Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Serve provenance without requiring the Accept header #17084

Open
simonw opened this issue Nov 15, 2024 · 1 comment
Open

Serve provenance without requiring the Accept header #17084

simonw opened this issue Nov 15, 2024 · 1 comment
Labels
feature request requires triaging maintainers need to do initial inspection of issue

Comments

@simonw
Copy link

simonw commented Nov 15, 2024

What's the problem this feature will solve?

When I visit this page in my browser:

https://pypi.org/integrity/pydantic/1.10.19/pydantic-1.10.19-cp310-cp310-macosx_11_0_arm64.whl/provenance

I get this:

{"message":"Request not acceptable"}

To see the content of that page I have to send an accept header like this:

curl -s \
  -H 'accept: application/vnd.pypi.integrity.v1+json' https://pypi.org/integrity/pydantic/1.10.19/pydantic-1.10.19-cp310-cp310-macosx_11_0_arm64.whl/provenance \
  | jq

Describe the solution you'd like

I'd prefer it if the page served me JSON without me having to send that accept header. That way I could explore and understand the API without needing to fire up a terminal or a custom HTTP client.

Additional context

Here's the implementation:

def provenance_for_file(file: File, request: Request):
# Determine our response content-type. For the time being, only the JSON
# type is accepted.
request.response.content_type = _select_content_type(request)
if request.response.content_type != MIME_PYPI_INTEGRITY_V1_JSON:
return HTTPNotAcceptable(json={"message": "Request not acceptable"})

@simonw simonw added feature request requires triaging maintainers need to do initial inspection of issue labels Nov 15, 2024
@simonw
Copy link
Author

simonw commented Nov 15, 2024

This is covered by the documentation here (I didn't think to look so I dug around in the source code instead): https://docs.pypi.org/api/integrity/#get-provenance-for-file

Although the docs say:

Example JSON request (default if no Accept header is passed)

Which I think is incorrect documentation - you have to pass the Accept header to see the format shown in that example.

@simonw simonw changed the title Serve attestations without requiring the Accept header Serve provenance without requiring the Accept header Nov 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature request requires triaging maintainers need to do initial inspection of issue
Projects
None yet
Development

No branches or pull requests

1 participant