Unable to access PyPI's CDN (files.pythonhosted.org) on macOS with IPv6 connectivity

[segevfiner]

Original Issue: pypi/warehouse#8292

I'm unable to use pip to install any packages due to it failing to access PyPI's CDN (files.pythonhosted.org), and sometimes PyPI itself, on macOS with IPv6 connectivity (Enabled & available on the network, this is a true dual-stack network, with both real IPv4 & IPv6 address, I know, right? An actual ISP that does that)

The socket gets immediately closed on connection which leads to errors like this (Which are retried until eventually giving up):

Could not fetch URL https://pypi.org/simple/requests/: connection error: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/requests/ (Caused by ProtocolError('Connection aborted.', OSError(22, 'Inv    alid argument'))) - skipping

HTTPSConnectionPool(host='files.pythonhosted.org', port=443): Max retries exceeded with url: /packages/45/1e/0c169c6a5381e241ba7404532c16a21d86ab872c9bed8bdcd4c423954103/requests-2.24.0-py2.py3-none-any.whl (Caused by ProtocolError('Connection aborted.', OSError(22, 'Invalid argument')))

getpeername on macOS returns with errno EINVAL when the socket is closed.

Disabling IPv6 external connectivity by setting "Configure IPv6" to "Link-local only" in macOS network preferences causes pip to work again, but is obviously not desired.

My Platform

pip 20.1.1
Python 3.8.4 from Homebrew
macOS 10.14.6
A dual-stack IPv4/IPv6 network. Has both a public IPv4 address behind local router NAT, and IPv6 connectivity.

Network telemetry

DNS Resolution

dig pypi.org A

; <<>> DiG 9.10.6 <<>> pypi.org A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35797
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;pypi.org.			IN	A

;; ANSWER SECTION:
pypi.org.		7743	IN	A	151.101.192.223
pypi.org.		7743	IN	A	151.101.128.223
pypi.org.		7743	IN	A	151.101.0.223
pypi.org.		7743	IN	A	151.101.64.223

;; Query time: 75 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Mon Jul 20 18:39:15 IDT 2020
;; MSG SIZE  rcvd: 101

dig pypi.org AAAA

; <<>> DiG 9.10.6 <<>> pypi.org AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40587
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;pypi.org.			IN	AAAA

;; ANSWER SECTION:
pypi.org.		6497	IN	AAAA	2a04:4e42:400::223
pypi.org.		6497	IN	AAAA	2a04:4e42:200::223
pypi.org.		6497	IN	AAAA	2a04:4e42:600::223
pypi.org.		6497	IN	AAAA	2a04:4e42::223

;; Query time: 75 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Mon Jul 20 18:39:41 IDT 2020
;; MSG SIZE  rcvd: 149

dig files.pythonhosted.org A

; <<>> DiG 9.10.6 <<>> files.pythonhosted.org A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56495
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;files.pythonhosted.org.		IN	A

;; ANSWER SECTION:
files.pythonhosted.org.	20726	IN	CNAME	dualstack.r.ssl.global.fastly.net.
dualstack.r.ssl.global.fastly.net. 25 IN A	151.101.1.63
dualstack.r.ssl.global.fastly.net. 25 IN A	151.101.65.63
dualstack.r.ssl.global.fastly.net. 25 IN A	151.101.129.63
dualstack.r.ssl.global.fastly.net. 25 IN A	151.101.193.63

;; Query time: 94 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Mon Jul 20 18:41:41 IDT 2020
;; MSG SIZE  rcvd: 162

dig files.pythonhosted.org AAAA

; <<>> DiG 9.10.6 <<>> files.pythonhosted.org AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64524
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;files.pythonhosted.org.		IN	AAAA

;; ANSWER SECTION:
files.pythonhosted.org.	5887	IN	CNAME	dualstack.r.ssl.global.fastly.net.
dualstack.r.ssl.global.fastly.net. 25 IN AAAA	2a04:4e42::319
dualstack.r.ssl.global.fastly.net. 25 IN AAAA	2a04:4e42:200::319
dualstack.r.ssl.global.fastly.net. 25 IN AAAA	2a04:4e42:400::319
dualstack.r.ssl.global.fastly.net. 25 IN AAAA	2a04:4e42:600::319

;; Query time: 78 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Mon Jul 20 18:41:53 IDT 2020
;; MSG SIZE  rcvd: 210

Traceroutes

IPv4

traceroute -m 32 pypi.org
traceroute: Warning: pypi.org has multiple addresses; using 151.101.128.223
traceroute to pypi.org (151.101.128.223), 32 hops max, 52 byte packets
 1  192.168.1.1 (192.168.1.1)  3.785 ms  2.376 ms  1.154 ms
 2  10.162.48.1 (10.162.48.1)  12.901 ms  12.225 ms  12.180 ms
 3  * * *
 4  * * *
 5  * * *
 6  if-be-10.ecore1.fr0-frankfurt.as6453.net (80.231.65.4)  94.720 ms  87.756 ms *
 7  ae-27.r00.frnkge13.de.bb.gin.ntt.net (129.250.8.233)  77.672 ms  93.395 ms  92.477 ms
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
31  * * *
32  * * *

traceroute -m 32 files.pythonhosted.org
traceroute: Warning: files.pythonhosted.org has multiple addresses; using 151.101.1.63
traceroute to dualstack.r.ssl.global.fastly.net (151.101.1.63), 32 hops max, 52 byte packets
 1  192.168.1.1 (192.168.1.1)  1.996 ms  5.248 ms  2.442 ms
 2  10.162.48.1 (10.162.48.1)  15.389 ms  14.127 ms  10.216 ms
 3  * * *
 4  * * *
 5  * * *
 6  if-be-10.ecore1.fr0-frankfurt.as6453.net (80.231.65.4)  104.020 ms  101.524 ms  95.282 ms
 7  ae-27.r00.frnkge13.de.bb.gin.ntt.net (129.250.8.233)  76.129 ms  80.924 ms  77.853 ms
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
31  * * *
32  * * *

