Option to disable ssl verify (Poetry 1.0.x)

docs/docs/repositories.md

@@ -134,3 +134,14 @@ default = true
 ```
 
 A default source will also be the fallback source if you add other sources.
+
+### Trusting a repository
+
+You can bypass SSL verification for a repository if you know it can be trusted (useful for corporate private repositories):
+
+```toml
+[[tool.poetry.source]]
+name = "foo"
+url = "https://foo.bar/simple/"
+trusted = true
+```

poetry/factory.py

@@ -258,6 +258,7 @@ def create_legacy_repository(
             auth=auth,
             cert=get_cert(auth_config, name),
             client_cert=get_client_cert(auth_config, name),
+            trusted=source.get("trusted", False),
         )
 
     @classmethod

poetry/installation/pip_installer.py

@@ -61,6 +61,9 @@ def install(self, package, update=False):
 
             index_url = repository.authenticated_url
 
+            if repository.trusted:
+                args += ["--trusted-host", parsed.hostname]
+
             args += ["--index-url", index_url]
             if self._pool.has_default():
                 if repository.name != self._pool.repositories[0].name:

poetry/json/schemas/poetry-schema.json

@@ -523,6 +523,10 @@
                 "secondary": {
                     "type": "boolean",
                     "description": "Declare this repository as secondary, i.e. it will only be looked up last for packages."
+                },
+                "trusted": {
+                    "type": "boolean",
+                    "description": "Declare this repository as trusted, i.e. option --trusted-host will be used when installing packages with pip."
                 }
             }
         }

poetry/repositories/legacy_repository.py

@@ -162,14 +162,22 @@ def clean_link(self, url):
 
 class LegacyRepository(PyPiRepository):
     def __init__(
-        self, name, url, auth=None, disable_cache=False, cert=None, client_cert=None
+        self,
+        name,
+        url,
+        auth=None,
+        disable_cache=False,
+        cert=None,
+        client_cert=None,
+        trusted=False,
     ):  # type: (str, str, Optional[Auth], bool, Optional[Path], Optional[Path]) -> None
         if name == "pypi":
             raise ValueError("The name [pypi] is reserved for repositories")
 
         self._packages = []
         self._name = name
         self._url = url.rstrip("/")
+        self._trusted = trusted
         self._auth = auth
         self._client_cert = client_cert
         self._cert = cert
@@ -211,6 +219,10 @@ def cert(self):  # type: () -> Optional[Path]
     def client_cert(self):  # type: () -> Optional[Path]
         return self._client_cert
 
+    @property
+    def trusted(self):
+        return self._trusted
+
     @property
     def authenticated_url(self):  # type: () -> str
         if not self._auth:
@@ -414,15 +426,35 @@ def _get_release_info(self, name, version):  # type: (str, str) -> dict
         return data
 
     def _download(self, url, dest):  # type: (str, str) -> None
-        r = self._session.get(url, stream=True)
+        if self._trusted:
+            import urllib3
+
+            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+        r = self._session.get(url, stream=True, verify=not self._trusted)
+        if self._trusted:
+            import urllib3
+
+            urllib3.warnings.simplefilter(
+                "default", urllib3.exceptions.InsecureRequestWarning
+            )
         with open(dest, "wb") as f:
             for chunk in r.iter_content(chunk_size=1024):
                 if chunk:
                     f.write(chunk)
 
     def _get(self, endpoint):  # type: (str) -> Union[Page, None]
         url = self._url + endpoint
-        response = self._session.get(url)
+        if self._trusted:
+            import urllib3
+
+            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+        response = self._session.get(url, verify=not self._trusted)
+        if self._trusted:
+            import urllib3
+
+            urllib3.warnings.simplefilter(
+                "default", urllib3.exceptions.InsecureRequestWarning
+            )
         if response.status_code == 404:
             return