22

We use our own python package index at my office, and we're trying to add a new one. When I try to specify both indices at the same time, I get prompted to log in, but if I use only one at a time I don't.

For example:

$ pip install --user --upgrade \
    --extra-index-url https://<api token>:@packagecloud.io/2rs2ts/oldrepo/pypi/simple \
    --extra-index-url https://<other api token>:@packagecloud.io/2rs2ts/newrepo/pypi/simple \
    mypackage
Collecting mypackage
User for packagecloud.io:

But if I specify just one of either of those --extra-index-url arguments then I download my package just fine.

I'm 99% certain that I am passing the arguments correctly, since it's specified with an append action in the source. So I think the problem is that both of these index URLs are from packagecloud.io... but I could be wrong. Either way, how can I use both of my repos?

2rs2ts
  • 10,662
  • 10
  • 51
  • 95

3 Answers3

27

Apparently this is a bug in pip. The HTTP basic auth information is not stored correctly when specifying multiple --extra-index-urls that point to the same domain. I filed an issue, but in the meantime, there is a workaround. By specifying one of the --extra-index-urls as the --index instead, and adding PyPI as an --extra-index-url, I was able to download my package successfully:

$ pip install --user --upgrade \
    --index https://<api token>:@packagecloud.io/2rs2ts/oldrepo/pypi/simple \
    --extra-index-url https://<other api token>:@packagecloud.io/2rs2ts/newrepo/pypi/simple \
    --extra-index-url https://pypi.python.org/simple \
    mypackage
Collecting mypackage
  Downloading https://packagecloud.io/2rs2ts/newrepo/pypi/packages/mypackage-1.0.0-py2-none-any.whl (52kB)
etc. etc.

Edit: a fix for this problem has been merged and made available as of pip 21.2 (I think; I haven't tried because this hasn't been relevant to me in a while.) If you are experiencing this issue, try updating pip first before using my workaround, since my workaround will only let you get one extra use of the domain.

2rs2ts
  • 10,662
  • 10
  • 51
  • 95
  • Hi @2rs2ts this is not working for me with Azure DevOps Artifact Registry. I have tested it with pip==20.0.2, 21.2.1, 21.3.1. If I just use one extra-index-url it works, so it looks related – WaterKnight Dec 15 '21 at 08:55
  • @WaterKnight sorry I can't help with that. The best way to get help is to ask a new question, reference mine, and show how your situation is different and thus not a duplicate. I wish you the best of luck! – 2rs2ts Dec 15 '21 at 18:29
  • In case this helps anyone else, I was still having problems with this bug with pip 22. Upgrading to pip 23 fixed it for me. – Dana Cartwright Jun 06 '23 at 13:27
11

You can also use the environment variable PIP_EXTRA_INDEX_URL. And then you have to use space as delimiter.

export PIP_EXTRA_INDEX_URL="https://user:token@repo-a/ https://user:token@repo-b/"
pip install

I found something about env vars here in the docs. Based on the example about PIP_FIND_LINKS, I tried space and it worked.

The Fool
  • 16,715
  • 5
  • 52
  • 86
-1
--extra-index-url

accepts a list (it should probably be called --extra-index-urls). Try adding your URLs comma separated, like this:

pip install --user --upgrade \
    --extra-index-url https://<api token>:@packagebutt.io/2rs2ts/oldrepo/pypi/simple, \
    https://<other api token>:@packagebutt.io/2rs2ts/newrepo/pypi/simple \
    mypackage
Danielle M.
  • 3,607
  • 1
  • 14
  • 31
  • Thanks, this works if I make sure there is no space between the comma and the next URL. – 2rs2ts Aug 22 '16 at 17:56
  • 1
    Hm, actually, I take that back: if I uninstall the package then I get the error `Could not find a version that satisfies the requirement mypackage (from versions: )` `No matching distribution found for mypackage` - going back to just one index lets me install it. – 2rs2ts Aug 22 '16 at 17:59
  • Do you have another suggestion? – 2rs2ts Aug 23 '16 at 17:18
  • You may want to single quote the URLs to avoid whatever shell you are using trying to interpret any part of the string. – dragon788 Oct 09 '20 at 18:12