IPv6 (If available)

traceroute6 -m 32 pypi.org
traceroute6: Warning: pypi.org has multiple addresses; using 2a04:4e42:600::223
traceroute6 to pypi.org (2a04:4e42:600::223) from 2a00:a040:187:319b:876:977f:334c:a28d, 32 hops max, 12 byte packets
 1  2a00:a040:187:319b:2ee4:12ff:fee8:a2e0  2.248 ms  3.290 ms  3.147 ms
 2  2a00:a040:187:2000::1  12.181 ms  11.527 ms  20.054 ms
 3  * * *
 4  * * *
 5  * * *
 6  2a00:a040:3:236::2  39.387 ms  16.985 ms  13.950 ms
 7  2a00:a040:3:231::1  18.267 ms *  16.378 ms
 8  2a00:a040:3:1:15::22  69.517 ms  66.248 ms  65.226 ms
 9  ix-et-1-1-2-0.thar1.lrt-london.ipv6.as6453.net  75.086 ms  78.070 ms  73.111 ms
10  if-ae-5-2.tcore1.l78-london.ipv6.as6453.net  83.848 ms  92.035 ms  86.876 ms
11  if-ae-2-2.tcore2.l78-london.ipv6.as6453.net  76.251 ms  70.100 ms  73.640 ms
12  if-ae-14-2.tcore2.av2-amsterdam.ipv6.as6453.net  83.426 ms  82.926 ms  78.412 ms
13  if-ae-2-2.tcore1.av2-amsterdam.ipv6.as6453.net  86.659 ms  86.966 ms  83.542 ms
14  if-ae-6-2.tcore1.fnm-frankfurt.ipv6.as6453.net  73.370 ms  70.120 ms  95.918 ms
15  if-ae-9-2.tcore2.fr0-frankfurt.ipv6.as6453.net  93.402 ms  75.806 ms  70.928 ms
16  2003:0:130c:8024::1  81.405 ms  84.639 ms  86.287 ms
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
31  * * *
32  * * *

traceroute6 -m 32 files.pythonhosted.org
traceroute6 to dualstack.r.ssl.global.fastly.net (2a04:4e42:1b::319) from 2a00:a040:187:319b:876:977f:334c:a28d, 32 hops max, 12 byte packets
 1  2a00:a040:187:319b:2ee4:12ff:fee8:a2e0  3.497 ms  3.223 ms  3.147 ms
 2  2a00:a040:187:2000::1  10.188 ms  10.579 ms  13.670 ms
 3  2a00:a040:0:1:231::115  16.519 ms  14.881 ms  11.435 ms
 4  2a00:a040:0:1::d  15.506 ms  13.648 ms  14.872 ms
 5  *
    2a00:a040:0:70::2  2468.701 ms *
 6  2a00:a040:0:1::d  67.719 ms * *
 7  *
    2a00:a040:0:70::2  2433.040 ms *
 8  2a00:a040:0:1::d  120.273 ms * *
 9  2a00:a040:0:70::2  2679.739 ms  2552.362 ms *
10  * * *
11  *
    2a00:a040:0:70::2  2969.904 ms *
12  *
    2a00:a040:0:1::d  289.728 ms *
13  2a00:a040:0:70::2  2633.161 ms  2639.357 ms *
14  2a00:a040:0:1::d  359.580 ms *  331.070 ms
15  *
    2a00:a040:0:70::2  2781.373 ms *
16  * * *
17  2a00:a040:0:70::2  2928.809 ms  2764.826 ms  2764.067 ms
18  * * *
19  2a00:a040:0:70::2  2566.293 ms *  2766.364 ms
20  * * *
21  *
    2a00:a040:0:70::2  2653.726 ms  2888.933 ms
22  * *
    2a00:a040:0:1::d  622.188 ms
23  2a00:a040:0:70::2  3069.460 ms  3030.698 ms *
24  * * *
25  2a00:a040:0:70::2  2966.785 ms *  3250.762 ms
26  * * *
27  2a00:a040:0:70::2  2850.221 ms  2904.268 ms *
28  * * *
29  2a00:a040:0:70::2  3147.588 ms *  3066.634 ms
30  * * *
31  2a00:a040:0:70::2  3116.597 ms  3198.083 ms *
32  *
    2a00:a040:0:1::d  834.905 ms *

HTTPS Requests

IPv4

curl -vvv -I --ipv4 https://pypi.org/pypi/pip/json
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 151.101.0.223...
* TCP_NODELAY set
* Connected to pypi.org (151.101.0.223) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [214 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [102 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [3390 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [300 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: businessCategory=Private Organization; jurisdictionCountryName=US; jurisdictionStateOrProvinceName=Delaware; serialNumber=3359300; C=US; ST=New Hampshire; L=Wolfeboro; O=Python Software Foundation; CN=www.python.org
*  start date: Sep 18 00:00:00 2018 GMT
*  expire date: Oct 14 12:00:00 2020 GMT
*  subjectAltName: host "pypi.org" matched cert's "pypi.org"
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 Extended Validation Server CA
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7fc2ee80d800)
> HEAD /pypi/pip/json HTTP/2
> Host: pypi.org
> User-Agent: curl/7.54.0
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200 
< access-control-allow-headers: Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since
< access-control-allow-methods: GET
< access-control-allow-origin: *
< access-control-expose-headers: X-PyPI-Last-Serial
< access-control-max-age: 86400
< cache-control: max-age=900, public
< content-security-policy: base-uri 'self'; block-all-mixed-content; connect-src 'self' https://api.github.com/repos/ *.fastly-insights.com sentry.io https://api.pwnedpasswords.com https://2p66nmmycsj3.statuspage.io; default-src 'none'; font-src 'self' fonts.gstatic.com; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' https://warehouse-camo.ingress.cmh1.psfhosted.org/ www.google-analytics.com *.fastly-insights.com; script-src 'self' www.googletagmanager.com www.google-analytics.com *.fastly-insights.com https://cdn.ravenjs.com; style-src 'self' fonts.googleapis.com; worker-src *.fastly-insights.com
< content-type: application/json
< etag: "1bScw84sINFW/pIshXUiKQ"
< referrer-policy: origin-when-cross-origin
< server: nginx/1.13.9
< x-pypi-last-serial: 7292768
< accept-ranges: bytes
< date: Mon, 20 Jul 2020 16:36:26 GMT
< x-served-by: cache-bwi5120-BWI, cache-hhn4032-HHN
< x-cache: HIT, HIT
< x-cache-hits: 5, 3
< x-timer: S1595262986.456242,VS0,VE0
< vary: Accept-Encoding, Accept-Encoding
< strict-transport-security: max-age=31536000; includeSubDomains; preload
< x-frame-options: deny
< x-xss-protection: 1; mode=block
< x-content-type-options: nosniff
< x-permitted-cross-domain-policies: none
< content-length: 99851
< 

