha256:003953896629d762d7f497135171ad549df42a8ac63c1521a230832dd6f7fc25 \
     --hash=sha256:ffa291a7af9f5904ce9f0e56de44323a4476e28aaf0d68361b62b1b0e997d0b8
     # via -r requirements/lint.in
-packaging==23.2 \
-    --hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \
-    --hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7
+packaging @ https://github.com/dstufft/packaging/archive/refs/heads/warehouse-temporary.zip \
+    --hash=sha256:bd9c63b01eecceab4aef18f6e83976077d6b3a93fad49075fd3bd221a573d258
     # via black
 parsy==1.1.0 \
     --hash=sha256:25bd5cea2954950ebbfdf71f8bdaf7fd45a5df5325fd36a1064be2204d9d4c94 \

requirements/main.txt

@@ -1178,9 +1178,8 @@ orjson==3.9.7 \
     --hash=sha256:f738fee63eb263530efd4d2e9c76316c1f47b3bbf38c1bf45ae9625feed0395e \
     --hash=sha256:f9e01239abea2f52a429fe9d95c96df95f078f0172489d691b4a848ace54a476
     # via -r requirements/main.in
-packaging==23.2 \
-    --hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \
-    --hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7
+packaging @ https://github.com/dstufft/packaging/archive/refs/heads/warehouse-temporary.zip \
+    --hash=sha256:bd9c63b01eecceab4aef18f6e83976077d6b3a93fad49075fd3bd221a573d258
     # via
     #   -r requirements/main.in
     #   forcediphttpsadapter

requirements/tests.txt

@@ -186,9 +186,8 @@ mirakuru==2.5.1 \
     --hash=sha256:0a16f897841741f8cd784f790e54d74e61456ba36be9cb9de731b49e2e7a45dc \
     --hash=sha256:5a60d641fa92c8bfcd383f6e52f7a0bf3f081da0467fc6e3e6a3f6b3e3e47a7b
     # via pytest-postgresql
-packaging==23.2 \
-    --hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \
-    --hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7
+packaging @ https://github.com/dstufft/packaging/archive/refs/heads/warehouse-temporary.zip \
+    --hash=sha256:bd9c63b01eecceab4aef18f6e83976077d6b3a93fad49075fd3bd221a573d258
     # via pytest
 pluggy==1.3.0 \
     --hash=sha256:cf61ae8f126ac6f7c451172cf30e3e43d3ca77615509771b3a984a0730651e12 \

tests/unit/forklift/test_forms.py

@@ -0,0 +1,78 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import pretend
+import pytest
+
+from webob.multidict import MultiDict
+from wtforms.validators import ValidationError
+
+from warehouse.forklift.forms import UploadForm, _validate_pep440_version
+
+
+class TestValidation:
+    @pytest.mark.parametrize("version", ["1.0", "30a1", "1!1", "1.0-1", "v1.0"])
+    def test_validates_valid_pep440_version(self, version):
+        form, field = pretend.stub(), pretend.stub(data=version)
+        _validate_pep440_version(form, field)
+
+    @pytest.mark.parametrize("version", ["dog", "1.0.dev.a1"])
+    def test_validates_invalid_pep440_version(self, version):
+        form, field = pretend.stub(), pretend.stub(data=version)
+        with pytest.raises(ValidationError):
+            _validate_pep440_version(form, field)
+
+
+class TestUploadForm:
+    @pytest.mark.parametrize(
+        "data",
+        [
+            # Test for singular supported digests
+            {"filetype": "sdist", "md5_digest": "bad"},
+            {"filetype": "bdist_wheel", "pyversion": "3.4", "md5_digest": "bad"},
+            {"filetype": "sdist", "sha256_digest": "bad"},
+            {"filetype": "bdist_wheel", "pyversion": "3.4", "sha256_digest": "bad"},
+            {"filetype": "sdist", "blake2_256_digest": "bad"},
+            {"filetype": "bdist_wheel", "pyversion": "3.4", "blake2_256_digest": "bad"},
+            # Tests for multiple digests passing through
+            {
+                "filetype": "sdist",
+                "md5_digest": "bad",
+                "sha256_digest": "bad",
+                "blake2_256_digest": "bad",
+            },
+            {
+                "filetype": "bdist_wheel",
+                "pyversion": "3.4",
+                "md5_digest": "bad",
+                "sha256_digest": "bad",
+                "blake2_256_digest": "bad",
+            },
+        ],
+    )
+    def test_full_validate_valid(self, data):
+        form = UploadForm(MultiDict(data))
+        form.full_validate()
+
+    @pytest.mark.parametrize(
+        "data",
+        [
+            {"filetype": "sdist", "pyversion": "3.4"},
+            {"filetype": "bdist_wheel"},
+            {"filetype": "bdist_wheel", "pyversion": "3.4"},
+        ],
+    )
+    def test_full_validate_invalid(self, data):
+        form = UploadForm(MultiDict(data))
+        with pytest.raises(ValidationError):
+            form.full_validate()