pypa/pip — pull request #985 by dstufft (2013-06-07 14:42:23+00:00)
Title: Ignore external and unsafe urls aka PEP438

Implements Phase2 of [PEP438](http://www.python.org/dev/peps/pep-0438/).

Adds a number of index options:
```
# Allow an externally hosted and verifiable file to be installed for PROJECT
# AKA Files directly linked from the simple index with a Hash
--allow-external PROJECT

# Allows externally hosted and verifiable files to be installed for all projects
--allow-all-external

# Allows an insecure and unverifiable file to be installed for PROJECT
# AKA files directly linked from the simple index without a hash
# AKA files linked from the homepage or download url
--allow-insecure PROJECT

# Turn on future behavior with regards to external urls
--no-allow-external

# Turn on future behavior with regards to insecure urls
--no-allow-insecure
```

All changes are gated on the api version of the page being >= 2. This means that older indexes, apache indexes, etc will continue to use the old processing rules.

There is also a speed boost involved here as pip will ignore the homepage and download urls if the current options would not allow installing anything from them anyways.

The default action currently is to install but warn. In the future (1.5?) pip will default to ``--no-allow-insecure`` and ``no-allow-external`` and those flags will be noop'd.

URLs directly passed in via the command line, requirements files, etc are always considered verifiable and secure.