Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make pipenv respect pip.conf with an optional arugment #5710

Open
eldos-dl opened this issue May 25, 2023 · 4 comments
Open

Make pipenv respect pip.conf with an optional arugment #5710

eldos-dl opened this issue May 25, 2023 · 4 comments
Labels

Comments

@eldos-dl
Copy link

Is your feature request related to a problem? Please describe.

pip.conf can be used to configure Pypi mirrors or alternate indexes. Pipenv does not respect this. Having a pip.conf gives the ability to cleanly separate out this information from the Pipfile as it is usually committed to git. We don't want to commit this information to git as

  • different developers can choose to use different mirrors, based on their location.
  • different developers can use private Pypi repositories which require credentials (Jfrog, CodeArtifact, ...)
  • proxy configuration

Respecting pip.conf will also make it easier for developers to transition from pip to pipenv.

Describe the solution you'd like

An optional argument for pipenv install which considers the pip.conf configuration.

Describe alternatives you've considered

  • Currently using environment variables in Pipenv, to get this information. But this approach isn't as clean or convenient as pip.conf

Additional context

Related Issues:

@matteius
Copy link
Member

@eldos-dl I had done some work a while back that provides some initial default support for pip.conf: https://github.com/pypa/pipenv/pull/5297/files

Could you help me understand better the intersection of what we currently provide and what is being requested/what is missing?

@matteius
Copy link
Member

@eldos-dl not sure if you saw my last question, but I could use more context to understand where the support gaps are between what we currently infer from pip.conf and what is desired.

@eldos-dl
Copy link
Author

@matteius

As pip.conf can be maintained outside git, different developers can use their own Pypi Index without config being part of pipfile or git. (could be for private repos, mirrors or proxy config, etc.).

To my understanding, something similar can be achieved if we use environment variables in Pipfile. But I felt a config file would be more convenient.

I am not sure if there are any other better ways to achieve this.

@rehevkor5
Copy link

initial default support for pip.conf

Since it is not documented, for those wondering how to use it this way, it appears that you can start by omitting all [[source]] entries in your Pipfile. It seems like only the first occurrence of index-url within pip.conf is obeyed, regardless of the section name. Whatever that is, it becomes your default index.

Caution that it does not appear to obey extra-index-url, which aligns to the security stance explained in the "Note" of the Index Restricted Packages doc. It's also mentioned in the pip docs in https://pip.pypa.io/en/latest/cli/pip_install/ although it's somewhat hidden in the "Examples" section. In pip.conf the only real mechanism to specify multiple indexes is extra-index-url. So I think the only way Pipenv could obey extra-index-url is if it had a reliable way to convert each of those URLs into its own Pipenv [[source]] with a predictable name.

From the code, it appears to me that it is converting each index-url into a pipenv [[source]], with the name of the Pipenv source following a pattern based on the pip.conf section name: for example the [global] section results in a Pipenv source named pip_conf_index_global. However, it seems that only the first index-url is actually available in Pipenv, regardless of the section name, and all subsequent sections seem to be ignored. And with the lack of any unit tests it's difficult for me to determine what it's really doing without downloading & debugging the code locally.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants