An error occurred while installing <non-pypi packagename>
See original GitHub issueUsing pipenv version 8.2.6 with a Pipfile containing references to packages that are served from non-PyPi [[source]]
s results in a recoverable error. Given a Pipfile like this, where requests
comes from the public PyPi and (for the sake of example) secret-sauce
comes from on-prem-pypi.company.com
:
[[source]]
url = "https://on-prem-pypi.company.com"
verify_ssl = true
[[source]]
url = "https://pypi.python.org/simple"
verify_ssl = true
[packages]
requests = "*"
secret-sauce = "==1.2.3"
Running pipenv install
results in output like:
Pipfile.lock not found, creating…
Locking [packages] dependencies…
Updated Pipfile.lock (a1679f)!
Installing dependencies from Pipfile.lock (a1679f)…
An error occurred while installing secret-sauce==1.2.3! Will try again.
Installing initially–failed dependencies…
Success installing secret-sauce==1.2.3! — 00:00:00
It seems as though the initial failure was because pipenv failed to find secret-sauce
on PyPi, which makes sense, but would it be possible or pipenv to check all sources before emitting the error? It’s unsettling to see errors when in fact everything is fine once the appropriates sources are contacted.
Or, perhaps even better and more secure: Is it possible to declare that secret-sauce
only comes from on-prem-pypi.company.com
to avoid contacting other sources entirely? Without such a declaration, it would be possible for an attacker to claim secret-sauce
after-the-fact on PyPi and potentially run unexpected code on systems that expected secret-sauce
to be fetched from a different source.
Thanks for a great project!
Issue Analytics
- State:
- Created 6 years ago
- Comments:9 (6 by maintainers)
Whoops! Looks like it’s moved again. Check out https://docs.pipenv.org/advanced/#specifying-package-indexes
I’m kind of sure this was a race condition of some kind. Either way this technically does work. It might work better in master