Channels overrides not working

[EricScottN]

Hello. I work for an organization who hosts a private package repository on Artifactory. I am having issues attempting to override the default conda-forge channel. In the past with Miniconda, we've simply been able to do the following:

conda config --set ssl_verify %USERPROFILE%\path\to\certs.pem
conda config --set channel_alias https://<artifactory_url>
conda config --add channels https://<artifactory_url>
conda config --remove channels defaults

Which has always successfully overwritten any anacanda repos in the channels and allowed us to pull packages from from our private Artifactory repository.

Here are all commands I'm running and the outcomes (Windows 10):

First try

# Install executable
start /wait "" Miniforge3-Windows-x86_64.exe /InstallationType=JustMe /RegisterPython=0 /S /D=%UserProfile%\Miniforge3
conda info

Result:

active environment : base
    active env location : C:\Users\ebsaen1\Miniforge3
            shell level : 1
       user config file : C:\Users\ebsaen1\.condarc
 populated config files : C:\Users\ebsaen1\Miniforge3\.condarc
                          C:\Users\ebsaen1\.condarc
          conda version : 24.3.0
    conda-build version : not installed
         python version : 3.10.14.final.0
                 solver : libmamba (default)
       virtual packages : __archspec=1=haswell
                          __conda=24.3.0=0
                          __win=0=0
       base environment : C:\Users\ebsaen1\Miniforge3  (writable)
      conda av data dir : C:\Users\ebsaen1\Miniforge3\etc\conda
  conda av metadata url : None
           channel URLs : https://conda.anaconda.org/conda-forge/win-64
                          https://conda.anaconda.org/conda-forge/noarch
          package cache : C:\Users\ebsaen1\Miniforge3\pkgs
                          C:\Users\ebsaen1\.conda\pkgs
                          C:\Users\ebsaen1\AppData\Local\conda\conda\pkgs
       envs directories : C:\Users\ebsaen1\Miniforge3\envs
                          C:\Users\ebsaen1\.conda\envs
                          C:\Users\ebsaen1\AppData\Local\conda\conda\envs
               platform : win-64
             user-agent : conda/24.3.0 requests/2.31.0 CPython/3.10.14 Windows/10 Windows/10.0.19045 solver/libmamba conda-libmamba-solver/24.1.0 libmambapy/1.5.8
          administrator : False
             netrc file : None
           offline mode : False

Looks standard.. Moving on..

# Activate the environment
%UserProfile%\Miniforge3\Scripts\activate.bat %UserProfile%\Miniforge3
# Set SSL
conda config --set ssl_verify %USERPROFILE%\path\to\certs.pem

# Configure Channels
conda config --set channel_alias https://<artifactory_url>
conda config --add channels https://<artifactory_url>
conda config --remove channels defaults

Result:

CondaKeyError: 'channels': 'defaults' is not in the 'channels' key of the config file

Makes sense after doing conda config --show channels which outputs..

channels:                                                                                                                             
- https://<artifactory_url>
- conda-forge

Okay so remove conda-forge instead..

conda config --remove channels conda-forge

No errors. Great!

conda config --show channels

channels:                                                                                                                             
- https://<artifactory_url>
- conda-forge

😤

I then figure out there is a system flag. Let's try that..

conda config --system --remove channels conda-forge

No errors..

conda config --show channels

channels:                                                                                                                             
- https://<artifactory_url>

Great!

Conda info just to be safe..

