{"action":"created","issue":{"url":"https://api.github.com/repos/pypa/pip/issues/2809","labels_url":"https://api.github.com/repos/pypa/pip/issues/2809/labels{/name}","comments_url":"https://api.github.com/repos/pypa/pip/issues/2809/comments","events_url":"https://api.github.com/repos/pypa/pip/issues/2809/events","html_url":"https://github.com/pypa/pip/issues/2809","id":79624995,"number":2809,"title":"No way to track down \"github.com is not a trusted host\"","user":{"login":"thanatos","id":90853,"avatar_url":"https://avatars.githubusercontent.com/u/90853?v=3","gravatar_id":"","url":"https://api.github.com/users/thanatos","html_url":"https://github.com/thanatos","followers_url":"https://api.github.com/users/thanatos/followers","following_url":"https://api.github.com/users/thanatos/following{/other_user}","gists_url":"https://api.github.com/users/thanatos/gists{/gist_id}","starred_url":"https://api.github.com/users/thanatos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thanatos/subscriptions","organizations_url":"https://api.github.com/users/thanatos/orgs","repos_url":"https://api.github.com/users/thanatos/repos","events_url":"https://api.github.com/users/thanatos/events{/privacy}","received_events_url":"https://api.github.com/users/thanatos/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-22T21:51:36Z","updated_at":"2015-12-09T16:52:33Z","closed_at":null,"body":"As mentioned in #2424, I see a ton of these:\r\n\r\n```\r\nRequirement already up-to-date: simplejson>=2.5.0 in ./env/lib/python2.7/site-packages (from uritemplate>=0.6->google-api-python-client->foo->-r requirements.txt (line 34))\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nThis repository located at github.com is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host github.com'.\r\nRequirement already up-to-date: pycparser in ./env/lib/python2.7/site-packages (from \r\n```\r\n\r\nWhile the problem is likely in my stuff, `pip` leaves me with no actionable feedback here. I think `pip` believes that it has a dependency link that is a URL to `http://github.com` — when it outputs this message, can it also output where it got that dependency link? (So that I can then track it down to correct it to use HTTPS.)\r\n\r\nMy understand is that this is going to become more important once `--trusted-host` is mandatory, and I'd much rather secure the communication."},"comment":{"url":"https://api.github.com/repos/pypa/pip/issues/comments/163321796","html_url":"https://github.com/pypa/pip/issues/2809#issuecomment-163321796","issue_url":"https://api.github.com/repos/pypa/pip/issues/2809","id":163321796,"user":{"login":"tomprince","id":283816,"avatar_url":"https://avatars.githubusercontent.com/u/283816?v=3","gravatar_id":"","url":"https://api.github.com/users/tomprince","html_url":"https://github.com/tomprince","followers_url":"https://api.github.com/users/tomprince/followers","following_url":"https://api.github.com/users/tomprince/following{/other_user}","gists_url":"https://api.github.com/users/tomprince/gists{/gist_id}","starred_url":"https://api.github.com/users/tomprince/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomprince/subscriptions","organizations_url":"https://api.github.com/users/tomprince/orgs","repos_url":"https://api.github.com/users/tomprince/repos","events_url":"https://api.github.com/users/tomprince/events{/privacy}","received_events_url":"https://api.github.com/users/tomprince/received_events","type":"User","site_admin":false},"created_at":"2015-12-09T16:52:33Z","updated_at":"2015-12-09T16:52:33Z","body":"I encountered this with a `dependency_link` of `git+https://github.com/ClusterHQ/testtools@clusterhq-fork#egg=testtools-1.8.2chq1`. It looks like it does go on to install it though."}}