don't prompt to unlock keychain unless it's needed

[duckinator]

i suspect this automagically happens upon importing stuff from twine, but i'm not sure. if that is the case, we can just do a non-top-level import in bork.pypi.upload(...).

[duckinator]

I can't remember who told me they were encountering this, but I can't reproduce it on Fedora 31 using KDE. I'll need to figure out who encountered it and ask for more information about their environment.

[nicoonoclaste]

@duckinator I encountered it too, but even on non-bork things (like pip install) so I suspect some commonplace package hecked up really hard.

You can get hints that something is trying to use the keyring, by putting some garbage in ~/.config/python_keyring/keyringrc.cfg and looking for this warning:

WARNING: Keyring config file contains incorrect values.
Config file: ${HOME}/.config/python_keyring/keyringrc.cfg

I guess one could also use the kernel's audit capabilities or somesuch, to log accesses to that file.

[duckinator]

It looks like https://github.com/pypa/pep517/blob/master/pep517/envbuild.py#L92 is the last thing called before it happens, so I'm wondering if it's a pip thing.

$ bork build --verbose                                                              
pep517.envbuild INFO Temporary build environment: /tmp/pep517-build-env-2r4_fyn7
pep517.envbuild INFO Calling pip to install ['setuptools > 42', 'wheel']  
pep517.envbuild ERROR Keyring is skipped due to an exception: File contains no section headers.                        
pep517.envbuild ERROR file: '/home/puppy/.config/python_keyring/keyringrc.cfg', line: 1                                
pep517.envbuild ERROR 'xxxx\n'    

[duckinator]

Yes, it is:

$ mkdir x; python3 -m pip install --ignore-installed --prefix x 'setuptools > 42' 'wheel'
Keyring is skipped due to an exception: File contains no section headers.
file: '/home/puppy/.config/python_keyring/keyringrc.cfg', line: 1
'xxxx\n'

[nicoonoclaste]

Yeah, just found a plethora of pip issues about keyring support.

Looks like there is consensus on making keyring opt-in but nobody actually implemented anything.
I think that pip should additionally be patched not to interact with the keyring unless auth is required, though

[duckinator]

We don't use pep517 to build anymore, we use build. I think this got fixed when that happened, since I can't reproduce it anymore.

If anyone encounters this again, please open a new issue for it.