MetaCPAN vs. uscan

gregor herrmann <[email protected]> Thu, 10 Jul 2025 23:21:43 +0200

Newsgroups	gmane.linux.debian.devel.perl
Message-ID	<[email protected]>

Since a couple of days, MetaCPAN changed their ways of fighting AI
scrapers, according to [0] with some service called "signalsciences".
Which, according to [1] works fine, except that it means that all
requests from the commandline / programmatically / with a
non-javascript-capable browser don't work anymore. [2] This includes
uscan(1). [3]

So this means that we won't do any updates of Debian packages
representing CPAN distributions anymore.

As for potential fixes/workarounds:
- Setting a different User-Agent doesn't change anything.
- Bas found a way to change debian/watch to use the MetaCPAN API, cf.
[4]. In my POV, that's both technically brilliant and aesthetically
difficult :)
In general I think that updating ~5000 d/watch files (and some
tools) is not an attractive option …
- Hacking uscan to mangle metacpan.org URLs (or to work around the
javascript requirement from signalsciences in general) might be
doable but that would have to go into stable and whatever as well.
- Using a redirector for uscan might work but probably also needs
updating all d/watch files.

I guess talking to the MetaCPAN folks would be a reasonable next
step. Is there anybody, maybe wih connections to them, willing to do
this? I admit that I don't have the energy to put another task on my
TODO list.

Or maybe someone else has other ideas …

Cheers,
gregor

[0] https://github.com/metacpan/metacpan-web/commit/212a28303f761c181a4fcd94d8b17e70650ac1c2
[1] https://blogs.perl.org/users/dean/2025/07/metacpan-running-really-well-thanks.html
[2] try
wget -O- https://metacpan.org/release/ack
curl https://metacpan.org/release/ack
GET https://metacpan.org/release/ack
[3] uscan --report -vvv
in a soure package directory
[4] https://salsa.debian.org/perl-team/modules/packages/libpdl-vectorvalued-perl/-/commit/fc92473
--
.''`. https://info.comodo.priv.at -- Debian Developer https://www.debian.org
: :' : OpenPGP fingerprint D1E1 316E 93A7 60A8 104D 85FA BB3A 6801 8649 AA06
`. `' Member VIBE!AT & SPI Inc. -- Supporter Free Software Foundation Europe
`-

signature.asc (application/pgp-signature, 963 B)