Add data-dist-info-metadata to Simple HTML API

jobselko · jobselko · commit e4b8616ad9fd · 2025-12-18T13:00:12.000+01:00
diff --git a/pulp_python/app/utils.py b/pulp_python/app/utils.py
@@ -41,6 +41,8 @@
 </html>
 """
 
+# TODO in the future: data-requires-python (PEP 503)
+# TODO now: strip empty lines
 simple_detail_template = """<!DOCTYPE html>
 <html>
   <head>
@@ -50,7 +52,11 @@
   <body>
     <h1>Links for {{ project_name }}</h1>
     {% for pkg in project_packages %}
-      <a href="{{ pkg.url }}#sha256={{ pkg.sha256 }}" rel="internal" {% if pkg.provenance -%}
+      <a href="{{ pkg.url }}#sha256={{ pkg.sha256 }}"
+        {% if pkg.metadata_sha256 %}
+          data-dist-info-metadata="sha256={{ pkg.metadata_sha256 }}"
+        {% endif %}
+      rel="internal" {% if pkg.provenance -%}
       data-provenance="{{ pkg.provenance }}"{% endif %}>{{ pkg.filename }}</a><br/>
     {% endfor %}
   </body>
diff --git a/pulp_python/tests/functional/api/test_pypi_apis.py b/pulp_python/tests/functional/api/test_pypi_apis.py
@@ -6,9 +6,6 @@
 
 from pulp_python.tests.functional.constants import (
     PYPI_SERIAL_CONSTANT,
-    PYTHON_SM_PROJECT_SPECIFIER,
-    PYTHON_SM_FIXTURE_RELEASES,
-    PYTHON_SM_FIXTURE_CHECKSUMS,
     PYTHON_MD_PROJECT_SPECIFIER,
     PYTHON_MD_PYPI_SUMMARY,
     PYTHON_EGG_FILENAME,
@@ -17,8 +14,6 @@
     SHELF_PYTHON_JSON,
 )
 
-from pulp_python.tests.functional.utils import ensure_simple
-
 
 PYPI_LAST_SERIAL = "X-PYPI-LAST-SERIAL"
 
@@ -213,22 +208,6 @@ def test_simple_redirect_with_publications(
     assert response.url == str(urljoin(pulp_content_url, f"{distro.base_path}/simple/"))
 
 
-@pytest.mark.parallel
-def test_simple_correctness_live(
-    python_remote_factory, python_repo_with_sync, python_distribution_factory
-):
-    """Checks that the simple api on live distributions are correct."""
-    remote = python_remote_factory(includes=PYTHON_SM_PROJECT_SPECIFIER)
-    repo = python_repo_with_sync(remote)
-    distro = python_distribution_factory(repository=repo)
-    proper, msgs = ensure_simple(
-        urljoin(distro.base_url, "simple/"),
-        PYTHON_SM_FIXTURE_RELEASES,
-        sha_digests=PYTHON_SM_FIXTURE_CHECKSUMS,
-    )
-    assert proper is True, msgs
-
-
 @pytest.mark.parallel
 def test_pypi_json(python_remote_factory, python_repo_with_sync, python_distribution_factory):
     """Checks the data of `pypi/{package_name}/json` endpoint."""
diff --git a/pulp_python/tests/functional/api/test_pypi_simple_api.py b/pulp_python/tests/functional/api/test_pypi_simple_api.py
@@ -8,12 +8,16 @@
     PYTHON_EGG_FILENAME,
     PYTHON_EGG_SHA256,
     PYTHON_EGG_URL,
+    PYTHON_SM_FIXTURE_CHECKSUMS,
+    PYTHON_SM_FIXTURE_RELEASES,
     PYTHON_SM_PROJECT_SPECIFIER,
     PYTHON_WHEEL_FILENAME,
     PYTHON_WHEEL_METADATA_SHA256,
     PYTHON_WHEEL_SHA256,
     PYTHON_WHEEL_URL,
+    PYTHON_XS_FIXTURE_CHECKSUMS,
 )
+from pulp_python.tests.functional.utils import ensure_simple
 
 API_VERSION = "1.1"
 
@@ -22,6 +26,63 @@
 PYPI_SIMPLE_V1_JSON = "application/vnd.pypi.simple.v1+json"
 
