Show deprecation warning against --trusted-host with port part.

[frostming]

Following #6705 #6709

[cjerdonek]

@frostming Does pip’s code support trusting an individual host-port combination without also trusting the host as a whole?

[frostming]

@cjerdonek For HTTPS, yes, but HTTP will abort with a warning.

So we should deprecate the usage of a host with a port part.

[cjerdonek]

So we should deprecate the usage of a host with a port part.

I'm not sure yet. If it's useful, maybe we should be officially supporting that use case, and then update the documentation of --trusted-host to reflect that. Do you have an opinion? Also, maybe one of us can open a new issue, and then I can mark it "discussion needed."

[cjerdonek]

HTTP will abort with a warning.

Can you show what that abort and warning looks like, btw?

[frostming]

@cjerdonek Here it is

$ pip install -i http://localtest.me:5000 urllib3 --trusted-host localtest.me:5000
Looking in indexes: http://localtest.me:5000
Collecting urllib3
  The repository located at localtest.me is not a trusted or secure host and is being ignored. If this repository is available via HTTPS we recommend you use HTTPS instead, otherwise you may silence this warning and allow it anyway with '--trusted-host localtest.me'.
  Could not find a version that satisfies the requirement urllib3 (from versions: )
No matching distribution found for urllib3

I'm not sure yet. If it's useful, maybe we should be officially supporting that use case, and then update the documentation of --trusted-host to reflect that. Do you have an opinion?

I prefer pip to accept both and do corresponding handling.

[frostming]

Also, maybe one of us can open a new issue, and then I can mark it "discussion needed."

Sure, I created #6886 to track the discussion.

[cjerdonek]

Thanks! I noticed, and added some additional info to the ticket.

[frostming]

Close this PR in favor of #6909