llvm dev - Oct 2015 - pip issue on buildbot running on newer distro

I just moved the ppc64le lnt buildbot to a new machine whose distro has 
a later release of pip than was on the old machine.  The later release 
requires the use of https or the --trusted-host option or it generates 
an error.

pip is used in the venv.lnt.install step like this:

/some-long-path/lnt.venv/bin/pip install --no-index --find-links 
http://lab.llvm.org/packages -e .


On the old machine:

Collecting WTForms (from LNT==0.4.1.dev0)
   This repository located at lab.llvm.org is not a trusted host, if 
this repository is available via HTTPS it is recommend to use HTTPS 
instead, otherwise you may silence this warning with '--trusted-host 
lab.llvm.org'.
   DEPRECATION: Implicitly allowing locations which are not hosted at a 
secure origin is deprecated and will require the use of --trusted-host 
in the future.


On the new machine:

Collecting WTForms (from LNT==0.4.1.dev0)
   The repository located at lab.llvm.org is not a trusted or secure 
host and is being ignored. If this repository is available via HTTPS it 
is recommended to use HTTPS instead, otherwise you may silence this 
warning and allow it anyways with '--trusted-host lab.llvm.org'.
   Could not find a version that satisfies the requirement WTForms (from 
LNT==0.4.1.dev0) (from versions: )
No matching distribution found for WTForms (from LNT==0.4.1.dev0)
program finished with exit code 1


If the LNTBuilder code is updated to fix this problem is this going to 
cause a problem for bots running with older versions of pip?
-- 

-Bill Seurer

Would it be hard to get a cert for the labmaster?
> On Oct 15, 2015, at 3:12 PM, Bill Seurer via llvm-dev <llvm-dev at
lists.llvm.org> wrote:
> 
> I just moved the ppc64le lnt buildbot to a new machine whose distro has a
later release of pip than was on the old machine.  The later release requires
the use of https or the --trusted-host option or it generates an error.
> 
> pip is used in the venv.lnt.install step like this:
> 
> /some-long-path/lnt.venv/bin/pip install --no-index --find-links
http://lab.llvm.org/packages -e .
> 
> 
> On the old machine:
> 
> Collecting WTForms (from LNT==0.4.1.dev0)
>  This repository located at lab.llvm.org is not a trusted host, if this
repository is available via HTTPS it is recommend to use HTTPS instead,
otherwise you may silence this warning with '--trusted-host
lab.llvm.org'.
>  DEPRECATION: Implicitly allowing locations which are not hosted at a
secure origin is deprecated and will require the use of --trusted-host in the
future.
> 
> 
> On the new machine:
> 
> Collecting WTForms (from LNT==0.4.1.dev0)
>  The repository located at lab.llvm.org is not a trusted or secure host and
is being ignored. If this repository is available via HTTPS it is recommended to
use HTTPS instead, otherwise you may silence this warning and allow it anyways
with '--trusted-host lab.llvm.org'.
>  Could not find a version that satisfies the requirement WTForms (from
LNT==0.4.1.dev0) (from versions: )
> No matching distribution found for WTForms (from LNT==0.4.1.dev0)
> program finished with exit code 1
> 
> 
> If the LNTBuilder code is updated to fix this problem is this going to
cause a problem for bots running with older versions of pip?
> -- 
> 
> -Bill Seurer
> 
> _______________________________________________
> LLVM Developers mailing list
> llvm-dev at lists.llvm.org
> http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev

Am 16.10.2015 um 00:12 schrieb Bill Seurer via llvm-dev:
> I just moved the ppc64le lnt buildbot to a new machine whose distro has
> a later release of pip than was on the old machine.  The later release
> requires the use of https or the --trusted-host option or it generates
> an error.
 > If the LNTBuilder code is updated to fix this problem is this going
 > to cause a problem for bots running with older versions of pip?

https://media.readthedocs.org/pdf/pip/develop/pip.pdf says that 
trusted-host is available since pip 6.0 (2014-12-22).
IOW there will be problems if an older pip is in use.

Most people upgrade pip at the drop of a hat because usually pip would 
continue to "just work".
IOW adding trusted-host *should* be fine, but you will want to test that.

The option can be added on the command line or in pip.conf.
(It should have been possible in requirements.txt but they forgot to 
implement that; this is fixed since Sep 5, but I don't know whether that 
made it into a pip release yet. See 
https://github.com/pypa/pip/issues/2822 and 
https://github.com/pypa/pip/pull/3007 .)