  0 99851    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0
* Connection #0 to host pypi.org left intact
HTTP/2 200 
access-control-allow-headers: Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-expose-headers: X-PyPI-Last-Serial
access-control-max-age: 86400
cache-control: max-age=900, public
content-security-policy: base-uri 'self'; block-all-mixed-content; connect-src 'self' https://api.github.com/repos/ *.fastly-insights.com sentry.io https://api.pwnedpasswords.com https://2p66nmmycsj3.statuspage.io; default-src 'none'; font-src 'self' fonts.gstatic.com; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' https://warehouse-camo.ingress.cmh1.psfhosted.org/ www.google-analytics.com *.fastly-insights.com; script-src 'self' www.googletagmanager.com www.google-analytics.com *.fastly-insights.com https://cdn.ravenjs.com; style-src 'self' fonts.googleapis.com; worker-src *.fastly-insights.com
content-type: application/json
etag: "1bScw84sINFW/pIshXUiKQ"
referrer-policy: origin-when-cross-origin
server: nginx/1.13.9
x-pypi-last-serial: 7292768
accept-ranges: bytes
date: Mon, 20 Jul 2020 16:36:26 GMT
x-served-by: cache-bwi5120-BWI, cache-hhn4032-HHN
x-cache: HIT, HIT
x-cache-hits: 5, 3
x-timer: S1595262986.456242,VS0,VE0
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
content-length: 99851

curl -vvv -I --ipv4 https://files.pythonhosted.org/packages/ae/e8/2340d46ecadb1692a1e455f13f75e596d4eab3d11a57446f08259dee8f02/pip-10.0.1.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 151.101.1.63...
* TCP_NODELAY set
* Connected to files.pythonhosted.org (151.101.1.63) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [228 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [102 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [3675 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [300 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=Fastly, Inc; CN=r.ssl.fastly.net
*  start date: Jul 13 17:46:11 2020 GMT
*  expire date: Apr 28 19:20:25 2021 GMT
*  subjectAltName: host "files.pythonhosted.org" matched cert's "*.pythonhosted.org"
*  issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign CloudSSL CA - SHA256 - G3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7f9438800400)
> HEAD /packages/ae/e8/2340d46ecadb1692a1e455f13f75e596d4eab3d11a57446f08259dee8f02/pip-10.0.1.tar.gz HTTP/2
> Host: files.pythonhosted.org
> User-Agent: curl/7.54.0
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200 
< last-modified: Wed, 26 Feb 2020 17:47:37 GMT
< etag: "83a177756e2c801d0b3a6f7b0d4f3f7e"
< content-type: binary/octet-stream
< x-goog-hash: crc32c=Om2N1A==
< x-goog-hash: md5=g6F3dW4sgB0LOm97DU8/fg==
< server: UploadServer
< cache-control: max-age=365000000, immutable, public
< accept-ranges: bytes
< date: Mon, 20 Jul 2020 16:36:56 GMT
< age: 300585
< x-served-by: cache-sea4462-SEA, cache-hhn4066-HHN
< x-cache: HIT, HIT
< x-cache-hits: 1, 1
< x-timer: S1595263017.878862,VS0,VE5
< strict-transport-security: max-age=31536000; includeSubDomains; preload
< x-frame-options: deny
< x-xss-protection: 1; mode=block
< x-content-type-options: nosniff
< x-permitted-cross-domain-policies: none
< x-robots-header: noindex
< content-length: 1246072
< 

  0 1216k    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Connection #0 to host files.pythonhosted.org left intact
HTTP/2 200 
last-modified: Wed, 26 Feb 2020 17:47:37 GMT
etag: "83a177756e2c801d0b3a6f7b0d4f3f7e"
content-type: binary/octet-stream
x-goog-hash: crc32c=Om2N1A==
x-goog-hash: md5=g6F3dW4sgB0LOm97DU8/fg==
server: UploadServer
cache-control: max-age=365000000, immutable, public
accept-ranges: bytes
date: Mon, 20 Jul 2020 16:36:56 GMT
age: 300585
x-served-by: cache-sea4462-SEA, cache-hhn4066-HHN
x-cache: HIT, HIT
x-cache-hits: 1, 1
x-timer: S1595263017.878862,VS0,VE5
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-robots-header: noindex
content-length: 1246072

IPv6 (If available)

curl -vvv -I --ipv6 https://pypi.org/pypi/pip/json
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 2a04:4e42:600::223...
* TCP_NODELAY set
* Connected to pypi.org (2a04:4e42:600::223) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [214 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [102 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [3390 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [300 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: businessCategory=Private Organization; jurisdictionCountryName=US; jurisdictionStateOrProvinceName=Delaware; serialNumber=3359300; C=US; ST=New Hampshire; L=Wolfeboro; O=Python Software Foundation; CN=www.python.org
*  start date: Sep 18 00:00:00 2018 GMT
*  expire date: Oct 14 12:00:00 2020 GMT
*  subjectAltName: host "pypi.org" matched cert's "pypi.org"
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 Extended Validation Server CA
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7ffc20803c00)
> HEAD /pypi/pip/json HTTP/2
> Host: pypi.org
> User-Agent: curl/7.54.0
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200 
< access-control-allow-headers: Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since
< access-control-allow-methods: GET
< access-control-allow-origin: *
< access-control-expose-headers: X-PyPI-Last-Serial
< access-control-max-age: 86400
< cache-control: max-age=900, public
< content-security-policy: base-uri 'self'; block-all-mixed-content; connect-src 'self' https://api.github.com/repos/ *.fastly-insights.com sentry.io https://api.pwnedpasswords.com https://2p66nmmycsj3.statuspage.io; default-src 'none'; font-src 'self' fonts.gstatic.com; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' https://warehouse-camo.ingress.cmh1.psfhosted.org/ www.google-analytics.com *.fastly-insights.com; script-src 'self' www.googletagmanager.com www.google-analytics.com *.fastly-insights.com https://cdn.ravenjs.com; style-src 'self' fonts.googleapis.com; worker-src *.fastly-insights.com
< content-type: application/json
< etag: "1bScw84sINFW/pIshXUiKQ"
< referrer-policy: origin-when-cross-origin
< server: nginx/1.13.9
< x-pypi-last-serial: 7292768
< accept-ranges: bytes
< date: Mon, 20 Jul 2020 16:37:33 GMT
< x-served-by: cache-bwi5120-BWI, cache-hhn4020-HHN
< x-cache: HIT, HIT
< x-cache-hits: 5, 2
< x-timer: S1595263053.122044,VS0,VE0
< vary: Accept-Encoding, Accept-Encoding
< strict-transport-security: max-age=31536000; includeSubDomains; preload
< x-frame-options: deny
< x-xss-protection: 1; mode=block
< x-content-type-options: nosniff
< x-permitted-cross-domain-policies: none
< content-length: 99851
< 

  0 99851    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Connection #0 to host pypi.org left intact
HTTP/2 200 
access-control-allow-headers: Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-expose-headers: X-PyPI-Last-Serial
access-control-max-age: 86400
cache-control: max-age=900, public
content-security-policy: base-uri 'self'; block-all-mixed-content; connect-src 'self' https://api.github.com/repos/ *.fastly-insights.com sentry.io https://api.pwnedpasswords.com https://2p66nmmycsj3.statuspage.io; default-src 'none'; font-src 'self' fonts.gstatic.com; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' https://warehouse-camo.ingress.cmh1.psfhosted.org/ www.google-analytics.com *.fastly-insights.com; script-src 'self' www.googletagmanager.com www.google-analytics.com *.fastly-insights.com https://cdn.ravenjs.com; style-src 'self' fonts.googleapis.com; worker-src *.fastly-insights.com
content-type: application/json
etag: "1bScw84sINFW/pIshXUiKQ"
referrer-policy: origin-when-cross-origin
server: nginx/1.13.9
x-pypi-last-serial: 7292768
accept-ranges: bytes
date: Mon, 20 Jul 2020 16:37:33 GMT
x-served-by: cache-bwi5120-BWI, cache-hhn4020-HHN
x-cache: HIT, HIT
x-cache-hits: 5, 2
x-timer: S1595263053.122044,VS0,VE0
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
content-length: 99851

curl -vvv -I --ipv6 https://files.pythonhosted.org/packages/ae/e8/2340d46ecadb1692a1e455f13f75e596d4eab3d11a57446f08259dee8f02/pip-10.0.1.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 2a04:4e42::319...
* TCP_NODELAY set

