HTMLPage PEP 503 compliance

[uranusjr]

In pip._internal.index, links on a simple API page are found with the following:

1. a[href] values are collected
2. the filename part is parsed for metadata

But here’s how PEP 503 describes the a tags on an individual project page:

The text of the anchor tag MUST be the filename of the file and the href attribute MUST be an URL that links to the location of the file for download.

A linked file’s name is specified by the text, and there’s no guarantee that the link’s filename part should match it. So instead of parsing the link, pip should use the a tag’s text instead to parse for metadata.

Am I interpreting the PEP text correctly? If so, should pip be fixed to follow the spec, or should we just fix the PEP to say the URL’s filename part must match the text (since existing implementations all already do this anyway in order to work)?

[pradyunsg]

I feel like we should change the PEP. Can you bring this up on discuss.python.org?

[pfmoore]

Am I interpreting the PEP text correctly?

I believe so. I'd also noticed this oddity in the past.

If so, should pip be fixed to follow the spec, or should we just fix the PEP to say the URL’s filename part must match the text (since existing implementations all already do this anyway in order to work)?

When you say "existing implementations", I assume you mean "of PEP 508". Changing the PEP to say the text and URL filename must match seems like the simplest option (although a tiny, awkward, part of me that doesn't like giving pip special privileges wants to say "fix pip to follow the spec" :-))

[uranusjr]

Yes, I meant existing implementations of PEP 508. It’s not that difficult to fix this in pip (I believe the parsing happens only in one place in resolve.py index.py), so maybe we can just do that?

[uranusjr]

I took a stab at it in #6329.

[dstufft]

The PEP was originally written to mimic what pip / setuptools / PyPI already did. Pip differing from the PEP means it’s probsbly a bug in that PEP unless it’s new behavior since the PEP was written. It might still make sense to change pip though.