Option to disable SSL verify

See original GitHub issue
  • I have searched the issues of this repo and believe that this is not a duplicate.
  • I have searched the documentation and believe that my question is not covered.

Feature Request

I’m trying to use poetry in a corporate environment. We have a private server and index for packages, and conda is setup to not verify SSL. Unfortunately, I didn’t find a similar option or configuration for Poetry, so when I try to install a package with Poetry, it fails (SSLError).

I managed to get it to work by changing two lines in

https://github.com/sdispater/poetry/blob/51c7042160a74adf14038460468e5e5a72b0d965/poetry/repositories/legacy_repository.py#L415-L426

…to this:

     def _download(self, url, dest):  # type: (str, str) -> None
-        r = self._session.get(url, stream=True)
+        r = self._session.get(url, stream=True, verify=False)
         with open(dest, "wb") as f:
             for chunk in r.iter_content(chunk_size=1024):
                 if chunk:
                     f.write(chunk)

     def _get(self, endpoint):  # type: (str) -> Union[Page, None]
         url = self._url + endpoint
-        response = self._session.get(url)
+       response = self._session.get(url, verify=False)
         if response.status_code == 404:
             return

         return Page(url, response.content, response.headers)

Obviously we would use a value specified in the config.toml instead of a literal False.

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Reactions:34
  • Comments:26 (5 by maintainers)

github_iconTop GitHub Comments

22reactions
blunt1973commented, Mar 31, 2020

really need this option too

14reactions
Shackelford-Ardencommented, Oct 13, 2020

For what it’s worth here, I’ve used this to succesfully bypass SSL validation without any code changes to Poetry:

https://stackoverflow.com/questions/48391750/disable-python-requests-ssl-validation-for-an-imported-module

TL;DR;

Set the CURL_CA_BUNDLE environment variable to an empty string.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Disable SSL verification when accessing git server with a self ...
Answer. Use following steps to keep git config --global http.sslverify false setting persistent, so this setting will be enabled after the asset ...
Read more >
Disabling SSL verification - Conda
To disable SSL verification when using conda skeleton pypi , set the SSL_NO_VERIFY environment variable to either 1 or True (case insensitive). On...
Read more >
How to disable SSL verification for any request?
In general - disabling validation or even part of the validation (like checking that hostname in URL matches certificate) is a very bad...
Read more >
Disable SSL verification in git repositories with self-signed ...
Run git config http.sslVerify false to disable SSL verification if you're working with a checked out repository already.
Read more >
How to ignore invalid and self signed ssl connection errors ...
If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. Here is one useful example where...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found