  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:03 --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:04 --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:05 --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:06 --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:07 --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:08 --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:09 --:--:--     0* getpeername() failed with errno 22: Invalid argument
* Connected to files.pythonhosted.org () port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to files.pythonhosted.org:443 

  0     0    0     0    0     0      0      0 --:--:--  0:00:09 --:--:--     0
* Closing connection 0
curl: (35) getpeername() failed with errno 22: Invalid argument

TLS Debug

IPv4

echo -n | openssl s_client -4 -connect pypi.org:443
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 Extended Validation Server CA
verify return:1
depth=0 businessCategory = Private Organization, jurisdictionCountryName = US, jurisdictionStateOrProvinceName = Delaware, serialNumber = 3359300, C = US, ST = New Hampshire, L = Wolfeboro, O = Python Software Foundation, CN = www.python.org
verify return:1
CONNECTED(00000005)
---
Certificate chain
 0 s:/businessCategory=Private Organization/jurisdictionCountryName=US/jurisdictionStateOrProvinceName=Delaware/serialNumber=3359300/C=US/ST=New Hampshire/L=Wolfeboro/O=Python Software Foundation/CN=www.python.org
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIIczCCB1ugAwIBAgIQDl7PGBeDAG2brEU2EfVJEjANBgkqhkiG9w0BAQsFADB1
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMTQwMgYDVQQDEytEaWdpQ2VydCBTSEEyIEV4dGVuZGVk
IFZhbGlkYXRpb24gU2VydmVyIENBMB4XDTE4MDkxODAwMDAwMFoXDTIwMTAxNDEy
MDAwMFowgdgxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
BAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQF
EwczMzU5MzAwMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTmV3IEhhbXBzaGlyZTES
MBAGA1UEBxMJV29sZmVib3JvMSMwIQYDVQQKExpQeXRob24gU29mdHdhcmUgRm91
bmRhdGlvbjEXMBUGA1UEAxMOd3d3LnB5dGhvbi5vcmcwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQD2roGTDc+m3g3mReIf7j5rzLovnk3Zggvy2kWWMnDB
Yz2m6sgxOL1pkzIu7YNe4noH7ZRym0OIQjZbDIleB7SOGAoD2BBv+Mv79HtedJ3d
vhXwmgRenlNxBxhDcaVLDONVC9Ir3Ft46uuGIrXnKB8L1KZV6h8IFC2G3GZXJtkw
EojXdmJFzuRrKMRi0cLPlF60upRISIj3jg9kK4D+f0xYrsQAJvK0veqRsNQ8bXPE
YR8kG4Paj7rOeh3FVGxrKOKNpoI+kV6EqOVIhJY698P7EbDLGjG2Im9P6VFmwXod
YAZ2CTFaMlrC0FljAO/FKeQKR29vitthLMutcd+AkoDDAgMBAAGjggSZMIIElTAf
BgNVHSMEGDAWgBQ901Cl1qCt7vNKYApl0yHU+PjWDzAdBgNVHQ4EFgQUUTsyHAXZ
y6d2HWn+8MZNUhBCkEwwggFCBgNVHREEggE5MIIBNYIOd3d3LnB5dGhvbi5vcmeC
D2RvY3MucHl0aG9uLm9yZ4IPYnVncy5weXRob24ub3Jngg93aWtpLnB5dGhvbi5v
cmeCDWhnLnB5dGhvbi5vcmeCD21haWwucHl0aG9uLm9yZ4IPcHlwaS5weXRob24u
b3JnghRwYWNrYWdpbmcucHl0aG9uLm9yZ4IQbG9naW4ucHl0aG9uLm9yZ4ISZGlz
Y3Vzcy5weXRob24ub3Jnggx1cy5weWNvbi5vcmeCB3B5cGkuaW+CDGRvY3MucHlw
aS5pb4IIcHlwaS5vcmeCDWRvY3MucHlwaS5vcmeCD2RvbmF0ZS5weXBpLm9yZ4IT
ZGV2Z3VpZGUucHl0aG9uLm9yZ4ITd3d3LmJ1Z3MucHl0aG9uLm9yZ4IKcHl0aG9u
Lm9yZzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMHUGA1UdHwRuMGwwNKAyoDCGLmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9z
aGEyLWV2LXNlcnZlci1nMi5jcmwwNKAyoDCGLmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0
LmNvbS9zaGEyLWV2LXNlcnZlci1nMi5jcmwwSwYDVR0gBEQwQjA3BglghkgBhv1s
AgEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAH
BgVngQwBATCBiAYIKwYBBQUHAQEEfDB6MCQGCCsGAQUFBzABhhhodHRwOi8vb2Nz
cC5kaWdpY2VydC5jb20wUgYIKwYBBQUHMAKGRmh0dHA6Ly9jYWNlcnRzLmRpZ2lj
ZXJ0LmNvbS9EaWdpQ2VydFNIQTJFeHRlbmRlZFZhbGlkYXRpb25TZXJ2ZXJDQS5j
cnQwDAYDVR0TAQH/BAIwADCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHcA7ku9
t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo/csAAAFl7l3MWwAABAMASDBGAiEA
qfAJSfOHG4r8YvzTkZsr8cEXFcnFIns40+JXVdgY0vsCIQCvnB+YExtMRQVQXONc
glOTsIYmNgYPrtyHYsTj/Xua5QB3AFYUBpov18Ls0/XhvUSyPsdGdrm8mRFcwO+U
mFXWidDdAAABZe5dzHoAAAQDAEgwRgIhAIF6xXakKVdREciK8aM2z1c71eiU8qF/
UCZbl4sEfLTQAiEA870pR9Hazod3FgZszr9itk8sYPLoQjV9/WENl0HXXGwAdQC7
2d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAWXuXcwzAAAEAwBGMEQC
IAeIvcaqPATJrCo3+ceBlVbsyPJcDPM7QGLpaRPFBduQAiBHNfcsBLaelS9bUmfU
R0VjJLoTA39AJAj8oU6iAzruHDANBgkqhkiG9w0BAQsFAAOCAQEAwH5+PXougfo5
qMVIE65Dei/CEb4ahZfoMvvlJRvuNAI/ARWYQSHh6IKXdxFxIE5hCC/NNtdAcc1p
CoZ2+IM/x0cGBjHZegSjhXfQy+w7twfgyeTSNalV2jzKQ0Yv/JvfI9qiMdhEQbfL
qaQ6Nj/js8uvQqWf6w8yo7hAzKs1jTF7Wy/cM0lvqNocDWYROhAVcI+jSMKwlcLv
75xAbOZqw2D483mkQizVj7wQ1fYP3Tr0wfvFNeoIAPUXLrEHiEmHWA0h+U9KEgVf
VQ3PvzItecKWFI+0d9RpNupc1HdipBCySvnNa1LcG2AviYXpIsbo8EBvbj0HcEVx
7NEANHNX2g==
-----END CERTIFICATE-----
subject=/businessCategory=Private Organization/jurisdictionCountryName=US/jurisdictionStateOrProvinceName=Delaware/serialNumber=3359300/C=US/ST=New Hampshire/L=Wolfeboro/O=Python Software Foundation/CN=www.python.org
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
---
No client certificate CA names sent
Server Temp Key: ECDH, X25519, 253 bits
---
SSL handshake has read 4001 bytes and written 293 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 033D546B62DB8A0F252E5C1D9B42C37C08F7EF9190ED1AB44D43295B6A6D9278
    Session-ID-ctx: 
    Master-Key: 225E1AF122A40B9A33AF1C21A74F4017530E05DB88A42902A68B4A68C817921E91A80803419784464D6089A550AE7F64
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - bf 22 e3 13 85 4e 84 47-b8 70 98 dc d2 12 a8 7b   ."...N.G.p.....{
    0010 - 1f 11 61 53 5e 77 4a 15-71 c1 75 f1 85 91 4e e7   ..aS^wJ.q.u...N.
    0020 - 66 82 27 33 e4 80 c4 fd-3d 66 72 79 73 99 c4 6e   f.'3....=frys..n
    0030 - f2 f3 d3 09 9e f2 d4 55-e2 df fe 69 c2 e5 be a0   .......U...i....
    0040 - 60 f4 cf c7 49 0e ea 22-59 a8 bf dd 1c dc e0 0b   `...I.."Y.......
    0050 - 70 2e 79 64 71 4e a5 2b-3e 7b 42 dd 8a 60 08 db   p.ydqN.+>{B..`..
    0060 - 67 90 4d a0 0c 2b a1 c7-ce 2b 9d 4b 4e 71 53 f3   g.M..+...+.KNqS.
    0070 - 20 eb 2d 90 02 18 07 13-c4 4c fb e7 ca 92 b9 40    .-......L.....@
    0080 - 80 6c ef 93 d1 15 f3 f1-ad b7 aa dc 38 3d 55 ff   .l..........8=U.
    0090 - c8 7f bb 66 6d d0 8e 77-1e b2 61 1f 68 66 7f a5   ...fm..w..a.hf..

