Add cli flag --force-keyring #11029

Darsstar · 2022-04-12T10:23:47Z

Currently, Pip is conservative and does not query keyring at all when --no-input is used because the keyring might require user interaction such as prompting the user on the console.

These commits add a flag to pinky swear that the configured keyring backend does not require any user interaction. It defaults to False, making this opt-in behaviour.

Tools such as Pipx and Pipenv use Pip and have their own progress indicator that hides output from the subprocess Pip runs in. They should pass --no-input in my opinion, but Pip should provide some mechanism to still query the keyring in that case. Just not by default. So here we are.

pfmoore · 2022-04-12T10:41:32Z

If you supply the flag, but the keyring backend does prompt for user input (somehow, maybe via a GUI), what happens? I can imagine people using this flag getting very confused when the pip process "hangs" and reporting issues. In my experience, authentication prompts are notorious for "mostly" not needing user interaction, but then unexpectedly popping up prompts. The git client definitely does this - upgrading git often causes re-prompts, for example. And a keyring that periodically prompts for security reasons seems perfectly plausible to me. So it would be easy for a user to think that it's OK to supply this flag, but be wrong.

Also, the paragraph in the documentation about pipx/pipenv isn't at all clear to me. It seems to suggest that if you use those tools, you should always set this flag - which frankly seems like the wrong message to be giving.

Maybe this would be better handled as a --force-keyring flag, which overrides pip's current behaviour of disabling the keyring on --no-input. That's pretty easy to document ("Always query the keyring, regardless of pip's --no-input option. Note that this may cause problems if the keyring expects to be able to prompt the user interactively and no interactive user is available.") and puts the responsibility completely on the user to ensure that their keyring backend works as expected.

Darsstar · 2022-04-12T11:02:52Z

That does sound like a more sensible name and way to document the feature.

Time for a break tohopefully quicky stop being disapointed in myself not for realizing this myself after @uranusjr suggested --force-system-keyring. It was staring me right in the face and I wan't able to see it because I concentrated too much on system... Sorry!

Darsstar · 2022-04-18T11:48:44Z

I renamed the flag to --force-keyring and hopefully improved the documentation changes.

uranusjr · 2022-04-18T12:23:09Z

~~The flag name isn’t changed in documentation.~~ Edit: Need to change the config value and environment variable name as well.

docs/html/topics/authentication.md

Darsstar · 2022-04-18T12:53:54Z

~~The flag name isn’t changed in documentation.~~ Edit: Need to change the config value and environment variable name as well.

Woops. Fixed it.

uranusjr

Implementation looks good. Don’t have much opinion on the design, leaving it for others to comment on.

Darsstar · 2022-06-20T11:22:59Z

leaving it for others to comment on.

@uranusjr It has been two months without any sign of Pip contributors doing so without any asking them to. Would pinging people or a team be reasonable at this point? (The latter is not something I can do as far as I can tell.)

pfmoore · 2022-06-20T12:17:33Z

I'm much the same as @uranusjr - the implementation looks OK, but I don't have much opinion on the design. Basically, I don't mind if someone else merges this, but I won't do so myself.

pfmoore · 2022-10-15T09:04:16Z

Moving this to the 23.0 milestone.

tests/functional/test_install_config.py

…keyring queried for credentials. Since there is currently no possible way to get pip to query the keyring when --no-input is used I am not marking the new scenario xfail. That should change once there is some way to do that.

Currently, Pip is conservative and does not query keyring at all when `--no-input` is used because the keyring might require user interaction such as prompting the user on the console. This commit adds a flag to force keyring usage if it is installed. It defaults to `False`, making this opt-in behaviour. Tools such as Pipx and Pipenv use Pip and have their own progress indicator that hides output from the subprocess Pip runs in. They should pass `--no-input` in my opinion, but Pip should provide some mechanism to still query the keyring in that case. Just not by default. So here we are.

…r_keyring_if_needed to add a few --no-input and --force-keyring scenarios

…-defined]` comments that are no longer needed as of pytest 7.1.3

pradyunsg · 2023-01-09T14:26:35Z

I don't have the bandwidth to review/decide what to do on this PR and, TBH, I'm not too sure about breaking behaviour change here without a migration period (x-ref https://pip.pypa.io/en/stable/development/release-process/#deprecation-policy). What do we want to do here folks?

