pypa/pip — pull request #1438 by minrk (2014-01-08 06:02:41+00:00)
Title: warn if the latest version was ignored due to security policy

With 1.5 implementing the previously-warned-about security feature of silently ignoring external and insecure downloads, some packages will install old versions due to the security policy, and there is currently no indication that something has gone wrong.

This notes versions skipped for security reasons, and checks if the latest version has been ignored, warning if so.

This is more complicated than I wanted it to be, so perhaps I am not doing it correctly. It seems like the most logical cause for a warning is to do something like:

1. check the latest version on PyPI
2. if no downloads are found for that version (for any reason), there should be a warning

Honestly, the failure mode is so severe (warnings are generally ignored if installation succeeds) that I think there should be a prompt for user action in the case caught here, rather than proceeding with installation. But I expect maintainers would disagree, so I did not implement that.