    Start Time: 1595263219
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
DONE

echo -n | openssl s_client -4 -connect files.pythonhosted.org:443
depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign CloudSSL CA - SHA256 - G3
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "Fastly, Inc", CN = r.ssl.fastly.net
verify return:1
CONNECTED(00000005)
---
Certificate chain
 0 s:/C=US/ST=California/L=San Francisco/O=Fastly, Inc/CN=r.ssl.fastly.net
   i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign CloudSSL CA - SHA256 - G3
 1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign CloudSSL CA - SHA256 - G3
   i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIJuzCCCKOgAwIBAgIMIv4nxcJWdBF2KcUVMA0GCSqGSIb3DQEBCwUAMFcxCzAJ
BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS0wKwYDVQQDEyRH
bG9iYWxTaWduIENsb3VkU1NMIENBIC0gU0hBMjU2IC0gRzMwHhcNMjAwNzEzMTc0
NjExWhcNMjEwNDI4MTkyMDI1WjBrMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2Fs
aWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEUMBIGA1UECgwLRmFzdGx5
LCBJbmMxGTAXBgNVBAMMEHIuc3NsLmZhc3RseS5uZXQwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDTciJwVUeYpeFv0YzWACjrrAg7Qy2yWqLNrGXTJu0m
0bWfeB9kA3gY3gny66LF6W/hYVXtf+oCneDWIpm7eO8DogP+k9H2uwOkCnEXOGog
Jj1QfWnlqYQSpK0HRZ8idm6EglJANXBqK/G+Nbnqb0P68MsdaTKLo1zHyRcEncbZ
OnWAgYkZ1s5CyNQmNhn741JrkXuEcLjuRi5oFP252w8qhcxLAzI9T7pfym9ERcvM
kwZUXUIv9z0qrU3HikASfL6TC2O1qfHwVd4RvR74WOdDHkS02AQWx3NpVbfBLI53
GM/f59vocj3z6cV5TmUcbgrvYt2Lm215mjIOefyzxqlxAgMBAAGjggZxMIIGbTAO
BgNVHQ8BAf8EBAMCBaAwgYoGCCsGAQUFBwEBBH4wfDBCBggrBgEFBQcwAoY2aHR0
cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvY2xvdWRzc2xzaGEyZzMu
Y3J0MDYGCCsGAQUFBzABhipodHRwOi8vb2NzcDIuZ2xvYmFsc2lnbi5jb20vY2xv
dWRzc2xzaGEyZzMwVgYDVR0gBE8wTTBBBgkrBgEEAaAyARQwNDAyBggrBgEFBQcC
ARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wCAYGZ4EM
AQICMAkGA1UdEwQCMAAwggQBBgNVHREEggP4MIID9IIQci5zc2wuZmFzdGx5Lm5l
dIIMKi5hZHdlcnguY29tghEqLmFsaXR0bGVjcmFmdC5pdIITKi5hbGl0dGxlbWFy
a2V0LmNvbYIVKi5hbGl0dGxlbWVyY2VyaWUuY29tghAqLmNhdGNocG9pbnQuY29t
gggqLmNubi5pb4IVKi5kb2xsYXJzaGF2ZWNsdWIuY29tggsqLmVhdGVyLmNvbYIc
Ki5maWxlcy5zYXltZWRpYS1jb250ZW50LmNvbYIMKi5maW5uY2RuLm5vgggqLmZ0
LmNvbYIUKi5oaXBtdW5rc3RhZ2luZy5jb22CECouaG91c2Vsb2dpYy5jb22CEiou
bWVldHVwc3RhdGljLmNvbYINKi5uZXR6d2VsdC5kZYIJKi5uZmwuY29tggoqLnBh
Z2FyLm1lgg8qLnBpY21vbmtleS5jb22CCSoucHlwaS5pb4IKKi5weXBpLm9yZ4IS
Ki5weXRob25ob3N0ZWQub3Jngg4qLnJlYWxzZWxmLmNvbYIJKi5ydGJmLmJlgg4q
LnNibmF0aW9uLmNvbYILKi5zaGFrci5jb22CECouc3RhdGljLnJ0YmYuYmWCECou
c3RyZWFtYWJsZS5jb22CDCouc3VyZmx5LmNvbYIOKi50aGV2ZXJnZS5jb22CDyou
dGhyaWxsaXN0LmNvbYINKi52b3gtY2RuLmNvbYIJKi52b3guY29tgg4qLnZveG1l
ZGlhLmNvbYIMKi53ZXdvcmsuY29tggphZHdlcnguY29tgg9hbGl0dGxlY3JhZnQu
aXSCEWFsaXR0bGVtYXJrZXQuY29tghNhbGl0dGxlbWVyY2VyaWUuY29tghZhbHBo