Darsstar · 2023-01-09T14:40:10Z

If I do as @uranusjr suggests in #11698 then this PR will become irrelevant and only --keyring-provider with the default of auto (current behaviour) should not require a deprecation period as far as I can tell.

I can have that refactor done in the next couple of days. Not that that will magically give you more bandwith to deal with that PR... Could you at least take a quick look at #11658 which is about a tiny bug in new keyring related functionality on HEAD?

pradyunsg · 2023-01-09T14:51:15Z

only --keyring-provider with the default of auto (current behaviour) should not require a deprecation period as far as I can tell.

Oh, this sounds great and I agree. :)

Could you at least take a quick look at #11658 which is about a tiny bug in new keyring related functionality on HEAD?

Have added it to the 23.0 milestone for now. That's a relatively easy fix, I think but if we can cover that as part of this PR, that works for me too. :)

Darsstar · 2023-01-12T16:05:47Z

only --keyring-provider with the default of auto (current behaviour) should not require a deprecation period as far as I can tell.

Oh, this sounds great and I agree. :)

I'm done with the refactoring.

I'm going to selfishly leave this PR open for now since this one is on de 23.0 milestone and the other is not so it serves as a reminder.

pradyunsg · 2023-01-28T22:27:06Z

Given the lack of a response from the other maintainers here, and my lack of familiarity with this chunk of logic; I've extracted #11759 to fix the issue blocking the upcoming release based on the fix by @Darsstar related to that here.

Darsstar · 2023-01-30T08:50:37Z

Closing in favor of #11698

Darsstar mentioned this pull request Apr 12, 2022

Add a mechanism to query keyring for credentials in combination with --no-input #11020

Closed

1 task

Darsstar force-pushed the keyring-does-not-prompt branch 2 times, most recently from 89a4822 to 94a0941 Compare April 18, 2022 11:19

Darsstar changed the title ~~Add cli flag --keyring-does-not-prompt~~ Add cli flag --force-keyring Apr 18, 2022

uranusjr reviewed Apr 18, 2022

View reviewed changes

docs/html/topics/authentication.md Show resolved Hide resolved

Darsstar force-pushed the keyring-does-not-prompt branch from 94a0941 to 854accb Compare April 18, 2022 12:51

uranusjr approved these changes Apr 19, 2022

View reviewed changes

Darsstar mentioned this pull request Apr 20, 2022

Using: keyrings.google-artifactregistry-auth pipenv update -d fails hard. pypa/pipenv#4706

Closed

github-actions bot added the needs rebase or merge PR has conflicts with current master label May 25, 2022

Darsstar force-pushed the keyring-does-not-prompt branch from 854accb to 113d1a9 Compare May 30, 2022 10:46

pypa-bot removed the needs rebase or merge PR has conflicts with current master label May 30, 2022

Darsstar mentioned this pull request Jun 27, 2022

Add --shared to pipx install and pipx runpip. pypa/pipx#829

Closed

3 tasks

uranusjr added this to the 22.3 milestone Aug 12, 2022

Darsstar mentioned this pull request Aug 21, 2022

Vendor keyring & keyring-subprocess #11399

Closed

Darsstar mentioned this pull request Sep 2, 2022

Respect disable_pip_input setting from Pipfile pypa/pipenv#5323

Merged

2 tasks

pfmoore modified the milestones: 22.3, 23.0 Oct 15, 2022

q0w reviewed Oct 15, 2022

View reviewed changes

tests/functional/test_install_config.py Outdated Show resolved Hide resolved

Darsstar force-pushed the keyring-does-not-prompt branch from 113d1a9 to 82cc63c Compare October 17, 2022 11:55

github-actions bot added the needs rebase or merge PR has conflicts with current master label Nov 10, 2022

Darsstar force-pushed the keyring-does-not-prompt branch from 82cc63c to 11c1a10 Compare November 11, 2022 21:05

pypa-bot removed the needs rebase or merge PR has conflicts with current master label Nov 11, 2022

psf-chronographer bot added the bot:chronographer:provided label Dec 2, 2022

Darsstar force-pushed the keyring-does-not-prompt branch from bc1db24 to f255bfe Compare December 2, 2022 10:19

Darsstar force-pushed the keyring-does-not-prompt branch from f255bfe to 77b8bbd Compare December 13, 2022 22:50

