Command-line arguments to pip install should take precedence over options configured in requirements.txt

• Pip version: 8.1.1
• Python version: 2.7.11
• Operating System: Ubuntu 16.04

Description:

Command-line arguments to pip install should take precedence over options configured in requirements.txt files. For example, if --index-url is specified on the command-line, then it should override the index-url set in a requirements.txt file.

What I’ve run:

pushd $(mktemp -d) >/dev/null
virtualenv -q .
source bin/activate >/dev/null
pip install -qU pip
echo "\
--index-url=https://example.com/DONOTQUERY
examplethatdoesnotexist
" > r.txt
pip install --isolated --index-url=https://pypi.python.org/simple/ -vr r.txt > log
grep DONOTQUERY -B 2 log  && echo "Queried https://example.com/DONOTQUERY"
grep pypi log || echo "Did not query pypi.python.org"

This outputs

Collecting examplethatdoesnotexist (from -r r.txt (line 2))
  1 location(s) to search for versions of examplethatdoesnotexist:
  * https://example.com/DONOTQUERY/examplethatdoesnotexist/
  Getting page https://example.com/DONOTQUERY/examplethatdoesnotexist/
  Starting new HTTPS connection (1): example.com
  "GET /DONOTQUERY/examplethatdoesnotexist/ HTTP/1.1" 404 606
  Could not fetch URL https://example.com/DONOTQUERY/examplethatdoesnotexist/: 404 Client Error: Not Found for url: https://example.com/DONOTQUERY/examplethatdoesnotexist/ - skipping
Queried https://example.com/DONOTQUERY
Did not query pypi.python.org

I would expect that the location searched for examplethatdoesnotexist would be the one specified on the command line “https://pypi.python.org/simple/” not the one specified in the requirements.txt file “https://example.com/DONOTQUERY”.

[andornaut]

it makes no sense for the user to be able to override the index URL, so requirements file taking precedence seems logical there

IMHO, it would make sense for the user to be able to override any config. Perhaps, the user is a CI system with its own package index cache.

Shouldn’t the user be the ultimate decision maker? I struggle to recall software where this is not the case.

[niander]

I also would like to see more clear precedence order in the documentation. As @dquitmann-op pointed out, the current documentation doesn’t mention that configuration in requirements.txt take precedence over everything.

Nevertheless, I believe the configuration in the requirements.txt should not take precedence over command-line and global environment variables for security and other reasons.