This is a continuation of #5 (also from pyodide). For some reason the CORS headers are not included when making a range request. If I request:

let resp = await fetch("https://files.pythonhosted.org/packages/51/5f/802a04274843f634469ef299fcd273de4438386deb7b8681dd059f0ee3b7/pip-19.1.tar.gz", {
   'mode': 'cors',
   headers : {
      'range' : "bytes:0-1000",
   }
});

this raises an error:
Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Using curl, I see no CORS headers when I make a range request:

>>> curl -IXGET https://files.pythonhosted.org/packages/51/5f/802a04274843f634469ef299fcd273de4438386deb7b8681dd059f0ee3b7/pip-19.1.tar.gz -r 0-1000
etag: "22e3726252b492ce24312c2b43d0127f"
content-type: binary/octet-stream
...
accept-ranges: bytes
age: 690655
content-range: bytes 0-1000/1334822
date: Wed, 02 Jun 2021 04:17:20 GMT
...
content-length: 1001

It's odd though because the CORS headers are present if I drop the range.

The reason I am interested in this is because range requests seem to be part of the way that pip handles dependency resolution. In particular, see the docstring here:
https://github.com/pypa/pip/blob/57be6a77c57ab5d512371b5c48d508a7620c3217/src/pip/_internal/network/lazy_wheel.py#L23