Darsstar mentioned this pull request Dec 13, 2022

Keyring support broken on Windows when keyring.exe is found on PATH after #11589 #11658

Closed

1 task

Darsstar force-pushed the keyring-does-not-prompt branch from 77b8bbd to 01b74b4 Compare December 13, 2022 23:29

github-actions bot added the needs rebase or merge PR has conflicts with current master label Dec 14, 2022

Darsstar force-pushed the keyring-does-not-prompt branch from 01b74b4 to 185a579 Compare December 14, 2022 07:51

pypa-bot removed the needs rebase or merge PR has conflicts with current master label Dec 14, 2022

Darsstar force-pushed the keyring-does-not-prompt branch from 185a579 to cdb5756 Compare December 14, 2022 08:32

Darsstar and others added 3 commits December 14, 2022 11:18

Parameterized tests/functional/test_install_config.py::test_prompt_fo…

629de94

…r_keyring_if_needed to add a few --no-input and --force-keyring scenarios

Darsstar force-pushed the keyring-does-not-prompt branch from cdb5756 to b4082e3 Compare December 14, 2022 10:19

Darsstar mentioned this pull request Dec 19, 2022

Keyring support should require an --enable-keyring flag #8719

Closed

Darsstar and others added 2 commits January 5, 2023 11:05

Added a news entry and some documentation about --force-keyring

fe03e9c

Unpin pytest in .pre-commit-config.yaml and remove `type: ignore[attr…

7fd045c

…-defined]` comments that are no longer needed as of pytest 7.1.3

Darsstar force-pushed the keyring-does-not-prompt branch from b4082e3 to 7fd045c Compare January 5, 2023 10:07

Darsstar mentioned this pull request Jan 5, 2023

Keyring multi choice #11698

Merged

pradyunsg removed the bot:chronographer:provided label Jan 28, 2023

pradyunsg modified the milestones: 23.0, 23.1 Jan 28, 2023

pradyunsg mentioned this pull request Jan 28, 2023

Correctly handle keyring auth subprocess newlines on Windows #11759

Merged

Darsstar closed this Jan 30, 2023

github-actions bot locked as resolved and limited conversation to collaborators Feb 15, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add cli flag --force-keyring #11029

Add cli flag --force-keyring #11029

Darsstar commented Apr 12, 2022 •

edited by pradyunsg

Loading

pfmoore commented Apr 12, 2022

Darsstar commented Apr 12, 2022 •

edited

Loading

Darsstar commented Apr 18, 2022

uranusjr commented Apr 18, 2022 •

edited

Loading

Darsstar commented Apr 18, 2022

uranusjr left a comment

Darsstar commented Jun 20, 2022

pfmoore commented Jun 20, 2022

pfmoore commented Oct 15, 2022

pradyunsg commented Jan 9, 2023 •

edited

Loading

Darsstar commented Jan 9, 2023 •

edited

Loading

pradyunsg commented Jan 9, 2023 •

edited

Loading

Darsstar commented Jan 12, 2023

pradyunsg commented Jan 28, 2023

Darsstar commented Jan 30, 2023

Add cli flag --force-keyring #11029

Add cli flag --force-keyring #11029

Conversation

Darsstar commented Apr 12, 2022 • edited by pradyunsg Loading

pfmoore commented Apr 12, 2022

Darsstar commented Apr 12, 2022 • edited Loading

Darsstar commented Apr 18, 2022

uranusjr commented Apr 18, 2022 • edited Loading

Darsstar commented Apr 18, 2022

uranusjr left a comment

Choose a reason for hiding this comment

Darsstar commented Jun 20, 2022

pfmoore commented Jun 20, 2022

pfmoore commented Oct 15, 2022

pradyunsg commented Jan 9, 2023 • edited Loading

Darsstar commented Jan 9, 2023 • edited Loading

pradyunsg commented Jan 9, 2023 • edited Loading

Darsstar commented Jan 12, 2023

pradyunsg commented Jan 28, 2023

Darsstar commented Jan 30, 2023

Darsstar commented Apr 12, 2022 •

edited by pradyunsg

Loading

Darsstar commented Apr 12, 2022 •

edited

Loading

uranusjr commented Apr 18, 2022 •

edited

Loading

pradyunsg commented Jan 9, 2023 •

edited

Loading

Darsstar commented Jan 9, 2023 •

edited

Loading

pradyunsg commented Jan 9, 2023 •

edited

Loading