ubuntu-20.04 pip3 ignores /etc/pip.conf

[Tomasz Ostrowski]

[Impact]

 * Ubuntu's pip doesn't read /etc/pip.conf, the upstream documented
   configuration file location, instead it reads the alternate path:
   /etc/xdg/pip.conf
 * While the alternate path is documented, too, this will probably confuse
   users.

[Test Plan]

# apt install python3-pip
# python3 -c "from pip._internal.configuration import get_configuration_files; print('/etc/pip.conf' in get_configuration_files()['global'])"

False = bug
True = expected behaviour

[Where problems could occur]

 * It's possible that somebody is relying on this behaviour to target one
   config file at Ubuntu's pip and another at upstream pip, but that does
   seem far-fetched.
 * The patch is from upstream, so we're not stepping into uncharted
   territory.

[Other Info]

 * Upstream PR: https://github.com/pypa/pip/pull/7786

[Original Bug Report]

The pip3-20.0.2 from python3-pip package, and also installed with "python3 -m venv" (ensurepip module), ignores /etc/pip.conf.

Based on https://pip.pypa.io/en/stable/user_guide/#config-file the /etc/pip.conf should work. Also it does work properly if original pip-20.0.2 is reinstalled to a venv from PyPI.

Steps to reproduce:

1. Add special package index URL to /etc/pip.conf, for example

[global]
index-url = https://download.zope.org/ppix

2. Try to install a package from your special index

Expected result:

* Packages from your index are available.

Current result:

* Only PyPI packaged are available.

----

We are trying to use this functionality to provide a local cache of PyPI using Artifactory - to speed-up creating virtual environments inside short-lived Docker and lessen PyPI bandwidth.

We are working around this by copying the file to ~/.config/pip/pip.conf, but we'd like to make it work system-wide.

----

vagrant@ubuntu-focal:~$ lsb_release -rd
Description: Ubuntu 20.04.2 LTS
Release: 20.04

vagrant@ubuntu-focal:~$ apt-cache policy python3-pip
python3-pip:
  Installed: 20.0.2-5ubuntu1.1
  Candidate: 20.0.2-5ubuntu1.1
  Version table:
 *** 20.0.2-5ubuntu1.1 500
        500 http://archive.ubuntu.com/ubuntu focal-updates/universe amd64 Packages
        500 http://security.ubuntu.com/ubuntu focal-security/universe amd64 Packages
        100 /var/lib/dpkg/status
     20.0.2-5ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu focal/universe amd64 Packages

ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: python3-pip 20.0.2-5ubuntu1.1
ProcVersionSignature: Ubuntu 5.4.0-65.73-generic 5.4.78
Uname: Linux 5.4.0-65-generic x86_64
ApportVersion: 2.20.11-0ubuntu27.14
Architecture: amd64
CasperMD5CheckResult: skip
Date: Tue Feb 2 12:32:07 2021
PackageArchitecture: all
SourcePackage: python-pip
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Stefano Rivera (stefanor)]

The issue is that pip patched their vendored appdirs module, which we de-vendored in Debian.

https://github.com/pypa/pip/pull/7786 is a better solution, which fixes it in Ubuntu >= 20.10.

[Stefano Rivera (stefanor)]

Let's roll a fix for #1927865 into the same SRU.

[Łukasz Zemczak (sil2100)]

Hello Tomasz, or anyone else affected,

Accepted python-pip into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python-pip/20.0.2-5ubuntu1.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Stefano Rivera (stefanor)]

Verified.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted python-pip (20.0.2-5ubuntu1.4) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

doit/0.31.1-3.2ubuntu1 (ppc64el, amd64, arm64, s390x, armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#python-pip

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Matthias Klose (doko)]

we can ignore the autopkg test failure for doit, downloading packages during the test.
this was fixed in doit 0.31.1-3.3

[Łukasz Zemczak (sil2100)]

Ok, thanks for the verification and checking of the ADT story. I'll hint those and proceed with an early release as per agreement. But please watch out for any regressions this might introduce and contact me immediately if anything strange happens.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-pip - 20.0.2-5ubuntu1.4

---------------
python-pip (20.0.2-5ubuntu1.4) focal; urgency=medium

  * Look for pip config /etc (LP: #1914239)
  * Provide the pip binary again (LP: #1927865)

 -- Stefano Rivera <email address hidden> Sun, 09 May 2021 12:50:53 -0400

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for python-pip has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.