Trust the PyPI hosts for pipenv's pip

pipenv installs through pip, which skips the plaintext index on an
untrusted host, so `firewall pipenv install six` fetched nothing and
failed with "No matching distribution found". Set PIP_TRUSTED_HOST as
the pip recipe already does.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

core/src/aliasing/forward.rs

@@ -66,16 +66,12 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
     }
 
     info!(method = %req.method(), %url, "forwarding");
-    // Only an HTTPS registry was downgraded to reach us, so only it is upgraded back and rewritten.
-    let tls = firewall.is_https_url(&url);
-    let index = tls && firewall.is_index_url(&url);
+    let index = firewall.is_index_url(&url);
     let (mut parts, body) = req.into_parts();
-    if tls {
-        let Ok(uri) = url.parse() else {
-            return Ok(text(400, "firewall: expected an absolute URL\n"));
-        };
-        parts.uri = uri;
-    }
+    let Ok(uri) = url.parse() else {
+        return Ok(text(400, "firewall: expected an absolute URL\n"));
+    };
+    parts.uri = uri;
 
     let client = DecompressionLayer::new().into_layer(EasyHttpWebClient::default());
     let response = match client.serve(Request::from_parts(parts, body)).await {

core/src/aliasing/managers/pipenv.rs

@@ -9,6 +9,8 @@ pub static PIPENV: Manager = Manager {
         ("http_proxy", PROXY),
         ("https_proxy", PROXY),
         ("PIPENV_PYPI_MIRROR", PYPI_SIMPLE),
+        // pipenv installs through pip, which skips a plaintext index on a host it doesn't trust.
+        ("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
     ],
     args: &[],
 };

core/src/firewall.rs

@@ -50,11 +50,6 @@ impl Firewall {
         hosts
     }
 
-    pub fn is_https_url(&self, url: &str) -> bool {
-        let host = host_of(url);
-        self.config.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
-    }
-
     pub fn is_index_url(&self, url: &str) -> bool {
         self.config.registries.iter().any(|r| r.index && r.host() == host_of(url))
     }

core/tests/forward.rs

@@ -1,9 +1,7 @@
 use firewall::aliasing::forward::downgrade;
 use firewall::http::https_url;
-use firewall::{aliasing, Firewall, FirewallConfig};
+use firewall::Firewall;
 use rama::http::{Body, Request};
-use std::io::{Read, Write};
-use std::net::{TcpListener, TcpStream};
 
 fn request(target: &str, host: Option<&str>) -> Request {
     let mut builder = Request::builder().method("GET").uri(target);
@@ -37,25 +35,6 @@ fn requests_always_go_out_over_tls() {
     assert_eq!(https_url(&request("/six", None)), None);
 }
 
-#[test]
-fn a_plain_http_upstream_is_not_upgraded() {
-    let upstream = TcpListener::bind("127.0.0.1:0").expect("bind");
-    let addr = upstream.local_addr().expect("address");
-    std::thread::spawn(move || {
-        let (mut stream, _) = upstream.accept().expect("accept");
-        let _ = stream.read(&mut [0; 4096]);
-        let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
-    });
-
-    let port = aliasing::spawn(0, FirewallConfig::default()).expect("spawn");
-    let mut proxy = TcpStream::connect(("127.0.0.1", port)).expect("connect");
-    let request = format!("GET http://{addr}/x HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n");
-    proxy.write_all(request.as_bytes()).expect("write");
-    let mut response = String::new();
-    proxy.read_to_string(&mut response).expect("read");
-    assert!(response.starts_with("HTTP/1.1 200") && response.ends_with("ok"), "{response}");
-}
-
 #[tokio::test]
 async fn downgrade_touches_known_hosts_in_text_only() {
     let text = b"https://pypi.org/x https://example.com/y".to_vec();