upload to untrusted hosts with --trusted option

Hi,

Twine denies uploading to untrusted https PyPI clones. This triggers an SSL error caused by an unknown CA certificate. I need the ability to upload packages to untrusted private PyPI servers since

Backgroung : I’m in process to add PyPI and NPM support to a Nexus server that’s published in production with regular CA signed certificates. But can’t obtain such certificates for the Nexus test site.

I made a small quick’n’dirty patch setting verify=False option when posting a tarball or wheel file here. https://github.com/pypa/twine/blob/master/twine/repository.py#L152

I know that the requests lib issues a warning in such situations but I don’t care.

Thanks

[jaraco]

The solution to this problem is threefold:

• insecure requests over plain HTTP are allowed
• where SSL is used with an otherwise untrusted certificate, the --cert parameter should be used to pass the trusted certificate
• if the above solutions aren’t available, implement a hack (such as this) at your own risk to disable certificate checking.

This last option is intentionally ugly and inconvenient to limit the proliferation of that discouraged approach.

If none of these approaches are suitable, please feel free to elaborate on why.

[itaym120]

Sorry I didn’t comment earlier, but I wanted to say that I think I’m -1 on making this change.

I’m a bit concerned that if we add this flag, it will proliferate through comments, stack overflow answers, etc as an “easy” way to fix SSL errors that should actually be fixed by producing and obtaining valid certificates for third-party indices. Basically, this shouldn’t be necessary and feels like an easy way out.

I’m especially concerned about the possibility of this being used with --trusted-host pypi.org which should basically never happen. At the very least, I’d like to see this being implemented in a way that prevents this flag from ever being used with that host.

(cc @ewdurbin for thoughts here as well)

It’s not always possible to work the “right” way, that’s why pip, conda install and npm gives the option to add trusted-host\verify-ssl flags. Not as the recommended way, but as a possiblity for users. The default should obviously be to verify whenever its a possibility.

In my case, I just can’t demand from the Artifactory repository providers to add a real CA approved certificate and I have no choise but use verify=False when uploading and downloading packages from there. and there are no alternatives in the lan…