YS5lbnRyZXByZW5ldXIuY29tggllYXRlci5jb22CEGVudHJlcHJlbmV1ci5jb22C
FGZhc3RseS5zaGlla2hkZXYuY29tggZmdC5jb22CFWgyLmhpcG11bmtzdGFnaW5n
LmNvbYIIaS5nc2UuaW+CC2xvc3RteS5uYW1lgg1waWNtb25rZXkuY29tghhwcmV2
aWV3LmVudHJlcHJlbmV1ci5jb22CEHB5dGhvbmhvc3RlZC5vcmeCEXFhLnNhZmFy
aWZsb3cuY29tggxyZWFsc2VsZi5jb22CB3J0YmYuYmWCFHN0YXRpYy53aXhzdGF0
aWMuY29tgg5zdHJlYW1hYmxlLmNvbYIKc3VyZmx5LmNvbYIMdGhldmVyZ2UuY29t
ggt2b3gtY2RuLmNvbYIHdm94LmNvbYIUd3d3LmVudHJlcHJlbmV1ci5jb22CDnd3
dy5qb3llbnQuY29tghV3d3cucWEuc2FmYXJpZmxvdy5jb20wHQYDVR0lBBYwFAYI
KwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFKkrh+HOJEc7G7/PhTcCVZ0N
lFjmMB0GA1UdDgQWBBTxY+TFzJgw7IN9ivLLaqdlMf3mvzCCAQUGCisGAQQB1nkC
BAIEgfYEgfMA8QB2AO7Ale6NcmQPkuPDuRvHEqNpagl7S2oaFDjmR7LL7cX5AAAB
c0lI0J8AAAQDAEcwRQIhAJyhv/2T/cg+llhnp/yBWZONaTrnA1cPCY7GKBMNFImx
AiB0NUlpb4Ki7AyILBiecQ3xp0yaNDJ4+LOmjowS2wXZ8AB3APZclC/RdzAiFFQY
CDCUVo7jTRMZM7/fDC8gC8xO8WTjAAABc0lI0JMAAAQDAEgwRgIhANd3AjhosuGC
XDG/ZoLahmZL6cgS1JeHAU6gGedfaSxRAiEA+itmVtM5a/IdhDcpf0RYoivy3sSY
njCi2chBAtAgY5MwDQYJKoZIhvcNAQELBQADggEBAFXe/QXa9DIUZac9Aid+OYPj
MgAGPQ4q8swsJbV9VYueRNUzaqX2jOhhyj1dMxa4Fl3fXeDpkY8iY6VuR39at45l
9CHtIHT9NJDw7UtDbbzVKbwD5qXMnIEP3nbdPWcFcAkVgTphpQjdxz/y9ZgKyaCK
F2d1Btu5aHacd6ZUNKXgNlflArbixk6hDDdqNG+GTcNfL0r1WXk60HoGU6eBmxFb
Ydso4kC4jL1xwirleISteTDl/ffC/08XUdya29e+C4s7w0tG6BWdGiRExAYM7nqt
9n0+W6F4axUvOEpe0kapnu8JxAPQMY/dKrGowtq5cbINMc2ZsyYP23uzzIlN0xU=
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=San Francisco/O=Fastly, Inc/CN=r.ssl.fastly.net
issuer=/C=BE/O=GlobalSign nv-sa/CN=GlobalSign CloudSSL CA - SHA256 - G3
---
No client certificate CA names sent
Server Temp Key: ECDH, X25519, 253 bits
---
SSL handshake has read 4286 bytes and written 293 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 921626F91CA3BDBA6F295EEEC3320DA74903BAA58E601AB808ECEFEA903F1F8E
    Session-ID-ctx: 
    Master-Key: FAA2BCDD2D968396445A7F7D0D1580EBE01506DC6CBCF18F72D4A1CAE932EFCC78894628C7344685CB85CDA9F1FEF36D
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - bf 22 e3 13 85 4e 84 47-b8 70 98 dc d2 12 a8 7b   ."...N.G.p.....{
    0010 - 02 a4 f7 e2 8c 9b 23 01-86 cb 41 f9 75 33 84 d7   ......#...A.u3..
    0020 - b4 f4 11 03 d6 c8 fe 11-e9 d1 c7 35 8c 6f 83 b9   ...........5.o..
    0030 - 2a 6f 61 e5 ac 2f 29 0f-58 4d c7 57 71 04 37 a6   *oa../).XM.Wq.7.
    0040 - f1 ef c0 a0 f9 01 2b a7-44 34 96 cf 5f e7 22 94   ......+.D4.._.".
    0050 - b6 dd ee 5c d2 7e a6 39-54 c9 dd f4 46 e5 58 1e   ...\.~.9T...F.X.
    0060 - ec 05 02 d6 98 98 da 9c-1b af fd 30 f4 17 fd 91   ...........0....
    0070 - 43 be c7 89 e3 ae 75 64-a1 52 b3 0e 67 e0 48 c6   C.....ud.R..g.H.
    0080 - 6c ab 9b d3 3b c3 c7 24-db 8c 1e 13 c6 88 b6 99   l...;..$........
    0090 - f0 30 4b 2a 75 c6 b9 4e-09 b0 d1 b0 af 18 b7 06   .0K*u..N........

    Start Time: 1595263240
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
DONE

IPv6 (If available)

echo -n | openssl s_client -6 -connect pypi.org:443
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 Extended Validation Server CA
verify return:1
depth=0 businessCategory = Private Organization, jurisdictionCountryName = US, jurisdictionStateOrProvinceName = Delaware, serialNumber = 3359300, C = US, ST = New Hampshire, L = Wolfeboro, O = Python Software Foundation, CN = www.python.org
verify return:1
CONNECTED(00000005)
---
Certificate chain
 0 s:/businessCategory=Private Organization/jurisdictionCountryName=US/jurisdictionStateOrProvinceName=Delaware/serialNumber=3359300/C=US/ST=New Hampshire/L=Wolfeboro/O=Python Software Foundation/CN=www.python.org
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIIczCCB1ugAwIBAgIQDl7PGBeDAG2brEU2EfVJEjANBgkqhkiG9w0BAQsFADB1
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMTQwMgYDVQQDEytEaWdpQ2VydCBTSEEyIEV4dGVuZGVk
IFZhbGlkYXRpb24gU2VydmVyIENBMB4XDTE4MDkxODAwMDAwMFoXDTIwMTAxNDEy
MDAwMFowgdgxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
BAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQF
EwczMzU5MzAwMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTmV3IEhhbXBzaGlyZTES
MBAGA1UEBxMJV29sZmVib3JvMSMwIQYDVQQKExpQeXRob24gU29mdHdhcmUgRm91
bmRhdGlvbjEXMBUGA1UEAxMOd3d3LnB5dGhvbi5vcmcwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQD2roGTDc+m3g3mReIf7j5rzLovnk3Zggvy2kWWMnDB
Yz2m6sgxOL1pkzIu7YNe4noH7ZRym0OIQjZbDIleB7SOGAoD2BBv+Mv79HtedJ3d
vhXwmgRenlNxBxhDcaVLDONVC9Ir3Ft46uuGIrXnKB8L1KZV6h8IFC2G3GZXJtkw
EojXdmJFzuRrKMRi0cLPlF60upRISIj3jg9kK4D+f0xYrsQAJvK0veqRsNQ8bXPE
YR8kG4Paj7rOeh3FVGxrKOKNpoI+kV6EqOVIhJY698P7EbDLGjG2Im9P6VFmwXod
YAZ2CTFaMlrC0FljAO/FKeQKR29vitthLMutcd+AkoDDAgMBAAGjggSZMIIElTAf
BgNVHSMEGDAWgBQ901Cl1qCt7vNKYApl0yHU+PjWDzAdBgNVHQ4EFgQUUTsyHAXZ
y6d2HWn+8MZNUhBCkEwwggFCBgNVHREEggE5MIIBNYIOd3d3LnB5dGhvbi5vcmeC
D2RvY3MucHl0aG9uLm9yZ4IPYnVncy5weXRob24ub3Jngg93aWtpLnB5dGhvbi5v
cmeCDWhnLnB5dGhvbi5vcmeCD21haWwucHl0aG9uLm9yZ4IPcHlwaS5weXRob24u
b3JnghRwYWNrYWdpbmcucHl0aG9uLm9yZ4IQbG9naW4ucHl0aG9uLm9yZ4ISZGlz
Y3Vzcy5weXRob24ub3Jnggx1cy5weWNvbi5vcmeCB3B5cGkuaW+CDGRvY3MucHlw
aS5pb4IIcHlwaS5vcmeCDWRvY3MucHlwaS5vcmeCD2RvbmF0ZS5weXBpLm9yZ4IT
ZGV2Z3VpZGUucHl0aG9uLm9yZ4ITd3d3LmJ1Z3MucHl0aG9uLm9yZ4IKcHl0aG9u
Lm9yZzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMHUGA1UdHwRuMGwwNKAyoDCGLmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9z
aGEyLWV2LXNlcnZlci1nMi5jcmwwNKAyoDCGLmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0
LmNvbS9zaGEyLWV2LXNlcnZlci1nMi5jcmwwSwYDVR0gBEQwQjA3BglghkgBhv1s
AgEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAH
BgVngQwBATCBiAYIKwYBBQUHAQEEfDB6MCQGCCsGAQUFBzABhhhodHRwOi8vb2Nz
cC5kaWdpY2VydC5jb20wUgYIKwYBBQUHMAKGRmh0dHA6Ly9jYWNlcnRzLmRpZ2lj
ZXJ0LmNvbS9EaWdpQ2VydFNIQTJFeHRlbmRlZFZhbGlkYXRpb25TZXJ2ZXJDQS5j
cnQwDAYDVR0TAQH/BAIwADCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHcA7ku9
t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo/csAAAFl7l3MWwAABAMASDBGAiEA
qfAJSfOHG4r8YvzTkZsr8cEXFcnFIns40+JXVdgY0vsCIQCvnB+YExtMRQVQXONc
glOTsIYmNgYPrtyHYsTj/Xua5QB3AFYUBpov18Ls0/XhvUSyPsdGdrm8mRFcwO+U
mFXWidDdAAABZe5dzHoAAAQDAEgwRgIhAIF6xXakKVdREciK8aM2z1c71eiU8qF/
UCZbl4sEfLTQAiEA870pR9Hazod3FgZszr9itk8sYPLoQjV9/WENl0HXXGwAdQC7
2d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAWXuXcwzAAAEAwBGMEQC
IAeIvcaqPATJrCo3+ceBlVbsyPJcDPM7QGLpaRPFBduQAiBHNfcsBLaelS9bUmfU
R0VjJLoTA39AJAj8oU6iAzruHDANBgkqhkiG9w0BAQsFAAOCAQEAwH5+PXougfo5
qMVIE65Dei/CEb4ahZfoMvvlJRvuNAI/ARWYQSHh6IKXdxFxIE5hCC/NNtdAcc1p
CoZ2+IM/x0cGBjHZegSjhXfQy+w7twfgyeTSNalV2jzKQ0Yv/JvfI9qiMdhEQbfL
qaQ6Nj/js8uvQqWf6w8yo7hAzKs1jTF7Wy/cM0lvqNocDWYROhAVcI+jSMKwlcLv
75xAbOZqw2D483mkQizVj7wQ1fYP3Tr0wfvFNeoIAPUXLrEHiEmHWA0h+U9KEgVf
VQ3PvzItecKWFI+0d9RpNupc1HdipBCySvnNa1LcG2AviYXpIsbo8EBvbj0HcEVx
7NEANHNX2g==
-----END CERTIFICATE-----
subject=/businessCategory=Private Organization/jurisdictionCountryName=US/jurisdictionStateOrProvinceName=Delaware/serialNumber=3359300/C=US/ST=New Hampshire/L=Wolfeboro/O=Python Software Foundation/CN=www.python.org
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
---
No client certificate CA names sent
Server Temp Key: ECDH, X25519, 253 bits
---
SSL handshake has read 4001 bytes and written 293 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: C5941135698DD436E54D41359DD2F4CEB31B23D5BCBDBE2C2ED84FD96A22F168
    Session-ID-ctx: 
    Master-Key: 73B93158FCF3F846AE17E1D85F19B3B5BCB1737519465F59463C89E51327469F315B91D9F132D9E65DB6916E8A541EC0
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - bf 22 e3 13 85 4e 84 47-b8 70 98 dc d2 12 a8 7b   ."...N.G.p.....{
    0010 - 2c 17 b3 8d da 42 e6 56-ce 52 24 13 10 5c 18 59   ,....B.V.R$..\.Y
    0020 - 23 e9 3f 24 4c be 2c 28-69 79 97 27 b6 69 4a 4f   #.?$L.,(iy.'.iJO
    0030 - ab cd 86 83 14 20 e5 10-61 5b f2 c5 31 77 2b e5   ..... ..a[..1w+.
    0040 - 64 0b 78 14 92 16 17 75-2c 06 24 59 03 3f 49 1f   d.x....u,.$Y.?I.
    0050 - 5c aa af 3d f6 94 4f 5c-27 30 a6 59 20 e9 fa 5f   \..=..O\'0.Y .._
    0060 - 6a b0 9f 5c 03 c8 5e 75-7e 03 2b b1 71 b1 bb 15   j..\..^u~.+.q...
    0070 - c8 f4 a3 70 0e 0c 87 83-ea 07 7e 51 c0 9b 3f ef   ...p......~Q..?.
    0080 - 4c b5 70 c9 7c 10 6d bf-8c 92 08 71 9a 2d 77 29   L.p.|.m....q.-w)
    0090 - 79 8a b8 dd 38 03 dc ef-76 3a a6 21 32 9a aa da   y...8...v:.!2...

