Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Trusted Hosts Aren't Cached

See original GitHub issue

Environment

pip version: 20.0.2
Python version: 3.7.3
OS: CentOS Linux release 7.4.1708
Virtualenv version: 16.6.1 (ran as “virtualenv --python=3.7 build/python_env”)

Description If a host is added as a trusted-host, it won’t use the cache.

Expected behavior trusted-hosts use the cache.

How to Reproduce

pip config --site set global.index-url https://example.com/api/pypi/pypi/simple/
pip config --site set global.trusted-host example.com
pip install -r pip_requirements.txt

Output Line from broken output:

Collecting requests==2.23.0
  Downloading https://artifactory.rnclab.us.alcatel-lucent.com/artifactory/api/pypi/pypi/packages/1a/70/1935c770cb3be6e3a8b78ced23d7e0f3b187f5cbfab4749523ed65d7c9b1/requests-2.23.0-py2.py3-none-any.whl (58 kB)
     |████████████████████████████████| 58 kB 3.0 MB/s

Line from non-broken output (not configuring trusted-host):

Collecting requests==2.23.0
  Using cached https://example.com/artifactory/api/pypi/pypi/packages/1a/70/1935c770cb3be6e3a8b78ced23d7e0f3b187f5cbfab4749523ed65d7c9b1/requests-2.23.0-py2.py3-none-any.whl (58 kB)

Issue Analytics

State:
Created 4 years ago
Reactions:2
Comments:5 (4 by maintainers)

Top GitHub Comments

3reactions

d3davecommented, Mar 23, 2020

The change discussed for not caching packages from insecure origins was introduced alongside the --trusted-host flag in pip version 6. Then, installing from insecure origins was deprecated but not disabled (pip reported a warning, but still fetched the packages). As a result, the cache could still be poisoned by untrusted origins.

Since version 7, pip does not allow fetching packages from insecure origins unless they are explicitly marked trusted. As a result, the original change for not caching packages loses merit, because the cache cannot be poisoned anymore by untrusted origins (pip refuses to fetch the packages).

In light of the above, I believe the correct solution here is option 1.

1reaction

NoahGornycommented, Mar 23, 2020

hey @pradyunsg. can you please take a look at this and the PR I opened to solve it? 😄