I recommend a docblock here that explains the function's purpose, return value, and return type, and documents its arguments and their types.

It looks like there's a trailing character on the end of this line.

It looks like there's a trailing character on the end of this line.

@bowlofeggs Thanks for reviewing, updated

I recommend tests, but LGTM otherwise.

Added some tests, no sure whether the test cases are enough :P

Please also add the X-Content-Type-Options header with value "nosniff".

How about we drop the manual hackery?
I'd say just get rid of this case.

I'd say we should add the Content-Disposition header to application/ types as well, to prevent application/javascript etc

ping ?

so you mean to remove all the codes that guess the mimetype based on the file content?

The manual one we do here by detecting #!, yes. Not removing the mimetypes call.

all comments are addressed, and rebased to 2 commits

Sorry I dropped the ball on this PR, are you still interesting it getting it merged? Or would you prefer someone else to take it over?

Please go head to take it over. I haven't tracked the new changes in pagure's code base for a while.

@cverna finished this PR in https://pagure.io/pagure/pull-request/2778

Thanks for working on this @zhsj & @cverna it's nice to finally have it in! :)