Unnecessary keyring querying for URLs without need for credentials

[hroncok]

Environment

• pip version: 19.3.1, 20.1.1, 20.2b1
• Python version: 3.8
• OS: Fedora 32

Description

When an user installs a package with dependencies, for each dependency, the keyring (#5952) is prompted for credentials to https://pypi.org/simple and pypi.org and files.pythonhosted.org:

$ python3.8 -m venv --system-site-packages __venv__
$ . __venv__/bin/activate

(__venv__)$ pip list | grep keyring
keyring                       21.2.0  

(__venv__)$ pip install -U pip
...
Successfully installed pip-20.1.1

(__venv__)$ pip install gertty -vvv | grep credentials
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
  Getting credentials from keyring for files.pythonhosted.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
  Getting credentials from keyring for files.pythonhosted.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
  Getting credentials from keyring for files.pythonhosted.org

(__venv__)$ yes | pip uninstall SQLAlchemy alembic gertty ordereddict python-editor urwid voluptuous
...

(__venv__)$ pip install -U --pre pip
...
Successfully installed pip-20.2b1

(__venv__)$ pip install gertty -vvv | grep credentials
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
  Getting credentials from keyring for files.pythonhosted.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
  Getting credentials from keyring for files.pythonhosted.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
Getting credentials from keyring for https://pypi.org/simple
Getting credentials from keyring for pypi.org
  Getting credentials from keyring for files.pythonhosted.org

When the keyring is not accessible, this prompts the user for the keyring password all times and produces a lot of warnings:

WARNING: Keyring is skipped due to an exception: Failed to unlock the collection!
WARNING: Keyring is skipped due to an exception: Failed to unlock the collection!
WARNING: Keyring is skipped due to an exception: Failed to unlock the collection!
WARNING: Keyring is skipped due to an exception: Failed to unlock the collection!
WARNING: Keyring is skipped due to an exception: Failed to unlock the collection!

I do not know yet how to reproduce the locked keyring issue yet, but our user was hit by it:

https://bugzilla.redhat.com/show_bug.cgi?id=1859476

Expected behavior

Keyring should not be queried for URLs that work without authentication. The original issue #5948 only speaks about when a 401 is being handled situation, not all.

[hroncok]

Ok, here how's to get the bad UX:

1. run seahorse

2. lock the keyrings:

3. Run pip install ... and for each keyring prompt, click cancel, because you don't want the keyring to open or you don't remember the password:

Sorry for the Czech locales, I've tried to set English, but the prompt for keyring password is form some daemon.

[dtantsur]

The sad thing is, I see it without even having a keyring (no "Passwords" section in seahorse). And I have no clue what my password (for the absent keyring) is.

[pradyunsg]

Closing as a duplicate of #8090.

Quoting myself from that issue:

We need someone familiar with keyring, to look at pip._internal.network.auth and see what would be a good way to resolve this issue. :)