Channels overrides not working

[EricScottN]

Hello. I work for an organization who hosts a private package repository on Artifactory. I am having issues attempting to override the default conda-forge channel. In the past with Miniconda, we've simply been able to do the following:

conda config --set ssl_verify %USERPROFILE%\path\to\certs.pem
conda config --set channel_alias https://<artifactory_url>
conda config --add channels https://<artifactory_url>
conda config --remove channels defaults

Which has always successfully overwritten any anacanda repos in the channels and allowed us to pull packages from from our private Artifactory repository.

Here are all commands I'm running and the outcomes (Windows 10):

First try

# Install executable
start /wait "" Miniforge3-Windows-x86_64.exe /InstallationType=JustMe /RegisterPython=0 /S /D=%UserProfile%\Miniforge3
conda info

Result:

active environment : base
    active env location : C:\Users\ebsaen1\Miniforge3
            shell level : 1
       user config file : C:\Users\ebsaen1\.condarc
 populated config files : C:\Users\ebsaen1\Miniforge3\.condarc
                          C:\Users\ebsaen1\.condarc
          conda version : 24.3.0
    conda-build version : not installed
         python version : 3.10.14.final.0
                 solver : libmamba (default)
       virtual packages : __archspec=1=haswell
                          __conda=24.3.0=0
                          __win=0=0
       base environment : C:\Users\ebsaen1\Miniforge3  (writable)
      conda av data dir : C:\Users\ebsaen1\Miniforge3\etc\conda
  conda av metadata url : None
           channel URLs : https://conda.anaconda.org/conda-forge/win-64
                          https://conda.anaconda.org/conda-forge/noarch
          package cache : C:\Users\ebsaen1\Miniforge3\pkgs
                          C:\Users\ebsaen1\.conda\pkgs
                          C:\Users\ebsaen1\AppData\Local\conda\conda\pkgs
       envs directories : C:\Users\ebsaen1\Miniforge3\envs
                          C:\Users\ebsaen1\.conda\envs
                          C:\Users\ebsaen1\AppData\Local\conda\conda\envs
               platform : win-64
             user-agent : conda/24.3.0 requests/2.31.0 CPython/3.10.14 Windows/10 Windows/10.0.19045 solver/libmamba conda-libmamba-solver/24.1.0 libmambapy/1.5.8
          administrator : False
             netrc file : None
           offline mode : False

Looks standard.. Moving on..

# Activate the environment
%UserProfile%\Miniforge3\Scripts\activate.bat %UserProfile%\Miniforge3
# Set SSL
conda config --set ssl_verify %USERPROFILE%\path\to\certs.pem

# Configure Channels
conda config --set channel_alias https://<artifactory_url>
conda config --add channels https://<artifactory_url>
conda config --remove channels defaults

Result:

CondaKeyError: 'channels': 'defaults' is not in the 'channels' key of the config file

Makes sense after doing conda config --show channels which outputs..

channels:                                                                                                                             
- https://<artifactory_url>
- conda-forge

Okay so remove conda-forge instead..

conda config --remove channels conda-forge

No errors. Great!

conda config --show channels

channels:                                                                                                                             
- https://<artifactory_url>
- conda-forge

😤

I then figure out there is a system flag. Let's try that..

conda config --system --remove channels conda-forge

No errors..

conda config --show channels

channels:                                                                                                                             
- https://<artifactory_url>

Great!

Conda info just to be safe..

conda info
------
     active environment : base
    active env location : C:\Users\ebsaen1\Miniforge3
            shell level : 1
       user config file : C:\Users\ebsaen1\.condarc
 populated config files : C:\Users\ebsaen1\Miniforge3\.condarc
                          C:\Users\ebsaen1\.condarc
          conda version : 24.3.0
    conda-build version : not installed
         python version : 3.10.14.final.0
                 solver : libmamba (default)
       virtual packages : __archspec=1=haswell
                          __conda=24.3.0=0
                          __win=0=0
       base environment : C:\Users\ebsaen1\Miniforge3  (writable)
      conda av data dir : C:\Users\ebsaen1\Miniforge3\etc\conda
  conda av metadata url : None
           channel URLs : https://<artifactory_url>/win-64
                          https://<artifactory_url>/noarch
          package cache : C:\Users\ebsaen1\Miniforge3\pkgs
                          C:\Users\ebsaen1\.conda\pkgs
                          C:\Users\ebsaen1\AppData\Local\conda\conda\pkgs
       envs directories : C:\Users\ebsaen1\Miniforge3\envs
                          C:\Users\ebsaen1\.conda\envs
                          C:\Users\ebsaen1\AppData\Local\conda\conda\envs
               platform : win-64
             user-agent : conda/24.3.0 requests/2.31.0 CPython/3.10.14 Windows/10 Windows/10.0.19045 solver/libmamba conda-libmamba-solver/24.1.0 libmambapy/1.5.8
          administrator : False
             netrc file : None
           offline mode : False

Nice!

Update Conda..

conda update conda
-----------
Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /conda-forge/noarch/repodata.json

Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /conda-forge/noarch/repodata.json

Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /conda-forge/noarch/repodata.json

Channels:
 - /
Platform: win-64
Collecting package metadata (repodata.json): /

Okay that's definitely not right. Even through there is an SSLError, that is expected as I am on organization vpn and fetching outside repos will result in that error. The problem here is that it is still trying to fetch from conda-forge, even though it's nowhere to be found in my channels. So what's the deal here? I would prefer not to have to modify .condarc file, as this configuration has to be done completely inside a .bat script.

Thank you.

[jaimergp]

Does the behavior change if you export CONDA_LIBMAMBA_SOLVER_NO_CHANNELS_FROM_INSTALLED=1?

[EricScottN]

I tried adding SET CONDA_LIBMAMBA_SOLVER_NO_CHANNELS_FROM_INSTALLED=1 and there was no difference. I did end up doing the following:

## This removes `conda-forge` from `channels` and replaces it with `defaults`
del %USERPROFILE%\Miniforge3\.condarc

conda config --set channel_alias https://<artifactory_url>
conda config --add default_channels https://<artifactory_url>/<channel_name>

With this config, creating a new environment will pull everything from Artifactory, which is great. The only weird behavior is that when trying to do conda update conda in the base environment, it will still try to pull update packages from conda-forge. Once those fail with SSL errors, it will fall back to defaults which is now set to Artifactory urls and update them from there. Although, once the packages are replaced with packages from Artifactory, doing a subsequent conda update conda will still try to pull from conda-forge even through there is zero indication of that channel in any of the channel configs.

I feel that might be because the packages are, by default, installed from conda-forge during the initial conda installation. I guess my question now is - Can I somehow provide a url to override conda-forge when conda is first installed?