Skip to content

Conversation

@art1f1c3R
Copy link
Member

@art1f1c3R art1f1c3R commented Oct 3, 2025

Summary

This introduces debug information identifying when PyPI HTML content returns a JavaScript HTML page, to verify some other error or problem has not occurred.

Description of changes

When accessing PyPI HTML pages, Fastly, the CDN used by PyPI, may return a JavaScript Challenge to a GET request for a pypi.org HTML page. It is useful to know when this is the case, as this can cause some malware heuristics like CloserReleaseJoinDate, which rely on this HTML content for maintainer information, to be unable to perform their analysis. If it is known that they were unable to perform their analysis due to this JavaScript Challenge response, this can confirm that some other network error or mangled HTML was not returned and was not the cause of the failure.

Functions get_package_page and get_maintainer_profile_page now return None if a JavaScript Challenge is returned, as this HTML content cannot be analysed without rendering the JavaScript, which is not a capability of Macaron.

Checklist

  • I have reviewed the contribution guide.
  • My PR title and commits follow the Conventional Commits convention.
  • My commits include the "Signed-off-by" line.
  • I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
  • I have updated the relevant documentation, if applicable.
  • I have tested my changes and verified they work as expected.

Signed-off-by: Carl Flottmann <carl.flottmann@oracle.com>
@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Oct 3, 2025
@art1f1c3R art1f1c3R marked this pull request as ready for review October 3, 2025 04:27
@art1f1c3R art1f1c3R requested a review from behnazh-w as a code owner October 3, 2025 04:27
@art1f1c3R art1f1c3R merged commit 736dbf8 into main Oct 3, 2025
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OCA Verified All contributors have signed the Oracle Contributor Agreement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants