When an artifact is provided to Macaron to analyze, if there is no provenance to uniquely map it to the repository from which the artifact is generated from, Macaron tries to find it in a best-effort fashion.

There are multiple aspects to this milestone, such as support for various languages. Currently, Macaron only supports Java packages. Another aspect is to detect the exact commit that corresponds to the artifact.