STAC-25553: drop the GitLab PyPI index from the agent build

.assistance/Vagrantfile

@@ -45,9 +45,6 @@ Vagrant.configure("2") do |config|
     echo "export GOLANG_VERSION=1.14" >> /home/vagrant/.env
     echo "export RVM_VERSION=1.29.12" >> /home/vagrant/.env
     echo "export RUBY_VERSION=2.4.2" >> /home/vagrant/.env
-    echo "export artifactory_user=$artifactory_user" >> /home/vagrant/.env
-    echo "export artifactory_password=$artifactory_password" >> /home/vagrant/.env
-    echo "export GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL=gitlab.com/api/v4/projects/71271774/packages/pypi/simple" >> /home/vagrant/.env
     echo "export HOST_DIR=/home/vagrant/stackstate-agent-host" >> /home/vagrant/.env
     echo "export CI_PROJECT_DIR=/home/vagrant/stackstate-agent" >> /home/vagrant/.env
     echo "export C_MAKE_SETUP_PATH=~/cmake" >> /home/vagrant/.env

.github/workflows/build-deb.yml

@@ -112,10 +112,6 @@ jobs:
             bazel-${{ matrix.arch }}-
 
       - name: Build DEB package with omnibus
-        env:
-          GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL: ${{ vars.GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL }}
-          GITLAB_PACKAGE_REGISTRY_USER: ${{ secrets.GITLAB_PACKAGE_REGISTRY_USER }}
-          GITLAB_PACKAGE_REGISTRY_READONLY_PASSWORD: ${{ secrets.GITLAB_PACKAGE_REGISTRY_READONLY_PASSWORD }}
         run: |
           set -eo pipefail
           export PATH="$PATH:/usr/local/go/bin"
@@ -173,10 +169,6 @@ jobs:
           inv agent.version -u > version.txt
           cat version.txt
 
-          # Writes pip.conf + ~/.netrc for the private Python index. Hard-exits if
-          # the GITLAB_PACKAGE_REGISTRY_* variables above are unset.
-          source ./.gitlab-scripts/setup_artifact_registry.sh
-
           export LD_LIBRARY_PATH="/opt/stackstate-agent/embedded/lib/python3.12/site-packages/psycopg2_binary.libs:/opt/stackstate-agent/embedded/lib"
 
           # --install-directory pins the omnibus paths to the BRANDED install dir.

Development.md

@@ -14,16 +14,6 @@ $ export CI_PROJECT_DIR=/go/src/github.com/StackVista/stackstate-agent && \
 
 Remember to `git pull` every time you push a change.
 
