Kuskuren check_hostname na pip a bayan wakili: pip ko rami?

Rashin nasara biyu daban-daban suna buga wannan tarihin pip ɗaya, kuma gyaran da ya dace da ɗaya yana ƙara muni ga ɗayan. Abokin ciniki da ya tsufa don ya ambaci masaukin da aka rufe da rami yana buƙatar haɓakawa. Wakilin da ke sake sa hannu kan zirga-zirga yana buƙatar tabbataccen takardar shaidar tushe, ba raguwa ba. Gano wanne ne daga cikin biyun kake da shi kafin ka gyara maɓallin wakili, domin hanyoyin suna tafiya a gaban juna.

Karanta firam ɗin ƙarshe kafin ka taɓa saituna

Inda tarihin ya ƙare yana gaya maka wane mataki ya sauƙaƙa. Idan firam ɗin rufewa suna cikin lambar TLS ta urllib3 da ke tare da pip kuma rubutun yana korafi game da sunan masauki, ɗakin karatu na abokin ciniki bai iya kammala matakin tabbatarwa ba, kuma wannan matsala ce ta siga fiye da matsalar takardar shaida. Idan rubutun a maimakon haka ya ba da rahoton haɗin da aka ƙi, sunan wakili da ba a warware ba ko kuskure HTTP 407, ƙarshen ramin ne ke da laifi kuma babu haɓakawa da zai canza shi.

Ɗauki sigar pip da maɓallan wakili a cikin wannan shell ɗin da ke kasawa. Shell da aka buɗe kafin ramin ya tashi yana ɗauke da daban-daban dabi'u daga wanda aka buɗe bayansa, kuma bambanci tsakaninsu galibi shine dukan ganewar asali.

python3 -m pip --version
env | grep -i -E 'proxy|no_proxy'

Lokacin da abokin ciniki ya tsufa fiye da ramin

Tsofaffin fitarwar pip sun haɗa da tarin HTTPS da ya rasa sunan masaukin da ake nufi da zarar an naɗe soket ɗin da rami. Saƙon check_hostname shine abin da wannan tarin ke fitarwa lokacin da ya isa tabbatarwa ba tare da suna don kwatantawa ba. Haɓakawa yana kawar da kuskuren saboda sabon abokin ciniki yana riƙe da sunan a duk lokacin musafaha, kuma canjin yana da araha isa a gwada shi da farko duk lokacin da firam ɗin rufewa suka nuna lambar TLS da ke tare.

Idan ba za a iya isa ga fihirisar daga injin da ke kasawa ba, samo wheel na yanzu a kan masaukin da zai iya sannan ka shigar daga fayil ɗin. Yi amfani da sunan fayil ɗin da ka sauke a zahiri maimakon sigar da aka kwafa daga rubutun bulogi.

python3 -m pip install --upgrade pip
python3 -m pip install ./pip-24.2-py3-none-any.whl

Lokacin da wakilin ya sake sa hannu kan zirga-zirga

Wakilin da ke ƙare TLS kuma ya sake fitar da takardun shaida a ƙarƙashin tushen kamfani yana haifar da wata kuskure dabam: certificate verify failed, ba korafin sunan masauki ba. Wannan bambancin shine alamar, domin abokin ciniki ya isa uwar garke sannan ya ƙi asalin da aka nuna masa. Gyaran shine a amince da wannan tushen a fili, ko dai don umarni ɗaya ko ta maɓallin PIP_CERT, domin abokin ciniki ya iya gina sarkar zuwa abin da wakilin ke gabatarwa. Ƙara tushen cikin ajiyar amincewar tsarin yana aiki kuma, amma yana canza amincewa ga kowace shiri a kan injin, kuma wannan babbar shawara ce fiye da gyara shigarwar fakiti ɗaya.

Riƙe --trusted-host a matsayin ganewar asali, ba ta zama yanayin hutawa ba. Yana kashe binciken da kake ƙoƙarin kiyayewa, don haka takardar shaidar da ba daidai ba tana bayyana lafiya bayansa. Idan ka yi amfani da shi don shigar da fakiti ɗaya, cire shi kuma ka gyara sarkar kafin fitarwa ta gaba.

Lambar Python ɗinka da kanka tana watsi da saitin pip gaba ɗaya. Kira na requests yana buƙatar wakilin da kunshin a miƙa su inda wannan zaman zai iya ganin su, shi ya sa blok ɗin da ke ƙasa ya saita duka biyu a kan abin zaman.

pip install --cert /usr/local/share/ca-certificates/corp-root.crt requests
export PIP_CERT=/usr/local/share/ca-certificates/corp-root.crt

s = requests.Session()
s.proxies = {"https": "http://10.20.30.40:8080"}
s.verify = "/usr/local/share/ca-certificates/corp-root.crt"
s.get("https://pypi.org/simple/", timeout=15)

Lokacin da ƙarshen ko tashar jiragen ruwa ba daidai ba

Abokin ciniki na rami yakan sake rubuta wakilin tsarin yayin da yake haɗawa, wanda zai iya barin pip ya nuna ga masaukin da ba ya amsawa a wannan tashar. Gwada ƙarshen da abokin ciniki wanda ba pip ba kafin ka canza kowane saitin pip. Idan curl ya kasawa da wannan hujjar wakili, kuskuren yana sama da pip kuma babu adadin saiti a cikin pip da zai taimaka.

Tutar umarni da maɓallan muhalli suna faɗin abu ɗaya ga ma'auni daban-daban: tutar tana aiki ga kira ɗaya, maɓallan ga kowace tsari da aka fara bayanta. Ƙara NO_PROXY don fihirisar ciki domin zirga-zirgar fakiti na sirri ya tsallake kewayawa ta cikin ramin.

curl -x http://proxy.corp.internal:8080 --head https://pypi.org/simple/
pip install --proxy http://proxy.corp.internal:8080 requests

Ajiye saitin kuma tabbatar da hanyar tana aiki

Ajiye wakilin a cikin saitin pip ɗin kansa lokacin da ya kamata ya wuce wannan shell ɗin, sannan ka karanta abin da pip zai yi amfani da shi da gaske. Fitowar debug tana ambaton fayil ɗin da maɓallin da ke bayan kowace ƙima, wanda ke warware muhawara kan fifiko da sauri fiye da karanta takardun.

Tabbatarwa tana amfani da abokan ciniki biyu da gangan. Buƙatar ɗakin karatu na misali tana tabbatar da hanyar da sarkar amincewa, yayin da saukewa ke tabbatar da cewa saitin pip ɗin kansa ya yarda da su. Lokacin da na farko ya yi nasara kuma na biyu ya kasawa, bambancin yana cikin pip ba a cikin hanyar sadarwa ba.

pip config set global.proxy http://proxy.corp.internal:8080
pip config debug
python3 -c "import urllib.request as r; print(r.urlopen('https://pypi.org/simple/').status)"
pip download --no-deps -d /tmp/wheelcheck requests