Iphutha le-check_hostname le-pip ngemuva kwe-proxy: i-pip noma umhubhe?

Izingxaki ezimbili ezihlukene zinyathelisa umkhondo we-pip ofanayo, futhi ukulungiswa okufanele okukodwa kwenza okunye kube kubi nakakhulu. Iklayenti elidala kakhulu ukuthi lingasho umsingathi ogqitshiwe kuhubhe lidinga ukuthuthukiswa. I-proxy ebhalisa kabusha ithrafikhi idinga isitifiketi sezimpande esithembekile, hhayi ukwehliswa kwenguqulo. Thola ukuthi iyiphi kulezi ezimbili onayo ngaphambi kokuhlela okuguquguqukayo kwe-proxy, ngoba izindlela ziya ezinhlangothini eziphambene.

Funda amafreyimu okugcina ngaphambi kokuthinta izilungiselelo

Lapho umkhondo uphela khona kukutshela ukuthi yiluphi ungqimba oluyekile. Uma amafreyimu okuvala engaphakathi kwekhodi ye-TLS ye-urllib3 ehamba ne-pip futhi umbhalo ukhononda ngegama lomsingathi, ilabhulali yeklayenti ayikwazanga ukuqeda isinyathelo sokuqinisekisa, futhi lokho kuyinkinga yenguqulo izikhathi eziningi kakhulu kunenkinga yesitifiketi. Uma umbhalo esikhundleni salokho ubika ukuxhumana okunqatshiwe, igama le-proxy elingaxazululwanga noma iphutha le-HTTP 407, iphuzu lokugcina lomhubhe liyicala futhi akukho ukuthuthukiswa okuzokushintsha lokho.

Thwebula inguqulo ye-pip kanye nokuguquguqukayo kwe-proxy kuyo leyo shell ehlulekayo. I-shell evulwe ngaphambi kokuba umhubhe unyuke ithwala amanani ahlukile kunaleya evulwe ngemuva, futhi umehluko phakathi kwazo uvame ukuba ukuxilongwa konke.

python3 -m pip --version
env | grep -i -E 'proxy|no_proxy'

Lapho iklayenti lidala kuno mhubhe

Izinguqulo ezindala ze-pip zazifaka isitaki se-HTTPS esasilahlekelwa igama lomsingathi wendawo lapho isokhethi isisongwa umhubhe. Umlayezo we-check_hostname yilokho isitaki leso esikukhiphayo lapho sifinyelela ukuqinisekisa ngaphandle kwegama lokufanisa. Ukuthuthukiswa kususa iphutha ngoba iklayenti elisha ligcina igama kulo lonke ukuxhawulana, futhi ushintsho lushibhile ngokwanele ukuthi lungazanywa kuqala noma nini lapho amafreyimu okuvala akhomba ikhodi ye-TLS ehamba nawo.

Uma inkomba ingenakufinyelelwa kusuka emshinini ohlulekayo, landa i-wheel yamanje kumsingathi ongakwazi bese uyifaka kusuka efayeleni. Sebenzisa igama lefayela owalandayo ngempela, hhayi inguqulo ekhotshelwe epostini yebhulogi.

python3 -m pip install --upgrade pip
python3 -m pip install ./pip-24.2-py3-none-any.whl

Lapho i-proxy ibhalisa kabusha ithrafikhi

I-proxy eqeda i-TLS futhi ekhipha kabusha izitifiketi ngaphansi kwezimpande zebhizinisi ikhiqiza iphutha elihlukile: certificate verify failed, hhayi isikhalo segama lomsingathi. Lowo mehluko uyisiqondiso, ngoba iklayenti lafinyelela kuseva labe selilenqaba ubunikazi elaboniswa bona. Ukulungiswa ukuthemba leyo mpande ngokusobala, kungaba ngomyalo owodwa noma ngokusebenzisa okuguquguqukayo kwe-PIP_CERT, ukuze iklayenti lakhe iketanga kuze kufike kulokho okuvezwa i-proxy. Ukwengeza impande esitolo sokuthembela sohlelo nakho kuyasebenza, kodwa kushintsha ukuthembela kohlelo ngalunye emshinini, futhi leso sinqumo esikhulu kunokulungisa ukufakwa kwephakethe elilodwa.

