Email attributed to wrong project author

[SnoopJ]

Describe the bug

If a project defines multiple authors, and the first author does not list an email, PyPI will erroneously attribute the first email address in the metadata to that first author.

Expected behavior

PyPI should not attribute any email to the first author if one is not given.

To Reproduce

See an example here: https://pypi.org/project/sopel-iplookup/1.0.0/

The project's authorship metadata looks like:

[project]
authors = [                                                                                                                                                           
  { name="Dimitri Molenaars" },                                                                                                                                       
  { name="Elad Alfassa", email="elad@fedoraproject.org" },
  ...
]
...

Where there is no email listed for Dimitri Molenaars. On the PyPI project page linked above, however, the address elad@fedoraproject.org is attributed to this author.

The generated METADATA splits this information across the Author and Author-email fields, which may be related to the bug.

My Platform

N/A

Additional context

The closest open issue I can find is #9400, but that seems distinct.

[aaraney]

The order of the authors field could be taken to have meaning (i.e. 1st author, 2nd author, etc.) or it could just be an unordered list of authors. I think you could argue either way. I personally lean towards it being an unordered collection as there is no discriminator to denote authorship ordering.

[dgw]

Regardless of ordering, surely it is a bug to display one author's name with a different author's email address on the package index? And especially if the author list is considered unordered, displaying the email address of the first author in Author-Email with the name of the first author listed in Author makes even less sense.

This behavior is described exactly by a comment on #9400, in fact: One author without an email address associated is displayed as the name on PyPI, with the email address of another entry.

[miketheman]

Marking as blocked for same issue as noted in #16496 (comment)