Offline installer download - pymanager does not respect user/pass with authenticating proxy

[pandel]

Hi!

I am using Windows OS...

If I try to download a Python version via an authenticating proxy (don't have any other chance), pymanager fails, because it does not take user/password into account, even though it seems to find the system proxy which is setup under Windows:

Failed to download using BITS. Retrying with fallback method.
# ERROR:
Traceback (most recent call last):
 File "manage\urlutils.py", line 450, in urlretrieve
 File "manage\urlutils.py", line 137, in _bits_urlretrieve
OSError: [WinError -2145844841] Download error: HTTP-Status 407: Proxy authentication required.

How to fix this? I am unable to setup any additional environment variables, as this is not allowed for the standard user, so pymanager has to figure this out on its own.

Regards,
Holger

[zooba]

You might be able to work around it by setting PYMANAGER_ENABLE_WINHTTP_DOWNLOAD=0 and PYMANAGER_ENABLE_BITS_DOWNLOAD=0, which should cause it to fall back to a Powershell hack.

Though if not being able to set environment variables extends to those, then you're just out of luck until we come up with a fix. Your best option would be to use an offline install on another machine and copy the runtime packages to this one, then install from local packages. If you're setting up machines as an admin, then this is possible to configure for all users through the registry or configuration files (see the docs below where I linked above).

[pandel]

Ah ok, thanks for the information. I already created an offline install package, but wanted to to let you know about the problem. I already created an offline package using the exe and the /layout parameter, which indeed is the most best option for me.

[zooba]

@pandel The new beta I just released should have a fix for the proxy issue, but I don't have the setup to test it. Based on the documentation, it should pick up the system proxy credentials automatically. Would be great if you could try it out and let me know

[pandel]

@zooba Hi! I tried and it worked now. Many thanks! As our employees are not allowed to setup software on their own, this seems to be scriptable with our software deployment system, which is good!

Just in case: in our environment, proxy authentication is done via Kerberos, so the user does not have to enter any credentials, if everything works. You change to the install manager does seem to pick up on this. BUT: what happens, if the proxy falls back to basic auth? Does the user get the chance to enter a user/password combination?

And, may I add, I noticed a few more things on first try even if they seem unrelated to the proxy problem:

• the pymanager list command lists a Python runtime I manully installed AND removed before the the test with the pymanager -> why? sadly, the -v does not give any path information regarding this runtime
• it won't install for all users, even if I start it as admin, to C:\Program Files\Python, but to the user folder -> this is definitely not smart on centrally managed machines and environments with a multi user setup
• it does not add the path to system PATH variable
• on uninstall, it does not completely remove C:\Users\<username>\AppData\Local\Python, there is unnecessary residue
• the install log, atm under C:\Users\<username>\AppData\Local\Temp, does not log anything -> I expected a decent and more or less debug like log to see exactly what's going on

At least for points 2 and 3, there should be command line parameters to choose for the admin or script who is installing it...

[zooba]

what happens, if the proxy falls back to basic auth? Does the user get the chance to enter a user/password combination?

I don't think so. From our perspective, it's all offloaded to the OS's download manager at this point, so it might pop something up. There's a separate request for #204 that would probably be the way to provide specific credentials for a single run (i.e. not in the system config).

• the pymanager list command lists a Python runtime I manully installed AND removed before the the test with the pymanager -> why?

Interesting. Usually it means that something wasn't cleaned up properly - if it's marked as an unmanaged runtime ("found, but cannot be updated or uninstalled") then that'll be some registry keys (known issue with the old installers). py list --format csv or --format json is how you get maximum information out of this command, so it may help.

• it won't install for all users, even if I start it as admin, to C:\Program Files\Python, but to the user folder

Yes, this is by design. The only admin controls we have are to let you override the default source, which will let you limit what your users may install (by providing your own version of index.json), but we no longer want to support scenarios where users aren't managing their own actual install of the runtime. Other distributors may add tooling for it, or if you're brave then you can just copy files into place and do your own registry keys, but we need to optimise the range of cases that we have to worry about, and this one didn't make the cut for us.

• it does not add the path to system PATH variable

Similar reasoning. The MSI installer should add PyManager to the system PATH variable, but the MSIX installer is intentionally per-user (as determined by Microsoft, not chosen by us).

• on uninstall, it does not completely remove C:\Users\<username>\AppData\Local\Python, there is unnecessary residue

Again, partly dictated by Microsoft (apps can't run arbitrary code on uninstall), but we also like that you can use the manager to install Python, remove the manager, and still have your install. py uninstall --purge will clean everything up, so if that's the last thing you run before uninstall, it'll be clean.

• the install log, atm under C:\Users\<username>\AppData\Local\Temp, does not log anything

For each py install ... it should log plenty. Each of my own python_install_...log files are about 18-20KB.

Installing the install manager itself won't log much - it really doesn't do a lot, so that isn't very surprising. Once the install manager is in place is when the interesting stuff begins.

Hope that helps explain some of the design decisions involved.

[pandel]

@zooba
Many thanks for your detailed explanations. That did make things clear, even though I absolutely cannot understand the design decisions at all, especially leaving things up to the user in corporate environments, in current times, is not the way to go at all. Things are getting worse regarding security concerns and from a sysadm perspective, transparency and control are a must in my opinion. I just let users do things I want them to be able to, not what they want. Therefor, we actually do not allow Microsoft Store, MSIX installs, app control without AppLocker, etc..

Anyhow, you made things clear and I am thankful for that. Just regarding the log, my log was 0kb in the end, but the install went fine. And regarding the unmanaged part, might be that there is some leftover in the registry. I'll try to find and fix it myself.

Whatever, keep up the good work :D!

Regards,
Holger