Repository: pypa/pip

Issue:
pip 7.0.1: you should use "--trusted-host". Hey, no such option "--trusted-host"!
```
$ cat req.txt 
--extra-index-url http://pip.mycompany.com/simple 
mylib
myanotherlib

$ pip install -r req.txt
Collecting mylib (from -r req.txt (line 2))
.../urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
  The repository located at pip.mycompany.com is not a trusted or secure host and is being ignored. If this repository is available via HTTPS it is recommended to use HTTPS instead, otherwise you may silence this warning and allow it anyways with '--trusted-host pip.mycompany.com'.
  Could not find a version that satisfies the requirement mylib (from -r req.txt (line 2)) (from versions: )
No matching distribution found for mylib (from -r req.txt (line 2))

$ cat req1.txt 
--extra-index-url http://pip.mycompany.com/simple 
--trusted-host pip.mycompany.com
mylib
myanotherlib

$ pip install -r req1.txt 
Usage: pip [options]

pip: error: no such option: --trusted-host
$ 
```

I know that i can run `pip install -r file.txt --trusted-host=mycompany.com` but I configure my servers with Chef, not running pip directly.



Discussion:
Just wanted to note that the change to no longer allow insecure transport with no option to whitelist a host causes quite large amount of suffering on our side. 

We have lots of internal libraries that are hosted on an internal pypi server (I guess it's "external" in pip-talk). Issuing a certificate won't help us, since sometimes it's resolved using client1.pip.mycompany.com and issuing certificates on the fly would be a huge pain. 

Whitelisting all libraries with something like the following would also be inconvenient:

```
--extra-index-url http://pip.mycompany.com/simple 
--allow-external mylib
--allow-unverified mylib
mylib
--allow-external mylib2
--allow-unverified mylib2
mylib2
#etc.
```

A better solution at this stage would be just to downgrade all our pip usage to <7.0. Unfortunately, it's hard to do as well, since verses like this are used all across the place:

```
# chef configuration file
Chef::Log.info("About to upgrade pip & setuptools version to latest.")
%W{setuptools pip wheel}.each do |pkg|
  python_pip pkg do
    action :upgrade
  end
end
```

I believe `--trusted-host` should go to `pip.conf` or to command line. It should not be part of `requirements.txt`.

As @smira says, you can add trusted-host as a configuration option to your `pip.conf`; I just confirmed it works with our internal pip sever. You can set the env var `PIP_CONFIG_FILE` to point to a specific file if you can't set it up at a user/sytem level; see the [Pip docs](http://pip.readthedocs.org/en/latest/user_guide.html#configuration) for more info.

@smira, using a command line is not an option for us, as we run chef recipes that may not even support it. `chef.conf` might or might not work as `sudo pip install -r reqs.txt` may look for that in a different place than `pip install`. Using `PIP_CONFIG_FILE` may create permission issues.

Moreover, I can't see what problem would it create if the `--trusted-host` would be an acceptable option for requirements files, and what makes `--extra-index-url` a valid option for requirements files, while making `--trusted-host` an invalid one from your point of view?

I think it's fine for pip to add it to `requirements.txt`, the fact it isn't there is mostly an oversight.

We also would like to have the trusted host live in the requirements.txt file. The error message says we need to add it but when we do it throws an error saying the option "--trusted-host" doesn't exist.

We have bought a wildcard certificate for our site, and it seems that [the root CA certificate](https://github.com/jappix/jappix/blob/master/misc/certs/Starfield_Class_2_CA.pem) is not trusted by urllib3 by default.

So actually, even with a wildcard certificate in place, we still need to revert to using `--trusted-host` anyway.

Using puppet here, simply write your pip.conf into the venv.

+1 for adding `--trusted-host` to requirements files

@dstufft Isn't this just an inconsistency in pip? My understanding is that if you can place the option on the commandline you can place it in the requirements.txt file. 

Not every command line option is available in the `requirements.txt`, this jsut needs added to the list of options that are supported in `requirements.txt`.

+1 for `--trusted-host`, we got same issue while using some of Docker oficial images and internal pypi server.

+1 for `--trusted-host` in requirements.txt, also causing some issues for me.

+1 for --trusted-host ... it's a job stopping for me.


Resolving patch:
diff --git a/pip/req/req_file.py b/pip/req/req_file.py
--- a/pip/req/req_file.py
+++ b/pip/req/req_file.py
@@ -43,6 +43,7 @@
     cmdoptions.always_unzip,
     cmdoptions.no_binary,
     cmdoptions.only_binary,
+    cmdoptions.trusted_host,
 ]
 
 # options to be passed to requirements
@@ -218,6 +219,9 @@ def process_line(line, filename, line_number, finder=None, comes_from=None,
             if os.path.exists(relative_to_reqs_file):
                 value = relative_to_reqs_file
             finder.find_links.append(value)
+        if opts.trusted_hosts:
+            finder.secure_origins.extend(
+                ("*", host, "*") for host in opts.trusted_hosts)
 
 
 def break_args_options(line):


Test patch:
diff --git a/tests/unit/test_req_file.py b/tests/unit/test_req_file.py
--- a/tests/unit/test_req_file.py
+++ b/tests/unit/test_req_file.py
@@ -202,6 +202,10 @@ def test_set_finder_no_use_wheel(self, finder):
         no_use_wheel_fmt = pip.index.FormatControl(set([':all:']), set())
         assert finder.format_control == no_use_wheel_fmt
 
+    def test_set_finder_trusted_host(self, finder):
+        list(process_line("--trusted-host=url", "file", 1, finder=finder))
+        assert finder.secure_origins == [('*', 'url', '*')]
+
     def test_noop_always_unzip(self, finder):
         # noop, but confirm it can be set
         list(process_line("--always-unzip", "file", 1, finder=finder))