Skip to content

fix: pass --no-input and bounded timeouts to pip - #246

Merged
FeodorFitsner merged 3 commits into
mainfrom
fix/pip-no-input-timeout
Sep 2, 2026
Merged

fix: pass --no-input and bounded timeouts to pip#246
FeodorFitsner merged 3 commits into
mainfrom
fix/pip-no-input-timeout

Conversation

@ndonkoHenri

Copy link
Copy Markdown
Collaborator

Problem

When an index answers 401 — a corporate mirror, an authenticating proxy — pip prompts for credentials. The package command starts pip with a stdin pipe that nothing writes to and nothing closes, so the prompt can never be answered, and pip blocks forever. flet build shows this as a frozen Packaging Python app... with no error, no progress and no timeout.

The prompt is also invisible: pip writes User for <host>: to stdout with no trailing newline, and this command routes child stdout through verbose(), which flet build only enables at -vv. So the user gets a spinner and nothing else.

Reproduced against a local index returning 401 WWW-Authenticate: Basic, driving the same pip the tool bundles (26.1.2, from the pinned python-build-standalone distro), with stdin held open the way Process.start leaves it:

as on main:     HUNG — killed at 30s | stdout=76B stderr=0B
                last output: "User for 127.0.0.1:52836: "
with this PR:   rc=1 in 1.2s | stdout=50B stderr=135B
                last output: "ERROR: No matching distribution found for foo"

Change

--no-input makes pip fail with a readable error instead of prompting. --timeout 30 --retries 3 pins the network bounds on the command line so they hold regardless of a user's pip.conf or PIP_* environment (CLI args win over both). pip's own defaults are 15 s / 5 retries, so this is not adding bounds where there were none — it is trading two retries for twice the patience per attempt, which suits the slow and throttled links these reports come from, and makes the worst case independent of ambient config.

Refs flet-dev/flet#5989, flet-dev/flet#5013, flet-dev/flet#5507.

Scope

This closes one cause of the "packaging hangs" family, not all of them. Two things it deliberately does not cover:

  • *A child that floods stderr still deadlocks.: runExec drains only stdout while the child runs, so a chatty or failing wheel build wedges on the unread stderr pipe — ~1 KB is enough on Windows. That is the other half of bug: flet build windows gets stuck on packaging python app; and extension template generation issues flet#5507 and will be thought of separately.
  • Closing the child's stdin is the complementary primitive. Worth noting the two interact: with stdin closed but no --no-input, pip dies with a 9.9 KB EOFError traceback — which on Windows is itself large enough to wedge the undrained stderr pipe. --no-input is the better fix precisely because it never generates that output.

pip prompts for credentials when an index answers 401 — a corporate mirror, an
authenticating proxy. The prompt has no trailing newline and this process has no
interactive stdin, so it can never be answered or even seen, and the install
blocks forever with "Looking in indexes: ..." as its last output. That is what
`flet build` users see as a frozen "Packaging Python app..." (flet-dev/flet#5989,
#5013, #5507).

--no-input makes it a readable error instead. --timeout/--retries bound each
attempt rather than inheriting whatever ambient pip config applies.
Pre-existing drift, separated from the fix so it doesn't bury it.
@FeodorFitsner
FeodorFitsner merged commit fa0502d into main Sep 2, 2026
52 of 58 checks passed
@FeodorFitsner
FeodorFitsner deleted the fix/pip-no-input-timeout branch September 2, 2026 20:34
FeodorFitsner added a commit that referenced this pull request Sep 2, 2026
main landed the pip --no-input / bounded-timeout fix (#246) under a new
`## 4.5.2` heading in serious_python's changelog, which collided with the
`## 4.6.0` heading this branch adds at the same spot.

4.5.2 was never published -- #246 added the heading but left every pubspec,
the podspec and build.gradle.kts at 4.5.1 -- so there is no released 4.5.2 for
users to have seen. Its bullet moves into 4.6.0 and the heading goes away,
rather than shipping an empty version number between 4.5.1 and 4.6.0.

The pip bullet goes last in the section, after the runtime bullets it is
unrelated to. package_command.dart merged clean and is byte-identical to main.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants