← Back to issue list

Inspectors contain valid URL placeholders

View original Github issue

Metadata

Project
fetch-service
Number
#364
Type
issue
State
open
Author
cmatsuoka
Labels
—
Created
Updated
Closed
—

Current evaluation

Hard-coded PyPI URL matchers remain in package inspectors; the requested repository-wide placeholder audit is still open, unlabeled and awaiting maintainer triage.

Suggested action: needs triage

Reason: inspectors/pip/urls.go still hard-codes files.pythonhosted.org and explicitly says "using PyPI URLs as placeholders," while the reported wheel request was approved. Although changelog entry #368 records external-origin requests being marked unknown, the matchers remain; with no labels or substantive maintainer response and an explicit need to audit all inspectors, scope and acceptance criteria need triage.

Evaluated by: mr-cal-bot

Impact: 58 Quick Win: 15 Complexity: 60 Confidence: 90 Actionability: 64

Issue body

### Bug Description Certain inspectors such as the Python wheel inspector still contain valid URL placeholders. All inspectors must be audited and placeholders removed. ### To Reproduce Set up the fetch service and download a wheel from PyPI. ### Relevant log output ```shell 2025/03/17 10:14:43.742096 INFO : [sessionid] request approved: GET https://files.pythonhosted.org:443/packages/7e/d4/7ebdbd03970677812aac39c869717059dbb71a4cfc033ca6e5221787892c/click-8.1.8-py3-none-any.whl ```

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 58
Quick Win: 15
Complexity: 60
Confidence: 90
Actionability: 64
needs triage Hard-coded PyPI URL matchers remain in package inspectors; the requested repository-wide placeholder audit is still open, unlabeled and awaiting maintainer triage.
stealth/space-bunny-alpha
Impact: 47
Quick Win: 16
Complexity: 50
Confidence: 92
Actionability: 68
needs triage Python wheel, sdist, metadata and index inspectors still use default PyPI URL matchers, with an explicit placeholder FIXME; similar unsupported-origin matches remain across package inspectors.
qwen/qwen3.6-35b-a3b
Impact: 50
Quick Win: 30
Staleness: 95
Complexity: 40
Confidence: 70
Support Request: 10
close stale Inspectors contain valid URL placeholders that are being approved by the fetch service. Issue is stale with no maintainer engagement, labels, or assignee.

Update history

Date Change
created

Related work

  • Related To: fetch-service#368 (confidence 85%)

    Its changelog entry introduces unknown handling for external origins, which overlaps the placeholder behavior, but does not show that the hard-coded matchers were removed.

Related issues

No related issues found above the similarity threshold.