Package: pypiprivate
pypiprivateis a command line tool for hosting a privatePyPI-like package index or in other words, amanual python
repositorybacked
by a file based storage.It’s implemented in a way that the storage backends are pluggable. At
present, onlyAWS S3and local file system are supported but more
implementations can be added in future.The backend can be protected behind a HTTP reverse proxy (eg.Nginx)
to allow secure private access to the packages.How it works?Update: We have published a blog post that explains the usage,
approach and rationale in detail -Private Python Package Index with
Zero Hassle.At presentpypiprivatecomes with only one command to publish a
package (more utilities for package search and discoverability are
coming soon).A publish operation involves,Copying all the available package artifacts for a specific version
under the./distdirectory to the storage backendCreating the index on the same storage backendThe file structure created on the backend conforms to the “Simple
Repository API” specification defined inPEP 503.The files can now be served securely by a webserver eg. by setting up
a Nginx reverse proxy.It’s important to note that although the name of the project ispypiprivate,it’s upto you to ensure that the access to both,
the storage and the index is really private. If you are using S3 and
Nginx, for example, thenpackage authors/owners will need read-write S3 creds to publish
packagesnginx will authenticate with S3 using read-only S3 creds and protect
the files via HTTP Basic authenticationpackage users will need HTTP Auth creds to install the packages
using pipInstallationpypi-privatecan be installed usingpipas follows,$pipinstallpypiprivateThis will install pypiprivate with the additional dependency ofboto3for AWS S3 (compatible) backend.In last master (to be released), Azure backend is also supported. If
you wish to use that then for now you’ll need to additionally install theazure-storage-blobpackage$pipinstallazure-storage-blob==12.2.0After installation, a scriptpypi-privatewhich will be available
atPATH.You may choose to install it in avirtualenv, but it’s recommended to
install it globally for all users (usingsudo) so that it’s less
confusing to build and publish projects that need to use their own
virtualenvs.Configurationpypiprivaterequires it’s own config file, the default location
for which is~/.pypi-private.cfg. This repo contains the example
config fileexample.pypi-private.cfg, which can be simply copied
to the home directory and renamed to.pypi-private.cfg.The config file isNOTmeant for specifying the auth
credentials. Instead, they should be set as environment
variables. This to ensure that creds are not stored in plain text.Which env vars are to be set depends on the backend. More
documentation about it can be found in the example config file.AWS S3For S3 there are 2 ways to specify the credentialsSettingPP_S3_*env vars explicitlyPP_S3_ACCESS_KEY: requiredPP_S3_SECRET_KEY: requiredPP_S3_SESSION_TOKEN: optionalConfiguration methods supported by Boto3Since version: to be releasedThis method is implicit but more convenient if you already use
tools such asAWS-CLI. It’d also allow you to use
profiles. However, note that only credentials will be picked up for
the configured profile. Theregionandendpoint(if
required) need to explicitly configured in the~/.pypi-private.cfgfile.AZURESince version: to be releasedPP_AZURE_CONN_STR: (required) Connection string of the storage
accountUsageFirst create the builds,$pythonsetup.pysdistbdist_wheelThen to publish the built artifacts run,$pypi-private-vpublish<pkg-name><pkg-version>For other options, run$pypi-private-hFetching packages published using pypiprivateRun pip with the--extra-index-urloption,$pipinstallmypackage--extra-index-url=https://<user>:<password>@my.private.pypi.com/simpleOr, add theextra-index-urlto pip config file at~/.pip/pip.confas follows[install]
extra-index-url = https://<user>:<password>@my.private.pypi.com/simpleAnd then simply run,$pipinstallmypackageLicenseMIT (SeeLICENSE)