Registry / gcp / keyrings-google-artifactregistry-auth

keyrings-google-artifactregistry-auth

JSON →
library1.1.2pypypi✓ verified 49d ago

keyrings.google-artifactregistry-auth is a Python package that allows you to configure keyring to interact with Python repositories stored in Google Artifact Registry. The backend automatically searches for credentials from the environment and authenticates to Artifact Registry using Google Application Default Credentials or gcloud SDK credentials. The current version is 1.1.2.

gcpauth-securitydevops
pip install keyrings.google-artifactregistry-auth
Install & Compatibility
Where this runs
tested against v1.1.2 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.925 runs
installs and imports cleanly · install 0.0s · import 0.208s · 45MB
glibc
py 3.103.925 runs
installs and imports cleanly · install 4.3s · import 0.189s · 45MB
44MB installed
● package 44MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

GooglePythonAuth
import keyring # The backend is automatically discovered by `keyring` once installed. # You typically don't import from keyrings.gauth directly for runtime usage. # To verify installation: # assert 'keyrings.gauth.GooglePythonAuth' in [k.name for k in keyring.get_keyring().backends]
The backend registers itself with the `keyring` library; direct imports from `keyrings.gauth` are uncommon for end-user application logic. The backend's class name is `GooglePythonAuth` within the `keyrings.gauth` module.

The quickstart involves three main steps: authenticating your `gcloud` CLI (which the keyring backend uses), installing the `keyrings.google-artifactregistry-auth` package, and then configuring your Python tools (like `pip` or `twine`) to use your Artifact Registry repository. The backend automatically leverages your active `gcloud` credentials.

