Can't use globally installed truststore package

[Joshua-Schroijen]

I would like to start using pipx in a corporate Windows environment where TLS interception is used. My first goal with it is to install poetry. I have pip set up here and working perfectly fine thanks to using the truststore Python package. But when I try to run the command pipx install poetry from inside an elevated command prompt I get the following error message:

C:\WINDOWS\system32>python -m pipx install poetry
Fatal error from pip prevented installation. Full pip output in file:
    C:\Users\joshua\pipx\logs\cmd_2024-07-24_15.44.36_pip_errors.log

Some possibly relevant errors from pip install:
    ERROR: To use the truststore feature, 'truststore' must be installed into pip's current environment.

Error installing poetry.

Running python -m pip list in the same session confirms that truststore is installed globally and should be available to pipx. So what I am missing here? How do I get pipx to detect and use truststore/how do I fix this issue?

I could not find anything using Google or here in the discussions about this error. Thank you in advance for your input!

[huxuan]

I am not sure but maybe the --preinstall or --system-site-packages option in pipx install will help you?

[huxuan]

Could you provide the contents of C:\Users\joshua\pipx\logs\cmd_2024-07-26_11.21.33_pip_errors.log?

Generally, no matching distribution problem is related to the configuration of pypi index url.

[Joshua-Schroijen]

This is the content of log files like that:

PIP STDOUT
----------
Using pip 23.0.1 from C:\Users\joshua\pipx\shared\Lib\site-packages\pip (python 3.10)
Looking in indexes: https://<corporate internal Python package repository that fully works as expected from pip itself>/simple/

PIP STDERR
----------
ERROR: Could not find a version that satisfies the requirement poetry (from versions: none)
ERROR: No matching distribution found for poetry

I am on a corporate network where we host our own internal Python package repository. That repository works fine with pip. We do not use PyPI.

[huxuan]

In this way, you need have poetry on the internal Python package repository, too.

[Joshua-Schroijen]

We have one. I can pip download it ...

[huxuan]

I encountered a similar problem with my private PyPI. And it turns out I only uploaded one version of poetry and the default Python used by pipx are different (version) from that of pip.

You can check it with the following commands:

$(pipx environment -V PIPX_DEFAULT_PYTHON) --version

and

pip --version

[Joshua-Schroijen]

I am running python -m pipx and python -m pip so I know I am using pip and pipx with the same Python version. Maybe pipx calls pip directly without python -m (and that pip is indeed using a different Python version), but if it does that I would kind of consider that a bug or at least undesirable. I will check this later.

[Joshua-Schroijen]

I experimented further and it is beginning to look like --system-site-packages isn't giving the pip inside of pipx's new virtual environment for poetry access to truststore. (Maybe because that pip runs in turn in its own environment somehow?) This was the core error

I fixed the issue by installing truststore from a .whl file directly using the shared pip.exe of pipx:

C:\Users\joshua\pipx\shared\Scripts>.\pip.exe install C:\Users\joshua\Downloads\truststore-0.8.0-py3-none-any.whl

(This requires disabling use-feature = truststore temporarily in your pip configuration beforehand. After installing truststore through the wheel you can re-enable the setting. You should also make sure you have configured your credentials correctly if you are using a secured pip repository)

This only needs to be done once and should fix the issue allowing you to pipx install and pipx ensurepath any program from now on. ´pip`'s error message in this case was very misleading ...

I honestly think this is a bug. I will have to see if I can reproduce it.

[Joshua-Schroijen]

I have dug deeper into it and I think that pipx has an inherit issue with truststore and thus with running in environments with TLS interception. I have made a feature request to address this. I hope it gains traction because projects like pipx would be really awesome to have in enterprise environments.