Fix missing unverified URLs

tests/unit/forklift/test_legacy.py

@@ -3894,8 +3894,8 @@ def test_new_release_url_verified(
         release_db = (
             db_request.db.query(Release).filter(Release.project == project).one()
         )
-        assert release_db.urls_by_verify_status(expected) == {"Test": url}
-        assert not release_db.urls_by_verify_status(not expected)
+        assert release_db.urls_by_verify_status(verified=expected) == {"Test": url}
+        assert not release_db.urls_by_verify_status(verified=not expected)
 
     def test_new_publisher_verifies_existing_release_url(
         self,
@@ -3972,11 +3972,11 @@ def test_new_publisher_verifies_existing_release_url(
         release_db = (
             db_request.db.query(Release).filter(Release.project == project).one()
         )
-        assert release_db.urls_by_verify_status(True) == {
+        assert release_db.urls_by_verify_status(verified=True) == {
             "unverified_url": unverified_url,
             "verified_url": verified_url,
         }
-        assert not release_db.urls_by_verify_status(False)
+        assert not release_db.urls_by_verify_status(verified=False)
 
     @pytest.mark.parametrize(
         ("version", "expected_version"),

tests/unit/packaging/test_models.py

@@ -690,9 +690,88 @@ def test_urls_by_verify_status(self, db_session, release_urls):
             )
 
         for verified_status in [True, False]:
-            for label, url in release.urls_by_verify_status(verified_status).items():
+            for label, url in release.urls_by_verify_status(
+                verified=verified_status
+            ).items():
                 assert (label, url, verified_status) in release_urls
 
+    @pytest.mark.parametrize(
+        (
+            "homepage_metadata_url",
+            "download_metadata_url",
+            "extra_url",
+            "extra_url_verified",
+        ),
+        [
+            (
+                "https://homepage.com",
+                "https://download.com",
+                "https://example.com",
+                True,
+            ),
+            (
+                "https://homepage.com",
+                "https://download.com",
+                "https://homepage.com",
+                True,
+            ),
+            (
+                "https://homepage.com",
+                "https://download.com",
+                "https://homepage.com",
+                False,
+            ),
+            (
+                "https://homepage.com",
+                "https://download.com",
+                "https://download.com",
+                True,
+            ),
+            (
+                "https://homepage.com",
+                "https://download.com",
+                "https://download.com",
+                False,
+            ),
+        ],
+    )
+    def test_urls_by_verify_status_with_metadata_urls(
+        self,
+        db_session,
+        homepage_metadata_url,
+        download_metadata_url,
+        extra_url,
+        extra_url_verified,
+    ):
+        release = DBReleaseFactory.create(
+            home_page=homepage_metadata_url, download_url=download_metadata_url
+        )
+        db_session.add(
+            ReleaseURL(
+                release=release,
+                name="extra_url",
+                url=extra_url,
+                verified=extra_url_verified,
+            )
+        )
+
+        verified_urls = release.urls_by_verify_status(verified=True).values()
+        unverified_urls = release.urls_by_verify_status(verified=False).values()
+
+        # Homepage and Download URLs stored separately from the project URLs
+        # are considered unverified, unless they are equal to URLs present in
+        # `project_urls` that are verified.
+        if extra_url_verified:
+            assert extra_url in verified_urls
+            if homepage_metadata_url != extra_url:
+                assert homepage_metadata_url in unverified_urls
+            if download_metadata_url != extra_url:
+                assert download_metadata_url in unverified_urls
+        else:
+            assert extra_url in unverified_urls
+            assert homepage_metadata_url in unverified_urls
+            assert download_metadata_url in unverified_urls
+
     def test_acl(self, db_session):
         project = DBProjectFactory.create()
         owner1 = DBRoleFactory.create(project=project)

warehouse/locale/messages.pot

@@ -2807,7 +2807,7 @@ msgid "Verified details"
 msgstr ""
 
 #: warehouse/templates/includes/packaging/project-data.html:19
-#: warehouse/templates/includes/packaging/project-data.html:114
+#: warehouse/templates/includes/packaging/project-data.html:113
 msgid "Project links"
 msgstr ""
 
