Why is private code not supported?

[attfarhan]

I'm looking to use this in a project, but saw that private code (using --index-url or --extra-index-url) is not supported. I wanted to ask what the reason was? Is it simply because it has not yet been implemented or is there some other reason (security etc.)? Thanks for your work on this!

[davidfischer]

I'm not opposed to some basic level of support. However, ideally the requirement parser should not require connecting to any other server to complete its parsing.

[kousu]

Great! If we can work out a solution you'd be happy with I'd be happy to write a patch. The parser doesn't need to talk to anything. It just needs a way to return the URL to the caller.

It's a bit awkward since the API only returns Requirements as an iterator, so there's no place to shove in Repositories. Thinking out loud here, maybe you could say you return a iterator of Requirement | Repository. Maybe the API should change from requirements.parse(file) to requirements.requirements(file) with a separate requirements.repositories(file) (more expensive but more okay to work with).

And yes, thank you for putting this together! This should really be part of pypa.

[joshuacwnewton]

UserWarning: Private repos not supported. Skipping.

Please note that the warning emitted by requirements-parser has changed as of a8754ff:

requirements-parser/requirements/parser.py

Line 79 in 5937fb4

warnings.warn('Private repos not supported. Skipping.', stacklevel=2)

The addition of stacklevel=2 interferes with any warnings filters meant for this warning. For example, if you use something like this:

    warnings.filterwarnings(action='ignore', category=UserWarning, module='requirements')
    
    for req in requirements.parse(requirements_txt):

stacklevel=2 means that requirements is no longer the module emitting the error, and this filter won't work.

The stacklevel determines where the warning is emitted. If it is 1 (the default), the warning is emitted at the direct caller of the deprecated object; if it is higher, it is emitted further up the stack.

Removing module= but adding message= will preserve the filter.

    warnings.filterwarnings(message='Private repos not supported', action='ignore', category=UserWarning)

cc: @madpah