puppet apply with pip provider gives 403 error

[Dr Philip J Naylor]

Since some time on 16/06/2016 Puppet manifests that use the "pip" provider to manage Python packages are failing with a 403 error, on (at least) Ubuntu 14.04.4 LTS, when processed using "puppet apply...".

puppet version is 3.4.3-1ubuntu1.1
python-pip version is 1.5.4-1ubuntu3
python version is 2.7.5-5ubuntu3

On the command line:

pip install --upgrade rarfile

returns:

Requirement already up-to-date: rarfile in /usr/local/lib/python2.7/dist-packages
Cleaning up...

However, creating init.pp containing:

package { 'rarfile':
  ensure => 'latest',
  provider => 'pip',
}

and running:

puppet apply ./init.pp

returns:

Notice: Compiled catalog for narsaq.isys.bris.ac.uk in environment production in 0.01 seconds
Error: Could not get latest version: HTTP-Error: 403 Must access using HTTPS instead of HTTP
Error: /Stage[main]/Main/Package[rarfile]/ensure: change from 2.8 to latest failed: Could not get latest version: HTTP-Error: 403 Must access using HTTPS instead of HTTP
Notice: Finished catalog run in 1.05 seconds

This was previously working.

[Brian Wong (bwong)]

My colleagues ran into this issue yesterday and I think we tracked it down to a hardcoded method of retrieving the 'latest' for a pip package on old versions of the puppet agent. See this commit and line number at:

https://github.com/puppetlabs/puppet/commit/152299cc859fc74343c697841848086d4e41b6f8#diff-41bbce95c82bdc373da03bb2f6116ef5L70

What we ended up doing was hardcoding the version of the pip packages in our package resource declarations that used the pip provider. We did this as a short-term workaround until we can upgrade Puppet to a newer version that did not have this hardcoded mechanism.

[Cliff Roberts (watomlinson)]

bwong's workaround also worked for me. See this Github PR -> https://github.com/puppetlabs/puppet/pull/5024