From 37a0a5183ab9431206d34a7762042c869d4e011e Mon Sep 17 00:00:00 2001 From: Amine Date: Tue, 3 Jun 2025 21:29:43 +0100 Subject: [PATCH 1/2] fix(pypi): update get_maintainers_of_package to avoid request blocking Signed-off-by: Amine --- src/macaron/slsa_analyzer/package_registry/pypi_registry.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/macaron/slsa_analyzer/package_registry/pypi_registry.py b/src/macaron/slsa_analyzer/package_registry/pypi_registry.py index 13156f7f7..3c5da1e0b 100644 --- a/src/macaron/slsa_analyzer/package_registry/pypi_registry.py +++ b/src/macaron/slsa_analyzer/package_registry/pypi_registry.py @@ -320,11 +320,10 @@ def get_package_page(self, package_name: str) -> str | None: str | None The package main page. """ - url = os.path.join(self.registry_url, "project", package_name) + url = f"https://pypi.org/project/{package_name}/" response = send_get_http_raw(url) if response: - html_snippets = response.content.decode("utf-8") - return html_snippets + return response.text return None def get_maintainers_of_package(self, package_name: str) -> list | None: From 630cb8cb5f0b8576a209bbc4938a298c4147298b Mon Sep 17 00:00:00 2001 From: Amine Date: Tue, 10 Jun 2025 21:51:50 +0100 Subject: [PATCH 2/2] chore(pypi): add comment to clarify handling of trailing slash in URLs Signed-off-by: Amine --- .../slsa_analyzer/package_registry/pypi_registry.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/macaron/slsa_analyzer/package_registry/pypi_registry.py b/src/macaron/slsa_analyzer/package_registry/pypi_registry.py index 3c5da1e0b..f0cfcfbc3 100644 --- a/src/macaron/slsa_analyzer/package_registry/pypi_registry.py +++ b/src/macaron/slsa_analyzer/package_registry/pypi_registry.py @@ -320,10 +320,12 @@ def get_package_page(self, package_name: str) -> str | None: str | None The package main page. """ - url = f"https://pypi.org/project/{package_name}/" + # Important: trailing '/' avoids JS-based redirect; ensures Macaron can access the page directly + url = urllib.parse.urljoin(self.registry_url, f"project/{package_name}/") response = send_get_http_raw(url) if response: - return response.text + html_snippets = response.content.decode("utf-8") + return html_snippets return None def get_maintainers_of_package(self, package_name: str) -> list | None: @@ -359,7 +361,8 @@ def get_maintainer_profile_page(self, username: str) -> str | None: str | None The profile page. """ - url = os.path.join(self.registry_url, "user", username) + # Important: trailing '/' avoids JS-based redirect; ensures Macaron can access the page directly + url = urllib.parse.urljoin(self.registry_url, f"user/{username}/") response = send_get_http_raw(url, headers=None) if response: html_snippets = response.content.decode("utf-8")