Support credentials from environment variables.

docs/html/reference/pip_install.rst

@@ -804,6 +804,16 @@ Options
 .. pip-index-options::
 
 
+Environment Variables
+*********************
+
+It is possible to specify a username and password for accessing a pip repository which requires authentication.
+
+Use the environment variables ``PIP_USERNAME`` and ``PIP_PASSWORD`` to specify credentials.
+
+Note that these credentials will be used for all indexes. See the other means of specifying credentials if you use multiple indexes requiring different credentials.
+
+
 .. _`pip install Examples`:
 
 Examples

news/4789.feature

@@ -0,0 +1 @@
+Allow credentials from environment variables 'PIP_USERNAME' and 'PIP_PASSWORD'.

src/pip/_internal/download.py

@@ -279,6 +279,22 @@ def _get_new_credentials(self, original_url, allow_netrc=True,
                 logger.debug("Found credentials in index url for %s", netloc)
                 return index_url_user_password
 
+        # Check for creds in environment
+        user_var = 'PIP_USERNAME'
+        passwd_var = 'PIP_PASSWORD'
+        msg = "Found '{fv}' env variable, but not '{nv}'. Ignoring '{fv}'."
+        env_username = os.environ.get(user_var)
+        env_password = os.environ.get(passwd_var)
+        if env_username:
+            if env_password:
+                logger.debug("Found credentials in environment.")
+                return env_username, env_password
+
+            logger.warning(msg.format(fv=user_var, nv=passwd_var))
+
+        if env_password:
+            logger.warning(msg.format(fv=passwd_var, nv=user_var))
+
         # Get creds from netrc if we still don't have them
         if allow_netrc:
             netrc_auth = get_netrc_auth(original_url)

tests/unit/test_download.py

@@ -1,5 +1,6 @@
 import functools
 import hashlib
+import logging
 import os
 import sys
 from io import BytesIO
@@ -512,6 +513,72 @@ def test_get_index_url_credentials():
     assert get("http://example.com/path3/path2") == (None, None)
 
 
+def test_get_env_credentials(request, caplog):
+    def reset_env():
+        del os.environ['PIP_USERNAME']
+        del os.environ['PIP_PASSWORD']
+
+    request.addfinalizer(reset_env)
+
+    os.environ['PIP_USERNAME'] = 'foo'
+    os.environ['PIP_PASSWORD'] = 'bar'
+
+    with caplog.at_level(logging.DEBUG):
+        auth = MultiDomainBasicAuth()
+        get = functools.partial(
+            auth._get_new_credentials,
+            allow_netrc=False,
+            allow_keyring=False
+        )
+
+        # Check resolution of credentials from env
+        assert get("http://envexample.com/pathx") == ('foo', 'bar')
+
+    assert "Found credentials in environment" in caplog.text
+
+
+def test_get_env_credentials_only_username(request, caplog):
+    def reset_env():
+        del os.environ['PIP_USERNAME']
+
+    request.addfinalizer(reset_env)
+
+    os.environ['PIP_USERNAME'] = 'foo'
+
+    auth = MultiDomainBasicAuth()
+    get = functools.partial(
+        auth._get_new_credentials,
+        allow_netrc=False,
+        allow_keyring=False
+    )
+
+    # Check resolution of credentials from env
+    assert get("http://envexample.com/pathx") == (None, None)
+
+    assert "but not 'PIP_PASSWORD'" in caplog.text
+
+
+def test_get_env_credentials_only_password(request, caplog):
+    def reset_env():
+        del os.environ['PIP_PASSWORD']
+
+    request.addfinalizer(reset_env)
+
+    os.environ['PIP_PASSWORD'] = 'bar'
+
+    auth = MultiDomainBasicAuth()
+    get = functools.partial(
+        auth._get_new_credentials,
+        allow_netrc=False,
+        allow_keyring=False
+    )
+
+    # Check resolution of credentials from env
+    assert get("http://envexample.com/pathx") == (None, None)
+
+    assert "but not 'PIP_USERNAME'" in caplog.text
+
+
 class KeyringModuleV1(object):
     """Represents the supported API of keyring before get_credential
     was added.