Support authentication for non pypi package indices

[instinct-vfx]

We are running an internal pypi index (in our case Nexus) as a proxy (for blacklisting and whitelisting) as well as for internal packages. rez-pip fails for this index because it needs authentication which is not forwarded for the download.

To support this pip configuration must be taken into account for both the index URL as well as auth.

Because there are many ways to configure pip (various config files and environment variables) it seems the best to me to just piggy back pip's own configuration mechanisms (either through calling pip or using it's internal modules) to read the respective config settings. This should also make things cross platform automatically (as opposed to parsing config files or env vars directly).

[JeanChristopheMorinPerso]

Ok, thanks. I'm convinced with using pip's internals. I'll see what I can do.

[JeanChristopheMorinPerso]

One thing we could do is to replace the download code with a call to pip download -r <file>.

[JeanChristopheMorinPerso]

Though, technically it should not be required. Most the the complexity is in the solver (supporting environment variables, pip configs, etc) and we already use pip for that. So for the downloads, I think the only thing left to implement is https://pip.pypa.io/en/stable/topics/authentication/:

• Basic auth: Passing authentication into the URL if --index-url https://username@password:host.com is passed to rez-pip. There are two possibilities here. pip will give us that same URL as-is in the JSON output, or it won't. If it does, we have nothing to do. If it doesn't we can relatively easily re-inject them. We might have to use pip config list to get the active configs.
• netrc: This should be straight forward.
• keyring: This I believe should also be easy to implement. We would have to support https://pip.pypa.io/en/stable/topics/authentication/#configuring-pip-s-keyring-usage too.

[instinct-vfx]

I was not aware of pip download to be honest. It seems like a very easy way to support every auth config pip does with a single call, no? That introduces the least complexity and also the least re-implementation of features that exist in pip already. Or maybe importing the DownloadCommand class and execute from python without shelling out.