Re: Anubis challenge on texlive.info pretest mirror breaks TeX Live Utility

> On 20 Feb 2026, at 04:42, Adam R. Maxwell <[email protected]> wrote:
> 
>> On Feb 19, 2026, at 16:16 , Bruno Voisin <[email protected]> wrote:
>> 
>> Indeed, based on the math.utah.edu <http://math.utah.edu/> log above, TLU does the year check before calling tlmgr.
> 
> Yes, it's a consistency check so I can tell the user if there's a local/remote version mismatch. The alternatives are trying to parse tlmgr's output (which can change), or just throwing up a generic "Update listing failed" alert.
> 
> No idea how tlmgr bypasses the bot checker. I suppose I'll have to learn, as the enshittification of the internet continues apace.


> On 20 Feb 2026, at 08:12, Max Chernoff <[email protected]> wrote:
> 
> On Thu, 2026-02-19 at 19:42 -0800, Adam R. Maxwell via tex-live wrote
>> No idea how tlmgr bypasses the bot checker. I suppose I'll have to
>> learn, as the enshittification of the internet continues apace.
> 
> The default configuration of Anubis only blocks requests with
> "Mozilla/5.0" in their user-agent [1], so tlmgr doesn't need to do
> anything specific to bypass it. But perhaps Norbert has adjusted the
> configuration for texlive.info, in which case he might have to explictly
> whitelist TLU.
> 
> [1]: Which covers not just Firefox, but _all_ browsers due to weird
>     historical reasons
> 
>         https://en.wikipedia.org/wiki/User-Agent_header#Format_for_human-operated_web_browsers


For TeX Live Utility, TLMDatabase.m lines 90 ff say

        // get a user-agent for the default URL, to avoid hardcoding any framework versions
        WebView *wv = [[WebView alloc] initWithFrame:NSMakeRect(0, 0, 1, 1)];
        _userAgent = [[wv userAgentForURL:[[TLMEnvironment currentEnvironment] defaultServerURL]] copy];
        [wv release];

so I imagine Mozilla/5.0 comes from WebKit's userAgentForURL:

https://developer.apple.com/documentation/webkit/webview-swift.class/useragent(for:)?language=objc

As for tlmgr, trying to dig into the code: tlmgr does a year check too, lines 7549 ff

  # we allow a range of years to be specified by the remote tlpdb
  # for which it might work.
  # the lower limit is TLPDB->config_minrelease
  # the upper limit is TLPDB->config_release
[...]
  my $texlive_release = $remotetlpdb->config_release;
  my $texlive_minrelease = $remotetlpdb->config_minrelease;
[...]

where config_release and config_minrelease are defined in tlpkg/TeXLive/TLPDB.pm lines 1346 ff.

How exactly remotetlpdb is obtained I couldn't figure out. curl, wget or Perl's LWP depending on what the user has? I think this involves init_tlmedia (tlmgr.pl lines 7285 ff) and repository_to_array (TLUtils.pm lines 5249 ff), but that's as far as I went.

When the local and remote TL years don't match, tlmgr's output reflects that. The following with 2026 as the local year:

% tlmgr --repository https://texlive.info/tlpretest/ repository status
tlmgr: package repository https://texlive.info/tlpretest/ (verified)
main https://texlive.info/tlpretest//tlpkg/texlive.tlpdb verified

% tlmgr --repository https://mirrors.ircam.fr/pub/CTAN/systems/texlive/tlnet repository status
tlmgr: The TeX Live versions supported by the repository
https://mirrors.ircam.fr/pub/CTAN/systems/texlive/tlnet
  (2016--2025)
do not include the version of the local installation
  (2026).

Same with --machine-readable (which TLU uses):

% tlmgr --repository https://texlive.info/tlpretest/ --machine-readable repository status
tlmgr: --machine-readable output not supported for repository
start load https://texlive.info/tlpretest/
finish load https://texlive.info/tlpretest/
location-url https://texlive.info/tlpretest/
main https://texlive.info/tlpretest//tlpkg/texlive.tlpdb 0 verified

% tlmgr --repository https://mirrors.ircam.fr/pub/CTAN/systems/texlive/tlnet --machine-readable repository status
tlmgr: --machine-readable output not supported for repository
start load https://mirrors.ircam.fr/pub/CTAN/systems/texlive/tlnet
fail load https://mirrors.ircam.fr/pub/CTAN/systems/texlive/tlnet
tlmgr: The TeX Live versions supported by the repository
https://mirrors.ircam.fr/pub/CTAN/systems/texlive/tlnet
  (2016--2025)
do not include the version of the local installation
  (2026).

Unclear what could be parsed. "finish load" vs "fail load"?

Not sure this helps at all, but here we are.

Bruno