Skip to content

Redo pypi token encryption for travis ci deployment - #1100

Merged
k8s-ci-robot merged 1 commit into
kubernetes-client:masterfrom
roycaihw:redo-pypi-token
Mar 9, 2020
Merged

Redo pypi token encryption for travis ci deployment#1100
k8s-ci-robot merged 1 commit into
kubernetes-client:masterfrom
roycaihw:redo-pypi-token

Conversation

@roycaihw

@roycaihw roycaihw commented Mar 9, 2020

Copy link
Copy Markdown
Member

The pypi deployment was failing with

Uploading distributions to https://upload.pypi.org/legacy/
Uploading kubernetes-11.0.0_snapshot-py2-none-any.whl
100%|##########| 1.46M/1.46M [00:00<00:00, 3.70MB/s]
NOTE: Try --verbose to see response content.
HTTPError: 403 Client Error: Invalid or non-existent authentication information. See https://pypi.org/help/#invalid-auth for details for url: https://upload.pypi.org/legacy/
...
PyPI upload failed.
failed to deploy

even though it reported Authenticated as kubernetes in an earlier step. I couldn't find a way to enable --verbose through travis.

I issued a new pypi api token and re-encrypted it as a travis token. I also added some minor changes. Let's see if they help this time.

/cc @fabianvf @palnabarun

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 9, 2020
@k8s-ci-robot

k8s-ci-robot commented Mar 9, 2020

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: roycaihw

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 9, 2020
@micw523

micw523 commented Mar 9, 2020

Copy link
Copy Markdown
Contributor

It does not seem like the deploy stage is run.
I have two questions:

  • Will the deploy stage run on any pull request, saying, is it possible that unverified code will run its way to PyPI release without going through the PR process, and got released to PyPI?
  • