Metadata-Version: 2.4
Name: keyrings.gar-proxy-auth
Version: 2.0.1
Summary: Keyring backend for Google Auth tokens
Home-page: https://github.com/krb70/artifact-registry-python-tools
Author: Kendall Bailey
Author-email: krbailey@gmail.com
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Requires-Python: >=3.6
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: keyring
Requires-Dist: google-auth
Requires-Dist: pluggy
Provides-Extra: tox
Requires-Dist: tox; extra == "tox"
Provides-Extra: testing
Requires-Dist: pytest!=3.7.3,>=3.5; extra == "testing"
Requires-Dist: pytest-checkdocs>=1.2.3; extra == "testing"
Requires-Dist: pytest-flake8; extra == "testing"
Requires-Dist: pytest-black>=0.3.7; platform_python_implementation != "PyPy" and extra == "testing"
Requires-Dist: pytest-cov; extra == "testing"
Requires-Dist: pytest-mypy; platform_python_implementation != "PyPy" and extra == "testing"
Dynamic: license-file

# Artifact Registry tools for Python
This repository contains an alternate [keyring](https://pypi.python.org/pypi/keyring) backend implementation to help with interacting with Python repositories hosted on Artifact Registry.

Note: This version is identical to the official keyrings.google-artifactregistry-auth package except you may set which
domain to validate against. The default is the usual .pkg.dev but if you run a proxy in front of GAR, then you can set
environment variable GAR_PROXY_DOMAIN and this plugin will provide tokens when uv/pip are using that proxy domain.

Why would you want to run a GAR proxy? GAR is poor at dependency confusion defense and provides no facilities for
dependency cooldown. This keyring backend is motivated by the need to enhance GAR's security by putting a security
concious proxy in front of it. The proxy authorizes requests by passing credential straight through to GAR, so there's
no need for the proxy to have it's own auth layer.

## Authentication
`keyrings.gar-proxy-auth` is a Python package which allows you to configure keyring to interact with Python repositories stored in Artifact Registry.

The backend automatically searches for credentials from the environment and authenticates to Artifact Registry. It looks for credentials in the following order:

1. [Google Application Default Credentials](https://developers.google.com/accounts/docs/application-default-credentials).
2. From the `gcloud` SDK. (i.e., the access token printed via `gcloud config config-helper --format='value(credential.access_token)'`)
    * Hint: You can see which account is active with the command `gcloud config config-helper --format='value(configuration.properties.core.account)'`
3. If neither of them exist, an error occurs.

To use the keyring backend:

1. Log in

    Option 1: log in as a service account:

    (1). Using a JSON file that contains a service account key:

    ```
    $ export GOOGLE_APPLICATION_CREDENTIALS=[path/to/key.json]
    ```

    (2). Or using `gcloud`:

    ```
    $ gcloud auth application-default login
    ```

    Option 2: log in as an end user via `gcloud`:

    ```
    $ gcloud auth login
    ```

2. Configure twine (`.pypirc`) and pip (`pip.conf`) tools to connect to the repository. Use the output from the following command:

        $ gcloud artifacts print-settings python

    In your `.pypirc` file add:

    ```ini
    [disutils]
    index-servers =
        REPOSITORY_ID

    [REPOSITORY_ID]
    repository = https://LOCATION-python.pkg.dev/PROJECT_ID/REPOSITORY_ID/
    ```

    In your `pip.conf` file add:

    ```ini
    [global]
    index-url = https://LOCATION-python.pkg.dev/PROJECT_ID/REPOSITORY_ID/simple/
    ```
3. Install the `keyrings.gar-proxy-auth` package

    ```
    $ pip install keyrings.gar-proxy-auth
    ```

    List backends to confirm the installation.

    ```
    $ keyring --list-backends
    ```

    The list should include

    * `keyrings.gpauth.GooglePythonAuth (priority: 9)`
    * `keyring.backends.chainer.ChainerBackend (priority: -1)`
    * `keyring.backends.fail.Keyring (priority: 0)`

## Usage with other tools

### Usage with `tox`

The [`tox` tool](https://pypi.org/project/tox/) is a testing and automation tool.

Because the credential helper needs to be installed _before_ any private
dependencies are installed, it needs to be bootstrapped into the `tox`
environment via a plugin.

To do this, specify the `keyrings.gar-proxy-auth` package via the
[`requires`](https://tox.readthedocs.io/en/latest/config.html#conf-requires)
requirement in your `tox.ini` file:

```ini
[tox]
envlist = py
requires = keyrings.gar-proxy-auth

[testenv]
deps = -r requirements.txt
```

You can then configure your `requirement.txt` file to use the Artifact Registry repo as 
the index:

```
--index-url https://[REGION]-python.pkg.dev/[PROJECT_ID]/[REPOSITORY]/simple

# mypackage will be installed from the Artifact Registry repository
mypackage
```
