fedora-infrastructure

#12951 Allow Deptopia to scrape kojipkgs in order to do vulnerability management.
Closed: Fixed with Explanation by jazinner. Opened by jazinner.

Closed: Fixed with Explanation
Reopen Issue

Describe what you would like us to do:

We have an application called Deptopia which reads package data from kojipkgs.fedoraprojects.org. Recently we started being blocked by Anubis. Could you please whitelist our application so that we can continue to make requests to this endpoint? It runs in Red Hat's MPP environment, the egress IPs are:

MPP Prod:
- 52.202.2.55
- 18.213.120.162
- 107.20.230.14

MPP Stage:
- 34.238.133.136
- 54.91.156.163
- 52.20.152.103

The product security team do this in order to build a manifest of Fedora package for Security Tracking.

When do you need this to be done by? (YYYY/MM/DD)

19th Dec, 2025

From : https://docs.google.com/spreadsheets/d/1U9qucZa4TqqGIr7XvuRi6XyexwJgRcF62rx5kbAVMaw/edit?gid=0#gid=0

IP Addresses are from:

https://docs.google.com/spreadsheets/d/1U9qucZa4TqqGIr7XvuRi6XyexwJgRcF62rx5kbAVMaw/edit?gid=0#gid=0

If need be we can, but can you try and adjust your access to send a user-agent and also a accept header? Most clients are ok once they do that... but if not we can allowlist from there.

Can you provide more details of what we should set the user-agent to? And also how to adjust the accept-header? It should be possible for us to adjust the client request.

Would this be acceptable:

  • "User-Agent", "deptopia/1.0 (Red Hat Product Security)"
  • "Accept", "/"

Metadata Update from @zlopez:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: anubis, medium-gain, medium-trouble

Yes, it doesn't need to be any specific agent, it just needs to set one and also set accept to something...

Did you get things working with that? Or is it still giving you trouble?

We've added the Headers to the request, I'll get back to you before the end of the week if there are any problems.

Our test suite is no longer showing the errors, so it seems to be working. We haven't deployed the changes to the production environment, but if there are any issues we'll open a new ticket.

Metadata Update from @jazinner:
- Issue close_status updated to: Fixed with Explanation
- Issue status updated to: Closed (was: Open)
Metadata
None

anubis medium-gain medium-trouble

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.