pip proxy configuration and index checks

python3 -I -m pip --version
python3 -I -m pip index --help

import getpass
import os
import subprocess
import sys
import tempfile
import warnings
from urllib.parse import quote, urlsplit


def require_runtime():
    # Check the same isolated interpreter before asking for any credential.
    probe = (
        "import sys, pip; from pip._vendor.packaging.version import Version; "
        "v=Version(pip.__version__); "
        "sys.exit(0 if sys.version_info >= (3, 10) and "
        "v >= Version('26.2.1') and not v.is_prerelease and "
        "not v.is_devrelease else 1)"
    )
    try:
        result = subprocess.run(
            [sys.executable, "-I", "-c", probe],
            env={"PATH": os.defpath}, stdin=subprocess.DEVNULL,
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
            timeout=5, check=False,
        )
    except (OSError, subprocess.TimeoutExpired):
        raise ValueError("Runtime check failed") from None
    if result.returncode != 0:
        raise ValueError("Use Python 3.10+ with stable pip 26.2.1+")


def check_config(server, username, password):
    if any(ord(char) <= 32 or ord(char) == 127 for char in server):
        raise ValueError("Invalid gateway")
    proxy = urlsplit(server)
    if (proxy.scheme != "http" or not proxy.hostname or
            proxy.port is None or not 1 <= proxy.port <= 65535 or
            proxy.username is not None or proxy.password is not None or
            proxy.path not in ("", "/") or proxy.query or proxy.fragment):
        raise ValueError("Use an HTTP gateway with a port and no credentials")
    if (not username or not password or ":" in username or
            any(ord(char) < 32 or ord(char) > 126
                for char in username + password)):
        raise ValueError("This example requires printable ASCII credentials")
    address = "http://{}:{}@{}".format(
        quote(username, safe=""), quote(password, safe=""), proxy.netloc)
    # Start fresh: no inherited index tokens, proxy exclusions, pip logs,
    # certificate overrides, Python paths, or package-manager settings.
    child_env = {
        "PATH": os.defpath,
        "PIP_CONFIG_FILE": os.devnull,
        "NETRC": os.devnull,
        "PIP_PROXY": address,
        "PIP_KEYRING_PROVIDER": "disabled",
        "PYTHON_KEYRING_BACKEND": "keyring.backends.null.Keyring",
    }
    command = [
        sys.executable, "-I", "-m", "pip", "index", "versions", "pip",
        "--index-url", "https://pypi.org/simple",
        "--disable-pip-version-check", "--no-cache-dir", "--no-input",
        "--retries", "0", "--timeout", "10",
    ]
    return command, child_env


def run_check(server, username, password):
    require_runtime()
    command, child_env = check_config(server, username, password)
    with tempfile.TemporaryDirectory(prefix="pip-proxy-check-") as directory:
        try:
            result = subprocess.run(
                command, env=child_env, cwd=directory,
                stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL, timeout=30, check=False,
            )
        except subprocess.TimeoutExpired:
            print("Index check stopped after its process timeout.")
            return 1
        except OSError:
            print("Could not start the selected Python interpreter.")
            return 1
    if result.returncode != 0:
        print("Index check failed. Raw pip output was not displayed.")
        return 1
    print("Index query completed. No package was installed.")
    return 0


def main():
    try:
        require_runtime()
    except ValueError:
        print("Use a supported Python 3.10+ environment with stable pip 26.2.1+.")
        return 1
    if os.name != "posix" or not sys.stdin.isatty():
        print("Use a macOS or Linux terminal for hidden credential input.")
        return 1
    server = os.environ.get("PROXY_SERVER", "http://gw.portproof.org:7000")
    with warnings.catch_warnings():
        warnings.simplefilter("error", getpass.GetPassWarning)
        username = getpass.getpass("Full proxy username: ")
        password = getpass.getpass("Proxy password: ")
    return run_check(server, username, password)


if __name__ == "__main__":
    try:
        sys.exit(main())
    except (ValueError, EOFError, KeyboardInterrupt, OSError, getpass.GetPassWarning):
        print("Check cancelled or setup invalid; credentials were not displayed.")
        sys.exit(1)