Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pipenv install --skip-lock should not expand environment variables in packages section #3049

Closed
uranusjr opened this issue Oct 16, 2018 · 7 comments
Labels
Type: Bug 🐛 This issue is a bug.

Comments

@uranusjr
Copy link
Member

From #3048. I believe this is unintended?

@techalchemy
Copy link
Member

Absolutely.

@techalchemy techalchemy added the Type: Bug 🐛 This issue is a bug. label Oct 16, 2018
@techalchemy
Copy link
Member

This is mainly a security concern I guess, but should we consider expanding variables in packages? It's not like people don't want it

@uranusjr
Copy link
Member Author

I agree this is worth considering, if Kenneth says yes.

@kirel
Copy link

kirel commented May 28, 2020

What did Kenneth say?

@uranusjr
Copy link
Member Author

No words from him, but @techalchemy I recall we had a similar discussion on this a while ago. The conclusion as I remember (might be me imagining) is essentially the same, i.e. don’t want to support this due to security concerns?

@giallu
Copy link

giallu commented Dec 6, 2021

I'd actually need this...
I am deploying to heroku an app with a dependency I need to download from a private git repo; so I would generate an access token for my repository and do something like:

[packages]
"mypackage" = {ref = "master", git = "git+https://user${ACCESS_TOKEN}@github.com/nsa/secret.git"}

There is probably a better way to add this (any suggestions appreciated) but it looks like a fairly common scenario, so I am wondering what are the security concerns preventing this to be added.

@matteius
Copy link
Member

--skip-lock is deprecated at this time as we do not recommend bypassing the lockfile, so I think we will plan to not fix this.

@matteius matteius closed this as not planned Won't fix, can't repro, duplicate, stale Jul 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Bug 🐛 This issue is a bug.
Projects
None yet
Development

No branches or pull requests

5 participants