 
+@pytest.mark.parallel
+def test_simple_html_index_api(
+    python_remote_factory, python_repo_with_sync, python_distribution_factory
+):
+    remote = python_remote_factory(includes=PYTHON_SM_PROJECT_SPECIFIER)
+    repo = python_repo_with_sync(remote)
+    distro = python_distribution_factory(repository=repo)
+
+    url = urljoin(distro.base_url, "simple/")
+    headers = {"Accept": PYPI_SIMPLE_V1_HTML}
+
+    response = requests.get(url, headers=headers)
+    assert response.headers["Content-Type"] == PYPI_SIMPLE_V1_HTML
+    assert response.headers["X-PyPI-Last-Serial"] == str(PYPI_SERIAL_CONSTANT)
+
+    proper, msgs = ensure_simple(
+        url, PYTHON_SM_FIXTURE_RELEASES, sha_digests=PYTHON_SM_FIXTURE_CHECKSUMS
+    )
+    assert proper, f"Simple API validation failed: {msgs}"
+
+
+def test_simple_html_detail_api(
+    delete_orphans_pre,
+    monitor_task,
+    python_bindings,
+    python_content_factory,
+    python_distribution_factory,
+    python_repo_factory,
+):
+    content_1 = python_content_factory(PYTHON_WHEEL_FILENAME, url=PYTHON_WHEEL_URL)
+    content_2 = python_content_factory(PYTHON_EGG_FILENAME, url=PYTHON_EGG_URL)
+    body = {"add_content_units": [content_1.pulp_href, content_2.pulp_href]}
+
+    repo = python_repo_factory()
+    monitor_task(python_bindings.RepositoriesPythonApi.modify(repo.pulp_href, body).task)
+    distro = python_distribution_factory(repository=repo)
+
+    url = f'{urljoin(distro.base_url, "simple/")}shelf-reader'
+    headers = {"Accept": PYPI_SIMPLE_V1_HTML}
+
+    response = requests.get(url, headers=headers)
+    assert response.headers["Content-Type"] == PYPI_SIMPLE_V1_HTML
+    assert response.headers["X-PyPI-Last-Serial"] == str(PYPI_SERIAL_CONSTANT)
+
+    metadata_sha_digests = {
+        PYTHON_WHEEL_FILENAME: PYTHON_WHEEL_METADATA_SHA256,
+        PYTHON_EGG_FILENAME: None,  # egg files should not have metadata
+    }
+    proper, msgs = ensure_simple(
+        urljoin(distro.base_url, "simple/"),
+        {"shelf-reader": [PYTHON_WHEEL_FILENAME, PYTHON_EGG_FILENAME]},
+        sha_digests=PYTHON_XS_FIXTURE_CHECKSUMS,
+        metadata_sha_digests=metadata_sha_digests,
+    )
+    assert proper, f"Simple API validation failed: {msgs}"
+
+
 @pytest.mark.parallel
 def test_simple_json_index_api(
     python_remote_factory, python_repo_with_sync, python_distribution_factory
diff --git a/pulp_python/tests/functional/utils.py b/pulp_python/tests/functional/utils.py
@@ -4,7 +4,29 @@
 from lxml import html
 
 
-def ensure_simple(simple_url, packages, sha_digests=None):
+def _validate_metadata_sha_digest(link, filename, metadata_sha_digests):
+    """
+    Validate data-dist-info-metadata attribute for a release link.
+    """
+    data_dist_info_metadata = link.get("data-dist-info-metadata")
+
+    if expected_metadata_sha := metadata_sha_digests.get(filename):
+        expected_attr = f"sha256={expected_metadata_sha}"
+        if data_dist_info_metadata != expected_attr:
+            return (
+                f"\nFile {filename} has incorrect data-dist-info-metadata: "
+                f"expected '{expected_attr}', got '{data_dist_info_metadata}'"
+            )
+    else:
+        if data_dist_info_metadata:
+            return (
+                f"\nFile {filename} should not have data-dist-info-metadata "
+                f"but has '{data_dist_info_metadata}'"
+            )
+    return ""
+
+
+def ensure_simple(simple_url, packages, sha_digests=None, metadata_sha_digests=None):
     """
     Tests that the simple api at `url` matches the packages supplied.
     `packages`: dictionary of form {package_name: [release_filenames]}
@@ -28,6 +50,9 @@ def explore_links(page_url, page_name, links_found, msgs):
                 links_found[link.text] = True
                 if link.get("href"):
                     legit_found_links.append(link.get("href"))
+                    # Check metadata SHA digest if provided
+                    if metadata_sha_digests and page_name == "release":
+                        msgs += _validate_metadata_sha_digest(link, link.text, metadata_sha_digests)
                 else:
                     msgs += f"\nFound {page_name} link without href {link.text}"
             else:
