For posterity's sake and for other people reading this, I answered on IRC and said:
```
13:00     hellais ) isis: if you have the latest version of pip won't setup download the dependencies via SSL?
13:00     hellais ) *setup.py
13:03     hellais ) isis: yeah, they said they would be soon switching to CentOS 6.3
13:15 [ (isis) ) hellais: no, sadly, because of the problem where the latest version of pip uses https://pypi.python.org/simple as its index, this means that 
                 it then crawls all the links listed there, which are like 90% http. :(
13:16 [ (isis) ) the whole problem is explained as clearly as i can explain it in that ticket. i should probably blog about that or send it to the python-dev 
                 mailing list so that everyone knows that pip is still being a piece of crap
13:17 [ (isis) ) s/ticket/first comment/
13:17 [ (isis) ) hellais: some of the nodes were switched to CentOS 6.3, but they appear to be in "failboot*" state
13:28     hellais ) isis: yeah if this is a bug in pip you should at the very least report it, because we need to have a setup.py script that actually has in 
                    it the right dependencies otherwise we won't be able to build packages and have it install automatically
13:29     hellais ) isis: but the fact that the links in https://pypi.python.org/simple are http is a problem of the package maintainer, right?
13:30     hellais ) isis: I am seeing though now that all the package download links are https (ex. https://pypi.python.org/simple/Twisted/)
13:31     hellais ) isis: the only stuff that is not https are links to the twisted website that are not used for downloading the package
13:31     hellais ) isis: can you give me an example of a package that would not be fetched over SSL, that is it has a link that is not https?
13:32 [ (isis) ) hellais: it is somewhat the package maintainers fault, yes. but also 'no' because the way those lists are compiled is kind of crazy in that 
                 there is another crawler (that i could not find the code for!) which creates the list by crawling *any* link on the packages webpage on pypi, 
                 which is how the hoomepages and such end up in there. i think it crawls like 2 levels of links.
13:33     hellais ) also it looks like the links are all relative so I don't see how they can not be SSL
13:33     hellais ) isis: yeah, but we don't care of the websites, because all the links to the packages are https
13:33     hellais ) or am I missing something?
13:36 [ (isis) ) hellais: i don't know, i fought this thing for hours one day, and right now if i uncomment the install_requires stuff in setup.py this is 
                 what happens when i go to make a fresh install: http://sprunge.us/PcLO
13:38 [ (isis) ) hellais: using this http://sprunge.us/EhVi as my setup.py (because the one in there right now is broken due to the lines starting with # and -
13:38     hellais ) hum
13:38 [ (isis) ) i should update the one in the pull so that it is not broken if we uncomment the lines, i'll do that now
13:38     hellais ) do you have the latest version of pip?
13:38     hellais ) It seems to be fetching the index over http
13:39     hellais ) and therefore the download links, being relative, are also just over http
13:39     hellais ) Reading http://pypi.python.org/simple/zope.interface/
13:39 [ (isis) ) (oonib)?!isis?wintermute:~/code/torproject/ooni-backend ? pip --version
13:39 [ (isis) ) pip 1.3.1 from /home/isis/.virtualenvs/oonib/lib/python2.7/site-packages/pip-1.3.1-py2.7.egg (python 2.7)
13:40 [ (isis) ) hellais: i think this is due to the fact that setup.py has it's own hardcoded package index somewhere, but i could not find how to change that
13:40 [ (isis) ) it may be something worth looking into
13:41     hellais ) ah, right, becuase in the setup.py we are using setuptools, that uses different code from pip
13:41 [ (isis) ) also, i couldn't find a way to get setup.py to respect the '-i https://pypi.python.org/packages' line at the top of requirements.txt...it 
                 just choked on it and threw exceptions at me because it couldn't parse it
13:43 [ (isis) ) hellais: yeah...we really want to be using distribute, because setuptools is being merged into that and the two projects are converging to be 
                 only distribute. there is also the problem that setuptools *does not work* and won't ever work on py3k, and the new version of distribute 
                 which is going to include all of the setuptools features *will not be compatible* with python2.x.
13:44 [ (isis) ) so we will apparently be forced to use a limited subset of the features in distribute if we wish to be compatible with python2.x and py3k.
13:45         hellais ) I think we should still have the install_requires and depends_install in the setup.py, because once we load ooni-backend on pypi
13:45     hellais ) and install it with pip then the deps will be downloaded over SSL
13:45     hellais ) it's just problematic if you run it locally
13:45     hellais ) but we just have to document that
13:46     hellais ) yeah, but distribute is not included by default. Also ATM python 3 is really the last of our worries
13:47 [ (isis) ) hmm.
13:48 [ (isis) ) do you know of a way to just call pip directly from setup.py and not use setuptools?
13:48     hellais ) pip uses setuptools.
13:49     hellais ) the fact is that the code that setuptools uses to download depenendencies is not the same that pip uses
13:49     hellais ) I believe what happens is that pip will download the dependencies and install them before setuptools does so
13:49 [ (isis) ) but pip, when those lines are commented out, when i do "pip install -r requirements.txt" uses *all* ssl.
13:50 [ (isis) ) because of line #1
13:50 [ (isis) ) in requirements.txt
13:51 [ (isis) ) so if we could do something like "cmd='pip install -r requirements.txt'; Popen(cmd, ...); setup(package=...)" then it might still work...
13:51 [ (isis) ) though this is janky
13:52 [ (isis) ) hellais: thanks for reviewing my code, by the way :)
13:56     hellais ) isis: no worries, it's more about reviewing python packaging systems than anything else :P
14:21 [ (isis) ) hellais: setuptools actually uses easy_install, underneath distutils, which is why there is no way to tell it to use a different package index
14:21 [ (isis) ) or, if there is, i am having a hell of a time trying to find it
14:42     hellais ) isis: merged.
15:03 [ (isis) ) hellais: cool, thanks! i tried just now also doing: http://sprunge.us/High but it did not work
15:04 [ (isis) ) i am going to sleep now
15:10  travis-ci  ???????? ~travis-ci@ec2-107-22-21-192.compute-1.amazonaws.com ???????? has joined #ooni
15:10         travis-ci ) [travis-ci] isislovecruft/ooni-backend#20 (fix/install-requirements - 30a1e07 : Isis Lovecruft): The build passed.
15:10         travis-ci ) [travis-ci] Change view : https://github.com/isislovecruft/ooni-backend/compare/75c95e5a36c8...30a1e07c7c06
```