import os import subprocess # 1. Ensure gcloud CLI is authenticated # Option A: Login as an end user # print("Please run: gcloud auth login") # Option B: Login as a service account (recommended for CI/CD) # print("Please run: gcloud auth application-default login") # Or set GOOGLE_APPLICATION_CREDENTIALS env var # os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = '/path/to/key.json' # 2. Install the backend (if not already installed) # For this quickstart, assume it's installed as per 'install' section. # 3. Verify the backend is listed by keyring try: # Using subprocess to run keyring CLI, as direct Python API usage is complex for listing backends result = subprocess.run(['keyring', '--list-backends'], capture_output=True, text=True, check=True) if 'keyrings.gauth.GooglePythonAuth' in result.stdout: print("keyrings.google-artifactregistry-auth backend is successfully installed and recognized.") else: print("Warning: keyrings.google-artifactregistry-auth backend not found in keyring --list-backends output.") print("Output: ", result.stdout) except FileNotFoundError: print("Error: 'keyring' command not found. Please ensure `keyring` is installed and in your PATH.") except subprocess.CalledProcessError as e: print(f"Error running keyring --list-backends: {e.stderr}") # 4. Configure pip/twine to use Artifact Registry (example for pip.conf) # You would typically run 'gcloud artifacts print-settings python' and copy the output. # Example values (replace with your own): # project_id = os.environ.get('GCP_PROJECT_ID', 'your-gcp-project-id') # repository_id = os.environ.get('AR_REPOSITORY_ID', 'your-repo-id') # location = os.environ.get('GCP_REGION', 'us-central1') # # print(f"\nTo configure pip, run: ") # print(f"gcloud artifacts print-settings python --project={project_id} --repository={repository_id} --location={location}") # print("Then add the extra-index-url to your pip.conf or requirements.txt")
Debug
Known issues
breakingInstalling `keyring` version 23.9.0 caused `keyrings.google-artifactregistry-auth` to fail due to a missing `keyring.util.properties` module.
fix
Upgrade `keyrings.google-artifactregistry-auth` to a newer version that addresses this, or pin `keyring<=23.8.2` as a temporary workaround.
affects: keyring==23.9.0
breakingUsing `google-auth` version 2.41.1 with this keyring backend can lead to 'No credentials could be found' errors when fetching credentials from GCP Artifact Registry.
fix
Roll back `google-auth` to version 2.40.3 or earlier (`google-auth==2.40.3`).
affects: google-auth==2.41.1
gotchaMixing user credentials (`gcloud auth login`) and service account credentials (via `GOOGLE_APPLICATION_CREDENTIALS` or `gcloud auth application-default login`) simultaneously can cause authentication conflicts.
fix
Ensure only one primary authentication method is active. If encountering issues, try `gcloud auth revoke --all` to clear conflicting credentials.
affects: All versions
gotchaWhen building Docker images, passing sensitive information like `ARTIFACT_REGISTRY_TOKEN` via `--build-arg` is insecure as it remains in the image metadata.
fix
Use Docker's secret volume mounts (`--secret`) to securely pass credentials during the build process.
affects: All versions (Docker build practices)
gotchaOn Databricks runtimes greater than 10.4, the `GooglePythonAuth` keyring backend may not be correctly set up or recognized, even if the package is installed.
fix
Investigate Databricks-specific configuration or environment issues. It may require direct intervention to ensure the keyring backend is properly registered and accessible by the Python environment.
affects: Databricks Runtimes > 10.4
deprecatedA separate package, `keyrings.google-artifactregistry-auth-py2`, exists for Python 2 compatibility. The main `keyrings.google-artifactregistry-auth` package is for Python 3.
fix
Migrate to Python 3. If Python 2 is unavoidable, use `keyrings.google-artifactregistry-auth-py2` and be aware it might not receive the same level of updates or support.
affects: Python 2 projects
Errors
Common errors & fixes
error: can't find Rust compiler If you are using an outdated pip version, it is possible a prebuilt wheel is available for this package but pip is not able to install from it. Installing from the wheel would avoid the need for a Rust compiler. To update pip, run: pip install --upgrade pip and then retry package installation. If you did intend to build this package from source, try installing a Rust compiler from your system package manager and ensure it is on the PATH during installation. Alternatively, rustup (available at https://rustup.rs) is the recommended way to download and update the Rust compiler toolchain. This package requires Rust >=1.41.0.
An outdated `pip` version is trying to build the `cryptography` dependency from source instead of using a pre-built wheel, and the system lacks a Rust compiler.
fix
Upgrade `pip` to a recent version: `pip install -U pip`.
Artifact Registry PyPI Keyring: No credentials could be found. Failed to find credentials, Please run: `gcloud auth application-default login or export GOOGLE_APPLICATION_CREDENTIALS=<path/to/service/account/key>`
The `keyrings.google-artifactregistry-auth` backend could not locate valid Google Cloud credentials via Application Default Credentials (ADC) or the `gcloud` CLI.
fix
Authenticate using `gcloud auth application-default login` or set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to a service account key file path. Ensure the authenticated identity has necessary Artifact Registry permissions.
User for <artifact-registry-url>: (prompt for username/password by pip or twine)
The `keyrings.google-artifactregistry-auth` backend is installed but not correctly configured or activated, leading pip/twine to default to basic authentication prompts.
fix
Ensure `keyring` and `keyrings.google-artifactregistry-auth` are installed (`pip install keyring keyrings.google-artifactregistry-auth`) and verify the backend is active using `keyring --list-backends`. For Python 3.12+, explicitly verify the backend with `python -m keyrings.google_artifactregistry_auth`.
Keyring authentication to Artifact Repository not working (GCP)
The user might have configured conflicting authentication methods (e.g., `GOOGLE_APPLICATION_CREDENTIALS` and `gcloud auth login`), causing the keyring to use unintended or insufficient credentials.
fix
Consolidate to a single authentication method. If using a service account, rely on `GOOGLE_APPLICATION_CREDENTIALS`. If using user credentials, ensure only `gcloud auth application-default login` (or `gcloud auth login` for interactive use) is used, and revoke conflicting credentials if necessary (`gcloud auth revoke --all`).
Upgrade
Version history
1.1.2latest on PyPI
Audit
Dependencies
keyringrequiredThis package is a backend for the `keyring` library, which provides OS-level credential storage.
google-authrequiredUsed for authenticating with Google Cloud, often via Application Default Credentials or gcloud SDK.
Agent activity
74 hits · last 30 days
node
6
ahrefsbot
2
bytedance
1
seranking-bot
1
Resources