Feature request: flag to unset --extra-index-url

[bennuttall]

What's the problem this feature will solve?

If extra-index-url is set in /etc/pip.conf or equivalent, it's not possible (as far as I'm aware) to unset this option in a pip command. You can replace --index-url but not unset --extra-index-url. If you have a third-party source set as an additional index, but want to explicitly install from PyPI, you have to clear /etc/pip.conf.

Describe the solution you'd like

Either a new flag to disable extra-index-url, or a new flag to specify to explicitly use one index, e.g:

$ pip install package --no-extra-index

$ pip install package --only-use-index-url https://pypi.org/simple

Alternative Solutions

As far as I'm aware, the only alternative is to delete /etc/pip.conf, and there's no way to tell pip not to use it for a particular use.

Additional context

I maintain a third-party repo at piwheels.org for Raspberry Pi users and we pre-configure /etc/pip.conf in Raspbian to set extra-index-url. If users want to make sure their installation comes from PyPI one time, they have to remove /etc/pip.conf.

One such reason for this is when a package's requirements.txt specifies hashes from PyPI, e.g. piwheels/piwheels#144

[chrahunt]

May be related to #4263, which tries to solve this kind of issue in a general way. An extension to that proposal could take this use case into account without creating more command-line options.

Could also be related to #6131, which suggests that an empty value for --index-url should take on the default. Extending that to --extra-index-url may be reasonable.

[Helveg]

This would also be useful when you have a private package repository that is only available on some networks. I'm now faced with the issue that every package I want to install it first has to time out after 4 times 15 seconds before it looks on the PyPI. Pic related

[qrnik]

I believe this should be prioritised as a security issue. Lack of ability to force certain index in pip install command poses security risk of installing unwanted (and potentially malicious) public package in case of primary index is down or has older version of the package. This article perfectly highlights the hazard: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

[stefansjs]

similarly for --trusted-host

[bcm-at-zama]

I have had this issue and I used

  --isolated                  Run pip in an isolated mode, ignoring environment variables and user configuration.

option, which was able to solve my issue. Maybe it will be useful to others?