conda info
------
     active environment : base
    active env location : C:\Users\ebsaen1\Miniforge3
            shell level : 1
       user config file : C:\Users\ebsaen1\.condarc
 populated config files : C:\Users\ebsaen1\Miniforge3\.condarc
                          C:\Users\ebsaen1\.condarc
          conda version : 24.3.0
    conda-build version : not installed
         python version : 3.10.14.final.0
                 solver : libmamba (default)
       virtual packages : __archspec=1=haswell
                          __conda=24.3.0=0
                          __win=0=0
       base environment : C:\Users\ebsaen1\Miniforge3  (writable)
      conda av data dir : C:\Users\ebsaen1\Miniforge3\etc\conda
  conda av metadata url : None
           channel URLs : https://<artifactory_url>/win-64
                          https://<artifactory_url>/noarch
          package cache : C:\Users\ebsaen1\Miniforge3\pkgs
                          C:\Users\ebsaen1\.conda\pkgs
                          C:\Users\ebsaen1\AppData\Local\conda\conda\pkgs
       envs directories : C:\Users\ebsaen1\Miniforge3\envs
                          C:\Users\ebsaen1\.conda\envs
                          C:\Users\ebsaen1\AppData\Local\conda\conda\envs
               platform : win-64
             user-agent : conda/24.3.0 requests/2.31.0 CPython/3.10.14 Windows/10 Windows/10.0.19045 solver/libmamba conda-libmamba-solver/24.1.0 libmambapy/1.5.8
          administrator : False
             netrc file : None
           offline mode : False

Nice!

Update Conda..

conda update conda
-----------
Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /conda-forge/noarch/repodata.json

Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /conda-forge/noarch/repodata.json

Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /conda-forge/noarch/repodata.json

Channels:
 - /
Platform: win-64
Collecting package metadata (repodata.json): /

Okay that's definitely not right. Even through there is an SSLError, that is expected as I am on organization vpn and fetching outside repos will result in that error. The problem here is that it is still trying to fetch from conda-forge, even though it's nowhere to be found in my channels. So what's the deal here? I would prefer not to have to modify .condarc file, as this configuration has to be done completely inside a .bat script.

Thank you.

[jaimergp]

Does the behavior change if you export CONDA_LIBMAMBA_SOLVER_NO_CHANNELS_FROM_INSTALLED=1?

[EricScottN]

I tried adding SET CONDA_LIBMAMBA_SOLVER_NO_CHANNELS_FROM_INSTALLED=1 and there was no difference. I did end up doing the following:

## This removes `conda-forge` from `channels` and replaces it with `defaults`
del %USERPROFILE%\Miniforge3\.condarc

conda config --set channel_alias https://<artifactory_url>
conda config --add default_channels https://<artifactory_url>/<channel_name>

With this config, creating a new environment will pull everything from Artifactory, which is great. The only weird behavior is that when trying to do conda update conda in the base environment, it will still try to pull update packages from conda-forge. Once those fail with SSL errors, it will fall back to defaults which is now set to Artifactory urls and update them from there. Although, once the packages are replaced with packages from Artifactory, doing a subsequent conda update conda will still try to pull from conda-forge even through there is zero indication of that channel in any of the channel configs.

I feel that might be because the packages are, by default, installed from conda-forge during the initial conda installation. I guess my question now is - Can I somehow provide a url to override conda-forge when conda is first installed?

[byjrack]

And just tagging onto this as i had the exact same problem trying to make this work airgap.

It seems like if you define channels and use strict you can steer traffic to the internal mirror, but repodata fetch seems to be early enough where it happens even if it's not the top channel. I sort of get that because the solve is across channels, but feels like there is something we could do to conda to have it stick to a specific channel and only that channel even for repodata.

I originally thought nodefault in channels would work, but seems that is more environments than condarc. I also tried to make denylist_channel work, but conda was picky and wouldn't process anything if conda-forge was in the denylist and still in the system condarc. Same with default_channels and channel_alias I couldn't stop it trying to pull repodata from forge and hitting the no route.

I also tried to move the existing installed packages, but you start dealing with elevated rights if it's installed machine context and it feeling incredibly kludgey.

I did have some success with bypassing the repodata EOFs by using both the --system --remove conda-forge and the SET CONDA_LIBMAMBA_SOLVER_NO_CHANNELS_FROM_INSTALLED=1. That creates its own challenges with getting folks up and running without deep insight into the nuances of the tooling. That did get me thinking though and I did try classic solver and same issue w repodata downloads failing in an airgap.

I feel like the answer for which combination is sitting right in front of me, but I can't figure out a bootstrap that doesn't require some internet access. Forking the bootstrap and hard coding in our mirror feels like the nuclear option.