Using "pip" behind a corporate firewall

Pip behind a corporate firewall

The tldr is:

1. Pip 23.3 or newer "just works" after you add a simple snippet to your config file.

   ; %AppData%\pip\pip.ini
   ; "${XDG_HOME-$HOME/.config}/pip/pip.ini"
   [global]
   use-feature = 
   	truststore

2. However, said snippet will break older versions of pip.
   • In particular, pip < 23.3, >= 22.2 will break, complaining that you need to install the "truststore" package before you can install any packages—a perfect "catch 22".
3. As of the last time I checked (CPython 3.12.1), ensurepip, which is what's used to bootstrap virtual environments) installs one of these broken versions of pip.
   • If you create your venvs with PyPA's "virtualenv" (specifically virtualenv >= 20.24.6) rather than venv, you will get a version of pip that works.
     • If you're using PyPA's "build" tool, it will automatically switch to using virtualenv if available, which means your "isolated" builds will work behind a corporate firewall.