@@ -2835,50 +2835,50 @@ msgstr ""
 msgid "Open PRs:"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:93
+#: warehouse/templates/includes/packaging/project-data.html:92
 msgid "Maintainers"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:95
+#: warehouse/templates/includes/packaging/project-data.html:94
 msgid "Avatar for {username} from gravatar.com"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:111
+#: warehouse/templates/includes/packaging/project-data.html:110
 msgid "Unverified details"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:130
+#: warehouse/templates/includes/packaging/project-data.html:129
 msgid "Meta"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:135
+#: warehouse/templates/includes/packaging/project-data.html:134
 msgid "License:"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:142
-#: warehouse/templates/includes/packaging/project-data.html:148
+#: warehouse/templates/includes/packaging/project-data.html:141
+#: warehouse/templates/includes/packaging/project-data.html:147
 msgid "Author:"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:155
-#: warehouse/templates/includes/packaging/project-data.html:161
+#: warehouse/templates/includes/packaging/project-data.html:154
+#: warehouse/templates/includes/packaging/project-data.html:160
 #: warehouse/templates/pages/help.html:612
 msgid "Maintainer:"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:169
+#: warehouse/templates/includes/packaging/project-data.html:168
 msgid "Tags"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:181
+#: warehouse/templates/includes/packaging/project-data.html:180
 msgid "Requires:"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:188
+#: warehouse/templates/includes/packaging/project-data.html:187
 msgid "Provides-Extra:"
 msgstr ""
 
-#: warehouse/templates/includes/packaging/project-data.html:198
+#: warehouse/templates/includes/packaging/project-data.html:197
 #: warehouse/templates/pages/classifiers.html:16
 #: warehouse/templates/pages/classifiers.html:21
 #: warehouse/templates/pages/sitemap.html:39

warehouse/packaging/models.py

@@ -689,13 +689,32 @@ def urls(self):
 
         return _urls
 
-    def urls_by_verify_status(self, verified: bool):
-        matching_urls = {
+    def urls_by_verify_status(self, *, verified: bool):
+        verified_urls = {
             release_url.url
             for release_url in self._project_urls.values()  # type: ignore[attr-defined]
-            if release_url.verified == verified
+            if release_url.verified
         }
 
+        if verified:
+            matching_urls = verified_urls
+        else:
+            matching_urls = {
+                release_url.url
+                for release_url in self._project_urls.values()  # type: ignore[attr-defined] # noqa: E501
+                if not release_url.verified
+            }
+            # The Homepage and Download URLs in the release metadata are currently not
+            # verified, so we return them if the user requests non-verified URLs *and*
+            # they are not verified in `project_urls`.
+            matching_urls.update(
+                {
+                    url
+                    for url in (self.home_page, self.download_url)
+                    if url is not None and url not in verified_urls
+                }
+            )
+
         # Filter the output of `Release.urls`, since it has custom logic to de-duplicate
         # release URLs
         _urls = OrderedDict()
@@ -706,7 +725,7 @@ def urls_by_verify_status(self, verified: bool):
 
     @property
     def verified_user_name_and_repo_name(self):
-        for _, url in self.urls_by_verify_status(True).items():
+        for _, url in self.urls_by_verify_status(verified=True).items():
             try:
                 parsed = parse_url(url)
             except LocationParseError:

warehouse/templates/includes/packaging/project-data.html

@@ -15,10 +15,10 @@
 <div class="sidebar-section verified">
   <h3 class="sidebar-section__title">{% trans %}Verified details{% endtrans %}</h3>
   <small><i>These details have been verified by PyPI</i></small>
-  {% if release.urls_by_verify_status(True).values() | contains_valid_uris %}
+  {% if release.urls_by_verify_status(verified=True).values() | contains_valid_uris %}
     <h6>{% trans %}Project links{% endtrans %}</h6>
     <ul class="vertical-tabs__list">
-      {% for name, url in release.urls_by_verify_status(True).items() %}
+      {% for name, url in release.urls_by_verify_status(verified=True).items() %}
       {% if is_valid_uri(url) %}
       <li>
         <a class="vertical-tabs__tab vertical-tabs__tab--with-icon vertical-tabs__tab--condensed" href="{{ url }}" rel="nofollow">
@@ -88,7 +88,6 @@ <h6>{% trans %}GitHub Statistics{% endtrans %}</h6>
     </ul>
   </div>
   {% endif %}
-
   {% if maintainers %}
     <h6>{% trans %}Maintainers{% endtrans %}</h6>
     {% for maintainer in maintainers %}
@@ -110,10 +109,10 @@ <h6>{% trans %}Maintainers{% endtrans %}</h6>
 <div class="sidebar-section unverified">
   <h3 class="sidebar-section__title">{% trans %}Unverified details{% endtrans %}</h3>
   <small><i>These details have <b>not</b> been verified by PyPI</i></small>
-{% if release.urls_by_verify_status(False).values() | contains_valid_uris %}
+{% if release.urls_by_verify_status(verified=False).values() | contains_valid_uris %}
   <h6>{% trans %}Project links{% endtrans %}</h6>
   <ul class="vertical-tabs__list">
-    {% for name, url in release.urls_by_verify_status(False).items() %}
+    {% for name, url in release.urls_by_verify_status(verified=False).items() %}
     {% if is_valid_uri(url) %}
     <li>
       <a class="vertical-tabs__tab vertical-tabs__tab--with-icon vertical-tabs__tab--condensed" href="{{ url }}" rel="nofollow">