# 警告：位于 private.example.com 的仓库不是受信任或安全的主机，已被忽略。

- **ID:** `python/pip-dependency-confusion-shadowing`
- **领域:** python
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

除非显式信任，pip 拒绝使用纯 HTTP 索引；该警告使 pip 回退到 PyPI，可能安装仿冒包（依赖混淆攻击）。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 3.x | active | — | — |

## 解决方案

1. **** (95% 成功率)
   ```
   Serve the private index over HTTPS with a valid certificate
   ```
2. **** (90% 成功率)
   ```
   Configure credentials: pip config set global.index-url https://user:token@private.example.com/simple
   ```
3. **** (88% 成功率)
   ```
   Pin internal packages to the private index only: pip install --index-url https://private.example.com/simple --no-index internal-pkg
   ```

## 无效尝试

- **** — Restores HTTP access but does not add authentication, so the private index is still unauthenticated and vulnerable to MITM. (75% 失败率)
- **** — Forces all installs through PyPI, reintroducing dependency-confusion risk for internal package names. (80% 失败率)
- **** — The fallback to PyPI may silently install a malicious package with the same name. (90% 失败率)