Summary

Addressing #1202, which occurred due to a tarfile.SpecialFileError, this case happened as the provided package had uploaded what linux classes as a character file (like a device file). Instead of handling specifically tarfile.ReadError, the download_package_sourcecode function how handles all tarfile errors using tarfile.TarError, the base error class.

Description of changes

In addition to those changes mentioned above, also included in this PR is modifying DetectMaliciousMetadataCheck.analyze_source to return SKIP instead of raising a HeuristicAnalyzerValueError from a SourceCodeError. This means that the result of the metadata analysis is still preserved and the analysis result does not result in UNKNOWN.

Related issues

Closes #1202.

Checklist

• I have reviewed the contribution guide.
• My PR title and commits follow the Conventional Commits convention.
• My commits include the "Signed-off-by" line.
• I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
• I have updated the relevant documentation, if applicable.
• I have tested my changes and verified they work as expected.