Khaladka check_hostname ee pip ee ka dambeeya boroksi: pip mise tunnel?

Laba cilladood oo kala duwan ayaa daabaca isla raadka pip, dayactirka mid ka mid ah ku habboonna wuxuu ka sii darayaa kan kale. Macmiil aad u duug ah oo aan magacaagi karin martigeliyaha tunnel-ka wuxuu u baahan yahay casriyeyn. Boroksi dib u saxeexa socodka wuxuu u baahan yahay shahaado xidid la aamini karo, ma aha hoos u dhigid nooc. Go'aanso midka labada ah ee aad haysato ka hor inta aadan wax ka beddelin doorsoome boroksi, sababtoo ah waddooyinku waxay u socdaan jihooyin iska soo horjeeda.

Akhri furayaasha ugu dambeeya ka hor inta aadan taaban dejinta

Halka raadku ku dhammaado waxay kuu sheegtaa lakabka is-dhiibay. Haddii furayaasha xidhitaanka ay ku jiraan koodhka TLS ee urllib3 ee la socda pip oo qoraalku ka cabanayo magaca martigeliyaha, maktabadda macmiilka ma dhammayn tallaabada xaqiijinta, taasna waa dhibaato nooc inta badan ka badan dhibaato shahaado. Haddii qoraalku taa beddelkeeda soo sheego xiriir la diiday, magac boroksi aan la xallin ama khalad HTTP 407, barta ugu dambeysa ee tunnel-ka ayaa qaldan oo wax casriyeyn ah ma beddeli doono.

Qabso nooca pip iyo doorsoomayaasha boroksi isla shell-ka guuldarraysta. Shell la furay ka hor inta uusan tunnel-ku soo bixin waxay qaadaa qiyam ka duwan mid la furay dabadeed, farqiqa u dhexeeyaana inta badan waa ogaanshaha oo dhan.

python3 -m pip --version
env | grep -i -E 'proxy|no_proxy'

Marka macmiilku ka duug yahay tunnel-ka

Noocyadii hore ee pip waxay la socdeen HTTPS stack oo lumiyay magaca martigeliyaha loo socdo marka socket-ka lagu duubo tunnel. Farriinta check_hostname waa waxa stack-kaas soo saaro marka uu gaaro xaqiijin isagoo aan haysan magac uu isbarbardhiggo. Casriyeyntu waxay meesha ka saartaa cilladda sababtoo ah macmiilka cusub wuxuu magaca hayaa inta kupeynta gacmaha socoto, isbeddelkuna waa mid jaban oo la isku dayo marka hore mar kasta oo furayaasha xidhitaanka ay tilmaamaan koodhka TLS ee la socda.

Haddii index-ka laga gaari karin mishiinka guuldarraysta, soo dejiso wheel cusub martigeliye awood u leh kadibna ka rakib faylka. Isticmaal magaca faylka aad dhab ahaan soo dejisatay, ma aha nooc laga koobiyeeyay bogga blog.

python3 -m pip install --upgrade pip
python3 -m pip install ./pip-24.2-py3-none-any.whl

Marka boroksideedu dib u saxeexo socodka

Boroksi dhammeeya TLS oo dib u soo saara shahaadooyin hoos yimaada xidid shirkadeed wuxuu soo saaraa khalad kale: certificate verify failed, ma aha cabasho magaca martigeliyaha. Farqiqaas waa tilmaanta, sababtoo ah macmiilku wuxuu gaaray server kadibna wuu diiday aqoonsiga la tusay. Dayactirku waa in si cad loo aamino xididkaas, ha ahaado amar keliya ama doorsoome PIP_CERT, si macmiilku u dhisi karo silsilad ilaa waxa boroksidu soo bandhigto. Ku darista xididka kaydka aaminnka nidaamka ayaa sidoo kale shaqeeya, laakiin waxay beddelaysaa aaminnka barnaamij kasta oo mishiinka ku yaal, taasna waa go'aan ka weyn dayactirka hal rakibaad baakad.

--trusted-host u hay ogaansho ahaan, weligaa ha u hayn xaalad joogto ah. Waxay damisaa hubinta aad isku dayaysay inaad haysato, sidaas darteed shahaado dhab ahaan khaldan ayaa dabadeed u muuqata mid caafimaad qaba. Haddii aad u isticmaashay rakibidda hal baakad, ka saar oo hagaaji silsiladda ka hor nooca xiga.

Koodhkaaga Python ee gaarka ah wuxuu gabi ahaan iska indhatirayaa dejinta pip. Wicitaanka requests wuxuu u baahan yahay boroksi iyo xidhka in la gudbiyo meesha fadhigaas uu ka arki karo, sidaas darteed block-ka hoose wuxuu labadaba dhigayaa shayga fadhiga.

pip install --cert /usr/local/share/ca-certificates/corp-root.crt requests
export PIP_CERT=/usr/local/share/ca-certificates/corp-root.crt

s = requests.Session()
s.proxies = {"https": "http://10.20.30.40:8080"}
s.verify = "/usr/local/share/ca-certificates/corp-root.crt"
s.get("https://pypi.org/simple/", timeout=15)

Marka barta ugu dambeysa ama dekeddu qaldan tahay

Macmiilka tunnel-ka wuxuu inta badan dib u qoraa borokska nidaamka inta uu xirmayo, taas oo pip ku reebi karta isagoo u jeeda martigeliye aan waligiis ka jawaabin dekeddaas. Tijaabi barta ugu dambeysa macmiil aan pip ahayn ka hor inta aadan beddelin wax dejinta pip ah. Haddii curl ku guuldarraysto isla doodda borokska, cilladdu waxay ka sarraysaa pip oo wax dejinta gudaha pip ah ma caawin doonto.

Calanka amarka iyo doorsoomayaasha deegaanku waxay isla wax u sheegaan xaddiyo kala duwan: calanku wuxuu khuseeyaa hal wicitaan, doorsoomayaashuna hawlgal kasta oo dabadeed bilaabma. Ku dar NO_PROXY index gudaha ah si socodka baakadaha gaarka ah uu u dhaafo hareeraha tunnel-ka.

curl -x http://proxy.corp.internal:8080 --head https://pypi.org/simple/
pip install --proxy http://proxy.corp.internal:8080 requests

Kaydi dejinta oo caddee in waddadu shaqeyso

Kaydi borokska dejinta pip ee u gaar ah marka ay tahay inuu ka baxo shell-ka hadda, kadibna akhri waxa pip dhab ahaan isticmaali doono. Soo-saarka debug wuxuu magacaabaa faylka iyo doorsoome ka dambeeya qiime kasta, taas oo xallisa doodaha mudnaanta si ka dhaqso badan akhrinta dukumeentiga.

Xaqiijintu waxay si ula kac ah u isticmaashaa laba macmiil. Codsi ka yimaada maktabadda caadiga ah wuxuu caddeeyaa waddada iyo silsiladda aaminnka, halka soo-dejintu caddeyso in dejinta pip ee u gaar ah ay la ogolaato iyaga. Marka kan hore guuleysto oo kan labaad guuldarraysto, farqigu wuxuu ku jiraa pip gudihiisa ma aha shabakadda.

pip config set global.proxy http://proxy.corp.internal:8080
pip config debug
python3 -c "import urllib.request as r; print(r.urlopen('https://pypi.org/simple/').status)"
pip download --no-deps -d /tmp/wheelcheck requests