    Start Time: 1595263305
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
DONE

echo -n | openssl s_client -6 -connect files.pythonhosted.org:443
read:errno=32
CONNECTED(00000005)
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Start Time: 1595263598
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

[di]

Do you have any antivirus or firewall enabled?

[segevfiner]

macOS builtin firewall, no antivirus.

[jamadden]

I mentioned on the original issue that I have a similar configuration (public IPv6, natted IPv4, macOS 10.15.6, firewall on) that works for me. e.g.,

curl —ipv6 output

$  curl -vvv -I --ipv6 https://files.pythonhosted.org/packages/ae/e8/2340d46ecadb1692a1e455f13f75e596d4eab3d11a57446f08259dee8f02/pip-10.0.1.tar.gz
*   Trying 2a04:4e42:600::319:443...
* Connected to files.pythonhosted.org (2a04:4e42:600::319) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /opt/local/share/curl/curl-ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=Fastly, Inc; CN=r.ssl.fastly.net
*  start date: Jul 20 18:19:08 2020 GMT
*  expire date: Apr 28 19:20:25 2021 GMT
*  subjectAltName: host "files.pythonhosted.org" matched cert's "*.pythonhosted.org"
*  issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign CloudSSL CA - SHA256 - G3
*  SSL certificate verify ok.
> HEAD /packages/ae/e8/2340d46ecadb1692a1e455f13f75e596d4eab3d11a57446f08259dee8f02/pip-10.0.1.tar.gz HTTP/1.1
> Host: files.pythonhosted.org
> User-Agent: curl/7.71.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Connection: keep-alive
Connection: keep-alive
< Content-Length: 1246072
Content-Length: 1246072
< Last-Modified: Wed, 26 Feb 2020 17:47:37 GMT
Last-Modified: Wed, 26 Feb 2020 17:47:37 GMT
< ETag: "83a177756e2c801d0b3a6f7b0d4f3f7e"
ETag: "83a177756e2c801d0b3a6f7b0d4f3f7e"
< Content-Type: binary/octet-stream
Content-Type: binary/octet-stream
< x-goog-hash: crc32c=Om2N1A==
x-goog-hash: crc32c=Om2N1A==
< x-goog-hash: md5=g6F3dW4sgB0LOm97DU8/fg==
x-goog-hash: md5=g6F3dW4sgB0LOm97DU8/fg==
< Server: UploadServer
Server: UploadServer
< Cache-Control: max-age=365000000, immutable, public
Cache-Control: max-age=365000000, immutable, public
< Accept-Ranges: bytes
Accept-Ranges: bytes
< Date: Mon, 20 Jul 2020 19:42:24 GMT
Date: Mon, 20 Jul 2020 19:42:24 GMT
< Age: 311712
Age: 311712
< X-Served-By: cache-sea4478-SEA, cache-dfw18621-DFW
X-Served-By: cache-sea4478-SEA, cache-dfw18621-DFW
< X-Cache: HIT, HIT
X-Cache: HIT, HIT
< X-Cache-Hits: 1, 1
X-Cache-Hits: 1, 1
< X-Timer: S1595274144.016807,VS0,VE5
X-Timer: S1595274144.016807,VS0,VE5
< Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
< X-Frame-Options: deny
X-Frame-Options: deny
< X-XSS-Protection: 1; mode=block
X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
X-Content-Type-Options: nosniff
< X-Permitted-Cross-Domain-Policies: none
X-Permitted-Cross-Domain-Policies: none
< X-Robots-Header: noindex
X-Robots-Header: noindex

<
* Connection #0 to host files.pythonhosted.org left intact

My curl works, but the original poster got "getpeername() failed with errno 22: Invalid argument". The man page for getpeername says EINVAL is returned when "socket has been shut down." Then later, the OP got

$ echo -n | openssl s_client -6 -connect files.pythonhosted.org:443
read:errno=32

errno 32 is EPIPE. So it looks like something is prematurely killing the OPs IPv6 connections?

[segevfiner]

This is happening against pypi.org intermittently too. Strangely enough it doesn't happen from the browser, at least I didn't see it happen yet. Wireshark is showing that I'm getting back an ICMPv6 hop limit exceeded error back after it tries to send a TCP SYN a few times and doesn't get an answer back. So a routing loop somewhere? Or is the hop limit on macOS too low?

pypi-ipv6-issue.pcapng.zip

[segevfiner]

Now I'm having issues on Windows as well:

curl -vvv -I --ipv6 https://pypi.org/pypi/pip/json
*   Trying 2a04:4e42:400::223...
* TCP_NODELAY set
* Connected to pypi.org (2a04:4e42:400::223) port 443 (#0)
* schannel: SSL/TLS connection with pypi.org port 443 (step 1/3)
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 179 bytes...
* schannel: sent initial handshake data: sent 179 bytes
* schannel: SSL/TLS connection with pypi.org port 443 (step 2/3)
* schannel: failed to receive handshake, need more data

[segevfiner]

I had to add the following to my hosts file to be able to access PyPI for the time being:

151.101.0.223	pypi.org
151.101.1.63	files.pythonhosted.org

[segevfiner]

This seems to possibly be an issue with Fastly and my ISP over IPv6? GitHub is apparently also using it, and seems to have enabled IPv6 for some resources over it, and now I can't download GitHub releases, only see user avatars intermittently, and so on. I'm not sure how to diagnose further and who to contact... (I have a feeling my ISP's support will probably answer with "WhTs IP?" after waiting for at least an hour for them to even answer...)

[di]

This is very likely an issue with your ISP's support for IPV6. Closing as we can't do much to help here, but good luck!

[nakad-vii]

this error is coming because files.pythonhosted.org, pypi.python.org, pypi.org are not in trusted hosts

you can permanently add them in trusted host like this

mkdir -p ~/.config/pip nano ~/.config/pip/pip.conf

[global] trusted-host = pypi.org pypi.python.org files.pythonhosted.org

For temporary solution you can do this
pip install --no-cache-dir --trusted-host pypi.org --trusted-host pypi.python.org --trusted-host files.pythonhosted.org <package-name>