Index URLs containing unescaped "@" in username cause "Failed to parse" error in pip 19.2

[bomri]

Environment

• pip version: 19.2
• Python version: 3.6.8
• OS: ubuntu 18.04

Description
After updating to pip-19.2 from pip-19.1.1 installing packages with --extra-index-url doesn't work and I get:

ERROR: Could not find a version that satisfies the requirement package_name (from versions: none)
ERROR: No matching distribution found for package_name

going back to 19.1.1 works fine

[shay108]

+1
Yup. Happened to us as well.

[TTRh]

We also have issue with pip-19.2 when using specific index url :

Looking in indexes: https://<email.com>:****@<artifactory_host>/artifactory/api/pypi/pypi-virtual/simple
Collecting setuptools
ERROR: Could not install packages due to an EnvironmentError: Failed to parse: https://<email.com>:[secure]@<artifactory_host>/artifactory/api/pypi/pypi-virtual/simple/setuptools/

It's working fine with pip-19.1.1. Could it be related ?

[cletomartin]

@TTRh just saw the same and open #6776. Not sure if it should be handled in the same issue though.

[chrahunt]

@bomri, can you please re-run with --verbose and provide the output?

[brainerazer]

Might be related to:
urllib3/urllib3#1640
urllib3/urllib3#1586

[philipp-lein]

We had the same problem with a special character in our password.

[pradyunsg]

Hi folks! Thanks for filing this issue and chiming in here.

It'd be best that if you're facing this issue, that you use GitHub's reactions on the first post and subscribe to this issue. That way we can avoid "me too" comments which don't really add much value to the discussion.

It'll make it easier for the maintainers to discuss how to go about resolving this issue, in this issue itself and provide updates to y'all more easily. 🙃

[bomri]

@chrahunt running with --verbose I get 404 on the pypi.org as expected (since the package doesn't exists there) but from my own pypi server I get:

403 Client Error: Forbidden for url:...

maybe it is related to special characters in the token id like @brainerazer mentioned

[slafs]

This has bitten us too. Not sure if this issue is related to the ones @brainerazer linked for urllib3. Our issue appears when trying to download a released .zip package from GitHub with an access token. So stuff like pip install https://<my-access-token>@github.com/myorganization/myprivaterepo/archive/myrelease.zip#egg=mypackage doesn't work anymore with pip 19.2 (works for 19.1.1 as someone already mentioned).

I've created an empty private repo, with an empty release to test that. The output for pip install -vvv ... can be found here:

• for pip 19.2,
• for pip 19.1.1 (with expected setup.py not found error).

The issue/difference can be observed around Starting new HTTPS connection (1): github.com:443.