Skip to content

Non-http(s) URLs used in project_urls are rejected as invalid #10198

Closed as not planned

Description

@WhyNotHugo

Describe the bug

I recently updated one of my packages to have a few project_urls, including website, issue tracker and IRC. For the latter, I used a URL in the format of irc://example.com/#my-channel, which Firefox and other tools understand.

Expected behavior

Uploading the package should have worked find.

To Reproduce

Try uploading a package with:

project_urls={
    "Chat": "irc://example.com/#my-channel",
    # ...
},

My Platform

I used twine to upload the package via GitHub Actions.

I've pinpointed the issue down to this snippet, which tries to validate the URL as http or https, even in cases where it's a different schema.

https://github.com/pypa/warehouse/blob/30a6733a3f4b91594ead39971277491a8b4bee67/warehouse/forklift/legacy.py#L337-L338

Additional context

I suspect that the validation is mostly an oversight of not taking this edge-case in mind; I can't imagine there was a strong reason to disallow non-https URLs.

While I think there's definitely value in allowing them, in case there's a strong sentiment against this, it would at least make sense for the error message to be clearer. It was quite tricky for me to figure out exactly what the error was, since right now the validation response just says Use valid URL., without even indicating which URL is wrong or in what way.

Activity

  1. di commented on Feb 18, 2022

    @di
    Member

    I think I'd prefer for us to stick with valid HTTP/HTTPS links, since these go in the sidebar for the project, and other protocols are somewhat exotic.

    I'd be in favor of updating the error message here to indicate that this needs to be a valid HTTP/HTTPS URL.

  2. WhyNotHugo commented on Feb 18, 2022

    @WhyNotHugo
    Author
  3. di commented on Feb 18, 2022

    @di
    Member

    Unfortunately that would require an update to the Core metadata spec

    Which I'm now noting says:

    A string containing a browsable URL for the project and a label for it, separated by a comma.

    Which IMO reinforces that this must remain HTTP/HTTPS.

  4. WhyNotHugo commented on Feb 18, 2022

    @WhyNotHugo
    Author
  5. dstufft commented on May 23, 2023

    @dstufft
    Member

    I'm going to close this. I think that keeping these as HTTP(S) urls is the path we're going to go for here, and if people feel strongly it's probably best to discuss it on discuss.python.org.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions