Check both index URL and its hostname for keyring entries

news/8634.bugfix

@@ -0,0 +1 @@
+Check both index URL and its hostname for entries in the keyring

src/pip/_internal/network/auth.py

@@ -151,14 +151,19 @@ def _get_new_credentials(self, original_url, allow_netrc=True,
 
         # If we don't have a password and keyring is available, use it.
         if allow_keyring:
-            # The index url is more specific than the netloc, so try it first
-            kr_auth = (
-                get_keyring_auth(index_url, username) or
-                get_keyring_auth(netloc, username)
-            )
-            if kr_auth:
+            url_kr = get_keyring_auth(index_url, username)
+            netloc_kr = get_keyring_auth(netloc, username)
+            # When using SecretService on keyring >= 19.2.0, a null-password
+            # credential is always returned, so check the netloc result as well
+            if (not url_kr and netloc_kr) or (
+                url_kr and netloc_kr and netloc_kr[1] and not url_kr[1]
+            ):
                 logger.debug("Found credentials in keyring for %s", netloc)
-                return kr_auth
+                return netloc_kr
+            elif url_kr:
+                # The index url is more specific, so it takes priority
+                logger.debug("Found credentials in keyring for %s", url)
+                return url_kr
 
         return username, password
 

tests/unit/test_network_auth.py

@@ -212,6 +212,8 @@ def _send(sent_req, **kwargs):
 class KeyringModuleV2:
     """Represents the current supported API of keyring"""
 
+    return_username = False
+
     class Credential:
         def __init__(self, username, password):
             self.username = username
@@ -225,18 +227,24 @@ def get_credential(self, system, username):
             return self.Credential("username", "url")
         if system == "example.com":
             return self.Credential("username", "netloc")
+        if self.return_username:
+            # When using SecretService on keyring >= 19.2.0, a null-password
+            # credential is always returned
+            return self.Credential(username, None)
         return None
 
 
 @pytest.mark.parametrize('url, expect', (
     ("http://example.com/path1", ("username", "netloc")),
     ("http://example.com/path2/path3", ("username", "url")),
     ("http://user2@example.com/path2/path3", ("username", "url")),
+    ("http://ss_user@example.com", ("username", "netloc")),
+    ("http://ss_user@example2.com", ("ss_user", None)),
 ))
 def test_keyring_get_credential(monkeypatch, url, expect):
-    monkeypatch.setattr(
-        pip._internal.network.auth, 'keyring', KeyringModuleV2()
-    )
+    keyring = KeyringModuleV2()
+    keyring.return_username = "ss_user" in url
+    monkeypatch.setattr(pip._internal.network.auth, 'keyring', keyring)
     auth = MultiDomainBasicAuth(index_urls=["http://example.com/path2"])
 
     assert auth._get_new_credentials(