Add an interface to allow calling system keyring

news/11589.feature.rst

@@ -0,0 +1,2 @@
+Enable the use of ``keyring`` found on ``PATH``. This allows ``keyring``
+installed using ``pipx`` to be used by ``pip``.

src/pip/_internal/network/auth.py

@@ -4,8 +4,10 @@
 providing credentials in the context of network requests.
 """
 
+import shutil
+import subprocess
 import urllib.parse
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, NamedTuple, Optional, Tuple
 
 from pip._vendor.requests.auth import AuthBase, HTTPBasicAuth
 from pip._vendor.requests.models import Request, Response
@@ -23,11 +25,52 @@
 
 logger = getLogger(__name__)
 
-Credentials = Tuple[str, str, str]
+
+class Credentials(NamedTuple):
+    service_name: str
+    username: str
+    password: str
+
+
+class KeyRingCredential(NamedTuple):
+    username: Optional[str]
+    password: str
+
+
+class KeyRingCli:
+    """Mirror the parts of keyring's API which pip uses
+
+    Instead of calling the keyring package installed alongside pip
+    we call keyring on the command line which will enable pip to
+    use which ever installation of keyring is available first in
+    PATH.
+    """
+
+    @classmethod
+    def get_credential(
+        cls, service_name: str, username: Optional[str]
+    ) -> Optional[KeyRingCredential]:
+        cmd = ["keyring", "get", service_name, str(username)]
+        res = subprocess.run(cmd, capture_output=True)
+        if res.returncode:
+            return None
+        password = res.stdout.decode().strip("\n")
+        return KeyRingCredential(username=username, password=password)
+
+    @classmethod
+    def set_password(cls, service_name: str, username: str, password: str) -> None:
+        cmd = ["keyring", "set", service_name, username]
+        input_ = password.encode() + b"\n"
+        res = subprocess.run(cmd, input=input_)
+        res.check_returncode()
+        return None
+
 
 try:
     import keyring
 except ImportError:
+    if shutil.which("keyring") is not None:
+        keyring = KeyRingCli  # type: ignore[assignment]
     keyring = None  # type: ignore[assignment]
 except Exception as exc:
     logger.warning(
@@ -276,7 +319,11 @@ def handle_401(self, resp: Response, **kwargs: Any) -> Response:
 
             # Prompt to save the password to keyring
             if save and self._should_save_password_to_keyring():
-                self._credentials_to_save = (parsed.netloc, username, password)
+                self._credentials_to_save = Credentials(
+                    service_name=parsed.netloc,
+                    username=username,
+                    password=password,
+                )
 
         # Consume content and release the original connection to allow our new
         #   request to reuse the same one.
@@ -318,6 +365,6 @@ def save_credentials(self, resp: Response, **kwargs: Any) -> None:
         if creds and resp.status_code < 400:
             try:
                 logger.info("Saving credentials to keyring")
-                keyring.set_password(*creds)
+                keyring.set_password(creds.service_name, creds.username, creds.password)
             except Exception:
                 logger.exception("Failed to save credentials")