Fall back to public PyPI if 'ConnectionError' occurs #2783

Activity

1. jaklan

   added

   kind/featureFeature requests/implementationsFeature requests/implementations

   status/triageThis issue needs to be triagedThis issue needs to be triaged

   on Aug 9, 2020
2. finswimmer

   added

   area/repoMeta-issues for the repository/forge itselfMeta-issues for the repository/forge itself

   on Aug 12, 2020
3. stormsw commented on Mar 25, 2021

   

   stormsw

   on Mar 25, 2021

   More actions

   Any progress on merging the PR?
4. abn commented on Mar 28, 2021

   

   abn

   on Mar 28, 2021

   Member

   More actions

   @stormsw does #3337 resolve this?
5. stormsw commented on Mar 28, 2021

   

   stormsw

   on Mar 28, 2021

   Last edited by stormsw

   More actions

   @abn I think this one is bit different.
   The lines are here https://github.com/python-poetry/poetry/blob/master/poetry/repositories/legacy_repository.py#L435

           try:
               response = self.session.get(url)
               if response.status_code in (401, 403):
                   self._log(
                       "Authorization error accessing {url}".format(url=url),
                       level="warning",
                   )
                   return
               if response.status_code == 404:
                   return
               response.raise_for_status()
           except requests.HTTPError as e:
               raise RepositoryError(e) # 
           #  <<< here we have uncaught exception NewConnectionError
6. ralbertazzi commented on Jun 8, 2023

   

   ralbertazzi

   on Jun 8, 2023

   Last edited by ralbertazzi

   Contributor

   More actions

   Honestly I wouldn't want to see this ever getting implemented in Poetry. It goes against the whole determinism / reproducibility idea of the lockfile that is one of the keypoints of the project. If the lockfile says that a package must be downloaded from repo xyz then that same package must always be downloaded from repo xyz.

   Note how there can be several reasons why you want to make sure packages are always downloaded from the same source, other than mere determinism:

   • The package on the private repo might not be exactly the same as the one on pypi (eg a wheel compiled in a different way)
   • You want to avoid dependency confusion attacks

   Overall I think your best chance to see this getting implemented is to develop a plugin on your own. I'm invoking an extra opinion from core maintainers before closing this issue - @dimbleby
7. jaklan commented on Jun 8, 2023

   

   jaklan

   on Jun 8, 2023

   Author

   More actions

   @ralbertazzi
   That's why I mentioned that functionality as an option, not as default behaviour. The request was created before plugins were introduced, if it's achievable this way - that should be also fine.

   Just one more point - you focused on poetry.lock in your comment, but what should be the behaviour on poetry add / poetry update level, yet before modifying the lockfile? If I have multiple primary sources defined and one of them is unreachable, should I be able to add package from one of the other sources or should it also fail? I haven't checked what's the current behaviour in Poetry 1.5 yet, but I still wonder what is actually expected.