Gcina --trusted-host njengokuxilonga, hhayi njengesimo esihlala njalo. Icisha isheke obuzama ukuligcina, ngakho isitifiketi esingalungile ngempela sibonakala siphilile ngemuva. Uma usisebenzisile ukufaka iphakethe elilodwa, sisuse futhi ulungise iketanga ngaphambi kwenguqulo elandelayo.

Ikhodi yakho ye-Python ngokwayo iyishaya indiva ngokuphelele ikhonfigurishini ye-pip. Ucingo lwe-requests ludinga ukuthi i-proxy nebhundela kudluliselwe lapho leso seshini singazibona khona, yingakho ibhlokhi engezansi ibeka kokubili kuyinto yeseshini.

pip install --cert /usr/local/share/ca-certificates/corp-root.crt requests
export PIP_CERT=/usr/local/share/ca-certificates/corp-root.crt

s = requests.Session()
s.proxies = {"https": "http://10.20.30.40:8080"}
s.verify = "/usr/local/share/ca-certificates/corp-root.crt"
s.get("https://pypi.org/simple/", timeout=15)

Lapho iphuzu lokugcina noma imbobo yokuxhumana ingalungile

Iklayenti lomhubhe livame ukubhala kabusha i-proxy yohlelo ngesikhathi lixhuma, okungase kushiye i-pip ikhombe kumsingathi ongaphenduli nhlobo kuleyo mbobo. Hlola iphuzu lokugcina ngeklayenti elingeyona i-pip ngaphambi kokushintsha noma yisiphi isilungiselelo se-pip. Uma i-curl ihluleka ngengxoxo efanayo ye-proxy, iphutha lingaphezulu kwe-pip futhi akuyona ikhonfigurishini efanele engaphakathi kwe-pip ezoqala isize.

Ifulegi lomyalo nokuguquguqukayo kwemvelo kusho into efanayo emikhakheni ehlukene: ifulegi lisebenza ekubizeni okukodwa, okuguquguqukayo kusebenza kuyo yonke inqubo eqalwa ngemuva. Engeza i-NO_PROXY enkombeni yangaphakathi, ithrafikhi yephakethe yangasese yeqe indlela ezungeza ngomhubhe.

curl -x http://proxy.corp.internal:8080 --head https://pypi.org/simple/
pip install --proxy http://proxy.corp.internal:8080 requests

Gcina isilungiselelo futhi ubonise ukuthi indlela iyasebenza

Gcina i-proxy kukhonfigurishini ye-pip uqobo lapho kufanele iphile ngaphezu kwe-shell yamanje, bese ufunda kabusha ukuthi i-pip izosebenzisa ini ngempela. Umphumela we-debug usho ifayela nokuguquguqukayo okungemuva kwenani ngalinye, okuxazulula izingxabano ngezikhathi ngokushesha kunokufunda imibhalo.

Ukuqinisekisa kusebenzisa amaklayenti amabili ngamabomu. Isicelo esisuka kulabhulali evamile sibonisa umzila neketanga lokuthembela, kanti ukulanda kubonisa ukuthi ikhonfigurishini ye-pip uqobo iyavumelana nazo. Lapho eyokuqala iphumelela futhi eyesibili ihluleka, umehluko usengaphakathi kwe-pip hhayi kunethiwekhi.

pip config set global.proxy http://proxy.corp.internal:8080
pip config debug
python3 -c "import urllib.request as r; print(r.urlopen('https://pypi.org/simple/').status)"
pip download --no-deps -d /tmp/wheelcheck requests