{"id":15946208,"url":"https://github.com/mike10004/shypip","last_synced_at":"2025-10-05T16:54:57.143Z","repository":{"id":68507631,"uuid":"571244428","full_name":"mike10004/shypip","owner":"mike10004","description":null,"archived":false,"fork":false,"pushed_at":"2022-12-05T01:46:41.000Z","size":124,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-05T16:54:55.421Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mike10004.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-11-27T16:15:44.000Z","updated_at":"2022-12-01T02:39:22.000Z","dependencies_parsed_at":null,"dependency_job_id":"cdd13874-a901-42b2-9966-2cb16786436a","html_url":"https://github.com/mike10004/shypip","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/mike10004/shypip","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mike10004%2Fshypip","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mike10004%2Fshypip/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mike10004%2Fshypip/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mike10004%2Fshypip/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mike10004","download_url":"https://codeload.github.com/mike10004/shypip/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mike10004%2Fshypip/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278486276,"owners_count":25994941,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-07T09:20:42.542Z","updated_at":"2025-10-05T16:54:57.108Z","avatar_url":"https://github.com/mike10004.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# shypip\n\n**shypip** (Secure Hybrid Pip) is a pip wrapper that improves security in \nhybrid public-private repository configurations.\n\n## Installation\n\n### Linux/MacOS\n\nCreate a virtual environment and activate it:\n\n    $ python3 -m venv venv   # or python3 -m virtualenv venv\n    $ source venv/bin/activate\n\nInstall the package from the github repository:\n\n    (venv) $ pip install git+https://github.com/mike10004/shypip.git\n    (venv) $ shypip --help  # prints pip help text\n\n### Windows\n\nTODO (not tested on Windows)\n\n## Usage\n\nUsage is exactly the same as `pip`. If the `download` or `install` command is \nexecuted and a package dependency has installation candidates from multiple\nrepositories, the installation will fail instead of pip selecting the candidate \nwith highest version.\n\nThese environment variables are relevant to application behavior:\n\n* SHYPIP_UNTRUSTED - comma delimited list of domains that are untrusted; default is `pypi.org`\n* SHYPIP_POPULARITY - minimum number of downloads to be eligible for installation; default is one million\n* SHYPIP_CACHE - pypistats cache directory; default is under system temp directory\n* SHYPIP_PYPISTATS_API_URL - pypistats API URL; default is `https://pypistats.org/api`\n* SHYPIP_MAX_CACHE_AGE - max age in minutes before pypistats cache files are considered stale; default is `1440`\n* SHYPIP_DUMP_CONFIG - if 1, print config to standard error and exit\n* SHYPIP_PROMPT - canned answer to shypip install permission prompt\n* SHYPIP_LOG_FILE - pathname of log file to append to\n\nA package popularity query returns three values: downloads in the last day, \nlast week, and last month. If the popularity threshold (value of \nSHYPIP_POPULARITY environment variable) is an integer, then all three values \nmust be exceed the threshold value for the threshold to be satisfied. More \ngranular control may be exercised by defining the threshold in URL query \nstring syntax, e.g. `SHYPIP_POPULARITY='last_day=100\u0026last_week=200'`. To allow \na threshold to be satisfied by any popularity value instead of all values, use \nthe prefix `or:`, e.g. `SHYPIP_POPULARITY='or:last_day=100\u0026last_month=300'`.\n\n## Demonstration\n\nTo see how it works, you can set up a local repository that you consider \"trusted\" and\npopulate it with versions of packages that also exist in PyPI. (These instructions assume\nyou created a virtual environment that has **shypip** installed, as described in the \n**Installation** section above.) Here we create a local repository that contains a \nsingle package, `sampleproject` version 1.3.0. The public repository has many other \nversions, including version 1.3.1. We will demonstrate the use of shypip in the common\nuse case where a project declares a loose dependency `sampleproject~=1.3.0`, which may \nbe satisfied by either version 1.3.0 or version 1.3.1.\n\n    (venv) $ mkdir -p demo/sampleproject\n    (venv) $ pip download --no-deps --dest demo/sampleproject sampleproject==1.3.0\n    (venv) $ python -m http.server 8080\n\nThat starts an HTTP server to serve your mini repository. Now open another terminal window\nto try out **shypip**:\n\n    $ source $VENV_DIR/bin/activate\n    $ export SHYPIP_LOG_FILE=/tmp/shypip.log\n    $ export SHYPIP_POPULARITY=100\n    (venv) $ shypip install 'sampleproject~=1.3.0' --extra-index-url http://localhost:8080/\n    Looking in indexes: https://pypi.org/simple, http://localhost:8080/\n    shypip: installation candidate sampleproject 1.3.1 from files.pythonhosted.org satisfies popularity threshold; allow (yes/no)? yes\n    Collecting sampleproject~=1.3.0\n      Downloading sampleproject-1.3.1-py3-none-any.whl (4.2 kB)\n    Collecting peppercorn\n      Downloading peppercorn-0.6-py3-none-any.whl (4.8 kB)\n    Installing collected packages: peppercorn, sampleproject\n    Successfully installed peppercorn-0.6 sampleproject-1.3.1\n\nInstallation pauses for user input because packages from both private (trusted) \nand public (untrusted) sources are available, and the package from the public \nrepository satisfies the (low) popularity threshold of 100. If the user enters \n'yes', the public package is installed fails, and if the user enters 'no', the \nprivate package is installed.\n\nIf any of the following conditions is true, the private package is installed \nwithout any prompt:\n\n* packages from private and public sources are available, and the private\n  package version is higher\n* packages from private and public sources are available, but the public \n  packages do not satisfy the popularity threshold\n\n# Known Issues\n\n* relies on internal API of pip~=22.3.1, so compatibility is limited\n* does not protect against typosquatting or bad dependency declaration; will \n  allow installation of package from public (untrusted) repository if no \n  package that satisfies a requirement is available from the private \n  (trusted) repository\n\n# Background\n\nThe code in this repository was produced as part of a project for a computer \nsecurity course. Several people were involved in its design, implementation, \nand evaluation, and for their privacy their names are not included in the \npackage metadata file, but their contributions are appreciated.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmike10004%2Fshypip","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmike10004%2Fshypip","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmike10004%2Fshypip/lists"}