STAC-25553: drop the GitLab PyPI index from the agent build - #497
Merged
Conversation
The private index existed for exactly one package. tasks/omnibus.py names it: vsphere-automation-sdk==1.82.0, which VMware withdrew from public PyPI (the name is squatted there by an unrelated 0.0.1 placeholder), so it was mirrored into the GitLab Package Registry and resolved with a read-only credential. That package is gone. stackstate-agent-integrations moved vsphere onto the renamed public VMware packages -- pyvmomi, vmware-vcenter, vmware-vapi-runtime and vmware-vapi-common-client, all 9.1.0.0 -- under STAC-25544, and stackstate-deps.json already pins STACKSTATE_INTEGRATIONS_VERSION 7.78.2-5, which contains that change. The embedded agent_requirements.in it ships no longer mentions vsphere-automation-sdk, and its full transitive closure resolves from public PyPI alone. So the index is dead weight, and not harmless dead weight: pip-compile echoes an authenticated index URL into agent_requirements-py3.txt, which is baked into the published image. That is the shape of the 2026-04-23 credential leak, fixed by STAC-24642 by moving auth into ~/.netrc. Removing the index removes the class of failure rather than mitigating it again, and takes the last PyPI read credential in the estate with it. Removing the env block also leaves this job with no secret in scope at all. The setup script, the tasks/omnibus.py block and the local-development references are left for a follow-up commit once a build confirms the resolve. Refs STAC-25553, STAC-25360
The DEB build no longer configures the index, so everything that existed to
serve it is now unreferenced. Removing it in one pass rather than leaving a
credential-shaped hole for someone to wire back up.
tasks/omnibus.py loses the extra-index-url block. local.sh sourced the setup
script from two places -- the container env passthrough and the in-container
build path at line 199 -- and both go, along with the Makefile env passthrough
and .gitlab-scripts/setup_artifact_registry.sh itself.
Three of these were already broken and had been for some time, which is the
argument for deleting rather than updating them:
- Dockerfiles/local_builder/local_init.sh sourced
.gitlab-scripts/setup_artifactory.sh, a filename that exists nowhere in
this repository.
- Development.md told a new engineer to export artifactory_user and
artifactory_password, which setup_artifact_registry.sh never read -- it
required GITLAB_PACKAGE_REGISTRY_USER and _READONLY_PASSWORD. The
documented setup could not have worked as written.
- .assistance/Vagrantfile exported the same two variables nothing consumes.
omnibus/package-scripts/publish_image.sh had the URL as a dead assignment,
never referenced in its 37 lines. The script itself appears to be unused --
nothing invokes it, and the only remaining mention is a comment in
build-deb.yml explaining that the workflow inlined its docker build -- but
deleting it is a separate claim, so only the assignment goes here.
The --no-emit-{index-url,find-links} flags in the integrations recipe stay.
They were the fix for the 2026-04-23 credential leak (STAC-24642) and cost
nothing; only the comment changes, since it cited the deleted script.
Refs STAC-25553, STAC-25360
LouisParkin
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The private index existed for exactly one package.
tasks/omnibus.pynamed it:vsphere-automation-sdk==1.82.0, which VMware withdrew from public PyPI.stackstate-agent-integrationsmoved vsphere onto the renamed public VMware packages under STAC-25544, andstackstate-deps.jsonalready pins integrations7.78.2-5, which contains that change — so nothing needs the index any more. Removing it also leaves the build job with no secret in scope.The second commit removes the plumbing that served it. Three of those paths were already broken, which is why they are deleted rather than updated:
local_init.shsourced.gitlab-scripts/setup_artifactory.sh, a filename that exists nowhere in this repo, andDevelopment.md/.assistance/Vagrantfileexportedartifactory_user/artifactory_password, which the setup script never read.Jira: https://stackstate.atlassian.net/browse/STAC-25553