pip or Conda Download Timeouts? The Right Way to Use a Clash Proxy in a Python Environment

Record the failing pip, Conda, or Git command and domain, then check its settings using the table below. Retry the original request with a temporary proxy in the current terminal. Save permanent settings only after the request appears in Clash connection records and the download succeeds, and keep the undo command. Opening PyPI in the browser does not replace these checks.

Replace the port with Clash's actual mixed-port. During the test, keep the client connections screen open. Only when PyPI or channel requests appear and match the intended node do you know the command entered the proxy. A browser reaching pypi.org does not prove this.

The examples below apply only to a temporary terminal with no existing proxy settings. Check upper- and lower-case variants of HTTP_PROXY, HTTPS_PROXY, NO_PROXY and ALL_PROXY, then inspect tool configuration sources with pip config debug and conda config --show-sources as described later.

If any source already defines a proxy, save its original value and configuration location, then handle it using the relevant instructions later. Do not run the overwrite and removal commands below directly. Leave company-required proxies unchanged. A new window can inherit old variables, so opening one does not establish that it has no settings.

Run the examples only after confirming that no existing source defines a proxy. Afterwards, remove only the variables added for this test and close the temporary window. This does not change the original window or persistent settings. If you manually changed an existing value, restore it from your record; unset or deleting the variable is not a substitute for restoration.

pip configuration may come from global, user, virtual-environment, or PIP_CONFIG_FILE sources. config debug lists file paths; do not edit only the first pip.conf you find.

--site writes to the current virtual environment, which is useful for a single local project. Keep .venv in .gitignore, and never write a personal proxy into requirements.txt or pyproject.toml.

If you use a custom index-url, record the domain where the timeout occurs. A working index page and a failing wheel download may use different file CDN or certificate paths.

Conda downloads a channel's repodata before fetching a package. If one third-party channel is unavailable, even correct proxy settings can still return 404 or time out. Use verbose output to identify the last channel accessed; do not rewrite defaults, conda-forge, and private mirrors together.

Check system time, the index domain, and whether corporate HTTPS inspection is present. When the organization provides a CA file, pip can use --cert or PIP_CERT, and Conda can point ssl_verify to the CA file.

Conda 23.9+ with Python 3.10+ also supports ssl_verify: truststore, which uses the operating system certificate store.

ssl_verify: false makes every future Conda request skip certificate verification, so it is unsuitable as a permanent setting. If an unknown CA suddenly appears on a home network, inspect security software or the proxy node instead of installing a root certificate suggested by a web page.

When pip encounters a git+https dependency, it invokes Git. Run git ls-remote for the repository outside the project first, then use git config --show-origin to find stale proxy settings. For repositories that require authentication, use a credential manager or SSH key; do not place a token in requirements.

PEP 517 build isolation may also create a temporary environment and download a build backend. Add -vvv to save verbose logs, then use the actual failing URL to determine whether pip, Git, or the package's build script is responsible.