-### Configure Artifactory
-
-We use some private python libraries for our integrations therefore you need to configure artifactory as pypi repository:
-```bash
-$ export GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL=gitlab.com/api/v4/projects/71271774/packages/pypi/simple && \
-  export artifactory_user=... && \
-  export artifactory_password=... && \
-  source ./.gitlab-scripts/setup_artifact_registry.sh
-```
-
 ### Build using Python3 interpreter
 ```bash
 $ conda activate ddpy3 && \

Dockerfiles/local_builder/local_init.sh

@@ -35,7 +35,6 @@ if [[ ! -z "${AGENT_SOURCE_MOUNT}" ]]; then
 fi
 
 cd ${PROJECT_DIR}
-source .gitlab-scripts/setup_artifactory.sh
 
 # List of rtloader commands
 COMMAND__RTLOADER_CLEAN="inv rtloader.clean"

Makefile

@@ -19,9 +19,6 @@ LOCAL_BUILDER_INIT = Dockerfiles/local_builder/local_init.sh
 # Set this parameter to 'dit' to use the make command in your IDE, You can then execute shell commands allowing the container to run in detached mode
 DOCKER_RUN_MODE   ?= it
 DOCKER_ENV		   = --env PROJECT_DIR=${PROJECT_DIR} \
-                     --env GITLAB_PACKAGE_REGISTRY_USER=${GITLAB_PACKAGE_REGISTRY_USER} \
-                     --env GITLAB_PACKAGE_REGISTRY_TOKEN=${GITLAB_PACKAGE_REGISTRY_TOKEN} \
-                     --env GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL="gitlab.com/api/v4/projects/71271774/packages/pypi/simple" \
                      --env PYTHON_RUNTIME=${PYTHON_RUNTIME}
 
 

local.sh

@@ -50,9 +50,6 @@ if [ "${WHAT}" = "SHELL" ]; then
         -e MAJOR_VERSION="3" \
         -e USER_ID="$(id -u)" -e GROUP_ID="$(id -g)" \
         -e CI_PROJECT_DIR=${PWD} \
-        -e GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL="${GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL}" \
-        -e GITLAB_PACKAGE_REGISTRY_USER="${GITLAB_PACKAGE_REGISTRY_USER}" \
-        -e GITLAB_PACKAGE_REGISTRY_TOKEN="${GITLAB_PACKAGE_REGISTRY_TOKEN}" \
         -e BRANDED=${BRANDED} \
         -e REGISTRY="${REGISTRY}" \
         -e ORG="${ORG:-stackstate}" \
@@ -199,7 +196,6 @@ if [ "${WHAT}" = "ALL" ] || [ "${WHAT}" = "BUILD_DEB" ] || [ "${WHAT}" = "UP_TO_
     mv "$SRC_PATH"/.omnibus /omnibus || mkdir -p /omnibus
     inv agent.version
     cat version.txt || true
-    source setup_artifact_registry.sh
     export OMNIBUS_BASE_DIR="/.omnibus"
     inv -e omnibus.build --gem-path $SRC_PATH/.gems --base-dir $OMNIBUS_BASE_DIR --go-mod-cache $SRC_PATH/vendor --skip-deps --skip-sign
 

omnibus/config/software/stackstate-agent-integrations-py3.rb

@@ -175,11 +175,9 @@
     # Use pip-compile to create the final requirements file. Notice when we invoke `pip` through `python -m pip <...>`,
     # there's no need to refer to `pip`, the interpreter will pick the right script.
     # --no-emit-{index-url,find-links}: defence in depth so the resolved
-    # requirements file does not echo any auth-bearing URL from pip.conf
-    # back into the image. Source-side fix is in tasks/agent.py and
-    # .gitlab-scripts/setup_artifactory.sh (STAC-24642); these flags
-    # prevent future regressions reaching the image even if a pip.conf
-    # with credentials-in-URL is reintroduced upstream.
+    # requirements file does not echo any auth-bearing URL from pip.conf back
+    # into the image (STAC-24642). No authenticated index is configured any more
+    # (STAC-25553), so these flags now only guard against one being reintroduced.
     if windows?
       command "#{python} -m pip install --no-deps  #{windows_safe_path(project_dir)}\\stackstate_checks_base"
 

omnibus/package-scripts/publish_image.sh

@@ -8,7 +8,6 @@ DOCKERFILE_PATH="${3}"
 EXTRA_TAG="${4}-${ARCH}"
 REGISTRY="quay.io"
 ORGANIZATION="stackstate"
-GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL="https://gitlab.com/api/v4/projects/71271774/packages/pypi/simple"
 S6_ARCH="${5}"
 
 echo "IMAGE_TAG=${IMAGE_TAG}"

tasks/omnibus.py

@@ -261,19 +261,6 @@ def build(
     # If a python_mirror is set then use it for pip by adding it in the pip.conf file
     pip_index_url = f"[global]\nindex-url = {python_mirror}" if python_mirror else ""
 
-    # [sts] Add private GitLab PyPI registry as extra-index-url if credentials are available.
-    # Credentials are not included in the URL here, they are expected to be in ~/.netrc (see
-    # .gitlab-scripts/setup_artifact_registry.sh). Without this block, the omnibus-managed
-    # pip.conf is empty, pip only queries PyPI default, and STS-only packages like
-    # vsphere-automation-sdk==1.82.0 fail with "Could not find a version that satisfies".
-    artifact_registry_pypi_url = os.environ.get("GITLAB_PACKAGE_REGISTRY_PYPI_SIMPLE_URL")
-    if artifact_registry_pypi_url:
-        python_extra_mirror = f"https://{artifact_registry_pypi_url}"
-        if pip_index_url:
-            pip_index_url += f"\nextra-index-url = {python_extra_mirror}"
-        else:
-            pip_index_url = f"[global]\nextra-index-url = {python_extra_mirror}"
-
     # We're passing the --index-url arg through a pip.conf file so that omnibus doesn't leak the token
     with open(pip_config_file, 'w') as f:
         f.write(pip_index_url)