Repository: conda/conda

Issue:
conda=4.1 no longer respects HTTP_PROXY 
My proxy variables are properly set:

```
$ set https_proxy
HTTPS_PROXY=http://myproxy:8080
```

`conda=4.0.8` successfully picks up my `%HTTPS_PROXY%` and installs `conda=4.1`:

```
$ conda install conda=4.1
Fetching package metadata: ..........
Solving package specifications: .........

The following packages will be UPDATED:
    conda:     4.0.8-py27_0 defaults --> 4.1.0-py27_0 defaults
```

now trying to revert back to `conda=4.0`:

```
$ conda install conda=4.0
Fetching package metadata .........
Could not connect to https://repo.continuum.io/pkgs/free/win-64/
Connection error: HTTPSConnectionPool(host='repo.continuum.io', port=443): Max retries exceeded with url...
```

proxy settings no longer work. Configuring `proxy_servers` in `.condarc` restores connectivity.



Discussion:
Can also confirm this. Unfortunately it's not possible to specify no_proxy in the .condarc, so 4.1 is not working if you have a proxy and internal channels.

Thanks for the report, folks; I'm sorry for the trouble here. I'm unfamiliar with the proxy handling code so we'll have to find someone here better equipped. As far as I can tell we've never explicitly checked HTTP_PROXY so I'm guessing that it's caused by `requests` (not blaming that module per se, just saying that we must have changed the way we are using it.) @kalefranz @msarahan any ideas? 

Something like this changed in Conda-build - not sure if it is instructive: https://github.com/conda/conda-build/pull/989

This seems to be a problem with the newer version of requests in conda 4.1.0.

With an HTTPS_PROXY environment variable set:

Using requests 2.9.0:

```
In [1]: import requests
In [2]: requests.get('https://repo.continuum.io/pkgs/free/win-64', timeout=1, verify=False)
C:\Miniconda2_2\lib\site-packages\requests\packages\urllib3\connectionpool.py:791: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html
  InsecureRequestWarning)
Out [2]: <Response [407]>
```

Using requests 2.10.0

```
In [1]: import requests
In [2]: requests.get('https://repo.continuum.io/pkgs/free/win-64', timeout=1, verify=False)
requests\packages\urllib3\connectionpool.py:821: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html
  InsecureRequestWarning)

<.............. times out>
```

The 407 response 'proxy authentication required' might be another clue I guess.

Ah, so I'm not the only one. I created this ticket because I experienced the same thing: https://github.com/conda/conda/issues/2671. This current ticket is more eloquent than mine, so perhaps 2671 can be closed and this can take it's place?

I have experienced the same thing. .condarc works, but env var HTTP_PROXY is not taken into account. conda 4.0.8 was fine in this regard.

I'm looking into this now.  Probably the last bug to fix for today's 4.1.1 release.

Pretty sure this happened when I disabled `~/.netrc` files from requests.  PR https://github.com/conda/conda/pull/2514 in response to issue https://github.com/conda/conda/issues/2161.

The thread here for requests is relevant: https://github.com/kennethreitz/requests/issues/2773

Looks like I should have followed more closely @dsludwig's fix here: https://github.com/Anaconda-Platform/anaconda-client/pull/298


Resolving patch:
diff --git a/conda/connection.py b/conda/connection.py
--- a/conda/connection.py
+++ b/conda/connection.py
@@ -90,8 +90,8 @@ def __init__(self, *args, **kwargs):
         proxies = get_proxy_servers()
         if proxies:
             self.proxies = proxies
-        self.trust_env = False  # disable .netrc file
-                                # also disables REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE env variables
+        self.auth = NullAuth()  # disable .netrc file. for reference, see
+                                #   https://github.com/Anaconda-Platform/anaconda-client/pull/298
 
         # Configure retries
         if retries:
@@ -112,6 +112,22 @@ def __init__(self, *args, **kwargs):
 
         self.verify = ssl_verify
 
+
+class NullAuth(requests.auth.AuthBase):
+    '''force requests to ignore the ``.netrc``
+    Some sites do not support regular authentication, but we still
+    want to store credentials in the ``.netrc`` file and submit them
+    as form elements. Without this, requests would otherwise use the
+    .netrc which leads, on some sites, to a 401 error.
+    https://github.com/kennethreitz/requests/issues/2773
+    Use with::
+        requests.get(url, auth=NullAuth())
+    '''
+
+    def __call__(self, r):
+        return r
+
+
 class S3Adapter(requests.adapters.BaseAdapter):
 
     def __init__(self):


Test patch: