Better error handling for uploading signed files

[jmwoliver]

With a new user, we ran into an issue where they thought you signed a file by doing:

# Upload the wheel
$ twine upload package.whl

# Then upload the signed file
$ twine upload package.whl.asc

It's not obvious that this is incorrect since trying to upload only the signed file doesn't output anything:

$ twine upload package.whl.asc --verbose
Uploading distributions to https://upload.pypi.org/legacy/
INFO     username set by command options
INFO     password set by command options
INFO     username: __token__
INFO     password: <hidden>

It would be useful to instead output that a signed file must be uploaded with its corresponding distribution:

$ twine upload package.whl.asc --verbose
Uploading distributions to https://upload.pypi.org/legacy/
INFO     username set by command options
INFO     password set by command options
INFO     username: __token__
INFO     password: <hidden>
ERROR    InvalidDistribution: Cannot upload signed file by itself, must upload with its corresponding distribution.

[jmwoliver]

I'm also happy to take a look at this. I'm still looking around to find where this happens in the code, I'll try to open a PR once I get something working.

[di]

I think #932 is the right thing to do in the short term, but long term I think we should probably do this: pypi/warehouse#12629

[jmwoliver]

I agree, I think being able to upload signature files separately would be a nice feature. Some thoughts about it since you mentioned it:

PyPI doesn't allow uploading a distribution twice, even if it's been deleted, right? So only the person who uploaded that distribution could upload a signature file for it (and only if one doesn't already exist). Does that sound like the intended behavior?

[di]

PyPI doesn't allow uploading a distribution twice, even if it's been deleted, right? So only the person who uploaded that distribution could upload a signature file for it (and only if one doesn't already exist). Does that sound like the intended behavior?

Correct!

[bhrutledge]

Fixed in #932