Background
1 |
pip install git+ssh://git@bitbucket.org/esologic/sample_project.git |
1 2 |
pip install git+ssh://git@bitbucket.org/esologic/sample_project.git@master # on the master branch pip install git+ssh://git@bitbucket.org/esologic/sample_project.git@0.0.2 # on the version tag of 0.0.2 |
1 2 3 4 5 6 7 8 9 |
(venv) dev@ESO-3:/tmp$ pip install git+ssh://git@bitbucket.org/esologic/sample_project.git Collecting git+ssh://git@bitbucket.org/esologic/sample_project.git Cloning ssh://git@bitbucket.org/esologic/sample_project.git to ./pip-sjec1gbh-build git@bitbucket.org: Permission denied (publickey). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. Command "git clone -q ssh://git@bitbucket.org/esologic/sample_project.git /tmp/pip-sjec1gbh-build" failed with error code 128 in None |
Using private repo packages locally
Step 1: Make sure your repo CAN be installed as a python package
setup.py
file. Here are best the best set of docs I’ve found on how to make this file.setup.py
. This repo will also be the standard example for this post.sample_project
as an example, we can do this like so:
1 2 3 4 5 6 7 8 9 10 11 12 13 |
(venv) dev@ESO-3:/tmp$ pip install /mnt/c/Users/dev/Documents/misc_git/sample_project/ Processing /mnt/c/Users/dev/Documents/misc_git/sample_project Installing collected packages: sample-project Running setup.py install for sample-project ... done Successfully installed sample-project-1.0 (venv) dev@ESO-3:/tmp$ python Python 3.6.8 (default, Jan 14 2019, 11:02:34) [GCC 8.0.1 20180414 (experimental) [trunk revision 259383]] on linux Type "help", "copyright", "credits" or "license" for more information. >>> from sample_project import print_quote >>> print_quote() If they can get you asking the wrong questions, they don't have to worry about answers. >>> |
If your package behaves as expected when installed like this locally, you’re all set to push the changes to your bitbucket repo and continue with the rest of the guide.
Step 2: Create SSH keys and add them to bitbucket
dev@esologic.com
. Make sure whenever you see that, to substitute email address associated with your bitbucket account.~/.ssh
. If you don’t see both id_rsa
and id_rsa.pub
files in that directory, create them with:
1 |
ssh-keygen -m PEM -t rsa -C "dev@esologic.com" |
passphrase
blank.Windows steps to create ssh keys
1 2 3 4 |
$ ssh-keygen -m PEM -t rsa -C "dev@esologic.com" -E md5 $ cd C:\Users\dev\.ssh $ ssh-add id_rsa $ ssh -T git@bitbucket.org |
Step 3: Make sure your account can read from the private repo with your python package
Devon
account is an owner of the repo, it will be allowed to read from the repo. The account ci_bot
will also be able to read from the repo because it has read permissions.Step 4: Install the package from bitbucket
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
(venv) dev@ESO-3:/tmp$ pip install git+ssh://git@bitbucket.org/esologic/sample_project.git Collecting git+ssh://git@bitbucket.org/esologic/sample_project.git Cloning ssh://git@bitbucket.org/esologic/sample_project.git to ./pip-nkrqsxao-build setsockopt IPV6_TCLASS 8: Operation not permitted: Installing collected packages: sample-project Running setup.py install for sample-project ... done Successfully installed sample-project-1.0 (venv) dev@ESO-3:/tmp$ python Python 3.6.8 (default, Jan 14 2019, 11:02:34) [GCC 8.0.1 20180414 (experimental) [trunk revision 259383]] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import sample_project >>> sample_project.print_quote() If they can get you asking the wrong questions, they don't have to worry about answers. >>> |
Fantastic! Remember, your pip command git+ssh://git@bitbucket.org/esologic/sample_project.git
 will be different for your package. It will look something like this: git+ssh://git@bitbucket.org/{your username}/{your project}.git
.
Using private repo packages in circleci
Step 5: Create a “machine user” in bitbucket
sample_project
repo.Step 6: Create SSH keys and add them to your machine user’s account
On whatever you system you have been using so far, enter the following commands and remember to leave passphrase
blank.
1 2 |
mkdir ~/.ssh/ci_bot_keys ssh-keygen -m PEM -t rsa -C "ci_bot@example.com" -f ~/.ssh/ci_bot_keys/id_rsa |
Add the contents of ~/.ssh/ci_bot_keys/id_rsa.pub
to bitbucket while signed in as your machine user like we did in step 2.
Step 7: Try git+ssh
key insertion locally
(Note: you can skip this step, but if things don’t work when you add the step to your CI build start looking for errors here.)
GIT_SSH_COMMAND
you can select which SSH key gets used by pip when doing an ssh pull.
1 2 |
export SSH_AUTH_SOCK=none export GIT_SSH_COMMAND='ssh -i ~/.ssh/ci_bot_keys/id_rsa' |
Step 8: Set the $KEY
environment variable in circleci
~/.ssh/ci_bot_keys/id_rsa
) available to the circle build process.
1 |
(venv) dev@ESO-3:/tmp$ cat ~/.ssh/ci_bot_keys/id_rsa | tr "\n" "_" |
-----END RSA PRIVATE KEY-----_
in case your terminal doesn’t wrap correctly.sample_project
) in.crossbow
is the name of my project.Now that the variable is set, we need to change our circle config to use it.
Step 9: Add the step to your /.circleci/config.yml
file
You have to make sure that the export GIT_SSH_COMMAND
step happens in the same step as any pip
commands. Your full dependencies installation circle step may look something like this:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
- run: name: Install Dependencies command: | # Give us access to private repos export KEY_PATH=tmp_id_rsa echo -e "${KEY//_/\\n}" > $KEY_PATH chmod 600 $KEY_PATH export SSH_AUTH_SOCK=none export GIT_SSH_COMMAND='ssh -i $KEY_PATH' python3 -m venv venv . venv/bin/activate pip install -r ./requirements.txtts.txt |
Make sure you select a circle image that has a git version of 2.17.0 or later, or this step will fail without an explanation. I found that the python image of circleci/python:3.7-buster
worked when testing.
Thanks to
- http://redgreenrepeat.com/2018/05/25/specifying-different-ssh-key-for-git/