从私有bitbucket回购tar.gz文件进行pip安装

Question

I have a common private repo that depends on other private repos.

I have a build process that creates a tar.gz file. it's on this url

https://git.my_company.com/projects/RA/repos/my-common-module/browse/scripts/testing_dist/api_common_module-4.0.10.tar.gz

here is the ssh url

ssh://git@git.my_company.com:8500/ra/my-common-module.git

my question is, what's the pip command I should use to install it from the terminal and a follow-up question, what should I write in the requirements.txt file to notate that installation?

Answer 1

You can do this, but it's a potential security risk, so proceed with caution.

Bitbucket Cloud, Bitbucket Server and GitHub allow you to generate App Passwords (Bitbucket Cloud) or Personal Access Tokens (Bitbucket Server, GitHub). These can be limited in scope (eg read only) so that the passwords can't be used to perform destructive actions. You can use these to embed a username and password directly to a URL that's pip-installable, eg:

pip install -e git+https://charlie:abcdefgh12345678@bitbucket.org/charlie/snakesonaplane.git@master#egg=snakesonaplane

(Note: not a real repo)

Here's the problem: it's almost always dangerous to commit any kind of credential to a project where other people can see it. Putting something like this into your requirements.txt , for example, is almost always going to be a bad idea. Even if it's a read only password, and even if anyone who might have access to it already has access to everything else it would otherwise provide them access to, it's still a hole. Imagine if one of your teammates leaves your group/company/etc., they may potentially retain read only access to all your work for as long as the app password is valid.

The "ideal" solution here is to host your own PyPi server. You can use this to host private packages so they can be pip installed without embedding credentials into requirements files, and if you work for a large organisation there's a fair chance one might already exist. This is a pretty googlable topic so I won't reproduce the wealth of info, but it's worth looking into.