Development and AI · Clash Technical Blog

pip or Conda Download Timeouts? The Right Way to Use a Clash Proxy in a Python Environment

pip, Conda, and git+https each read different proxy settings. Run a temporary test in a new terminal first to confirm that the network is actually the problem, then decide where to save the configuration.

Read the articleBack to blog
  • pip
  • Conda
  • Python
  • Download timeout
On this page
Published
Updated
Estimated reading time
About 8 minutes

If pip or Conda times out, first identify what is actually initiating the download

A browser reaching PyPI does not mean pip, Conda, or Git in the terminal is using Clash. Identify the domain and program behind the failing command, then compare with a temporary proxy in the current terminal. Only after the temporary test succeeds should you write settings to pip, .condarc, or the project's virtual environment—and keep the corresponding undo command.

First identify which program sent the command

Command or errorActual downloaderView configuration
python -m pip installpip / Python HTTP librarypip config debug, environment variables, and --proxy
conda install / createCondaconda config --show-sources、~/.condarc
git+https://...Gitgit config --show-origin --get-regexp http.*proxy
Downloads resources again during compilationThe package's own build scriptThe real URL in verbose logs

Run one temporary test in a new terminal first

Current macOS / Linux terminal; adjust CLASH_PORT to the actual mixed-port
CLASH_PORT=7890
export HTTP_PROXY="http://127.0.0.1:$CLASH_PORT"
export HTTPS_PROXY="http://127.0.0.1:$CLASH_PORT"
export NO_PROXY=localhost,127.0.0.1,::1

python -m pip install --dry-run packaging
conda search python

unset HTTP_PROXY HTTPS_PROXY NO_PROXY
Current Windows PowerShell window; adjust 7890 to the actual mixed-port
$ClashPort = 7890
$env:HTTP_PROXY = "http://127.0.0.1:$ClashPort"
$env:HTTPS_PROXY = "http://127.0.0.1:$ClashPort"
$env:NO_PROXY = "localhost,127.0.0.1,::1"

py -m pip install --dry-run packaging

Remove-Item Env:HTTP_PROXY, Env:HTTPS_PROXY, Env:NO_PROXY

Replace the port with Clash's actual mixed-port. During the test, keep the client connections screen open. Only when PyPI or channel requests appear and match the intended node do you know the command entered the proxy. A browser reaching pypi.org does not prove this.

Only if pip needs permanent access should you write pip configuration

View source, temporary use, and removal
python -m pip config debug
python -m pip config list -v

# 单次命令，官方支持 scheme://[user:password@]host:port
python -m pip install --proxy http://127.0.0.1:7890 requests

# 若曾写入用户配置，查看后再删除
python -m pip config unset global.proxy
Use only for the current virtual environment, with an independent undo path
# 先激活项目自己的 venv，再执行
python -m pip config --site set global.proxy http://127.0.0.1:7890
python -m pip config --site list

# 项目不再需要代理时
python -m pip config --site unset global.proxy

pip configuration may come from global, user, virtual-environment, or PIP_CONFIG_FILE sources. config debug lists file paths; do not edit only the first pip.conf you find.

--site writes to the current virtual environment, which is useful for a single local project. Keep .venv in .gitignore, and never write a personal proxy into requirements.txt or pyproject.toml.

If you use a custom index-url, record the domain where the timeout occurs. A working index page and a failing wheel download may use different file CDN or certificate paths.

Put Conda proxy_servers in .condarc, and inspect the channel

Only if the pip test succeeds while Conda still times out should you inspect .condarc. Conda fetches a channel's repodata before downloading packages, so use verbose output to identify the last channel that failed.

~/.condarc example
proxy_servers:
  http: http://127.0.0.1:7890
  https: http://127.0.0.1:7890

ssl_verify: true
Find the source and remove it
conda config --show-sources
conda config --show proxy_servers ssl_verify channels

# 不再需要时删除整个代理映射
conda config --remove-key proxy_servers

Conda downloads a channel's repodata before fetching a package. If one third-party channel is unavailable, even correct proxy settings can still return 404 or time out. Use verbose output to identify the last channel accessed; do not rewrite defaults, conda-forge, and private mirrors together.

Do not hide CERTIFICATE_VERIFY_FAILED with trusted-host or ssl_verify: false

Check system time, the index domain, and whether corporate HTTPS inspection is present. When the organization provides a CA file, pip can use --cert or PIP_CERT, and Conda can point ssl_verify to the CA file.

Conda 23.9+ with Python 3.10+ also supports ssl_verify: truststore, which uses the operating system certificate store.

ssl_verify: false makes every future Conda request skip certificate verification, so it is unsuitable as a permanent setting. If an unknown CA suddenly appears on a home network, inspect security software or the proxy node instead of installing a root certificate suggested by a web page.

Managed-device example; the administrator supplies the path
# pip 单次命令
python -m pip install --cert /path/to/company-ca.pem requests

# .condarc 二选一
ssl_verify: /path/to/company-ca.pem
# ssl_verify: truststore

If a dependency uses git+https, return to Git troubleshooting

When pip encounters a git+https dependency, it invokes Git. Run git ls-remote for the repository outside the project first, then use git config --show-origin to find stale proxy settings. For repositories that require authentication, use a credential manager or SSH key; do not place a token in requirements.

PEP 517 build isolation may also create a temporary environment and download a build backend. Add -vvv to save verbose logs, then use the actual failing URL to determine whether pip, Git, or the package's build script is responsible.

Runnable public example; then replace it with the failing repository and package name
REPO_URL='https://github.com/pallets/flask.git'
PACKAGE_NAME='packaging'

git config --show-origin --get-regexp 'http..*.proxy|http.proxy' || true
git ls-remote "$REPO_URL"
python -m pip install -vvv "$PACKAGE_NAME"

After cleanup, verify in a completely new terminal

After testing both temporary proxy settings and permanent configuration, close the current terminal and open a new one. Old environment variables remain only in the original window, while a new window reveals where your persistent configuration was actually written.

Completion criteria

  • pip config debug no longer shows the old proxy
  • conda config --show-sources contains no invalid proxy_servers
  • HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY in a new terminal all match expectations
  • Test a small pip package, Conda repodata, and a git+https dependency separately
  • After closing Clash, Python commands without proxy settings no longer point to the old 127.0.0.1 port
  • Certificate verification remains enabled

References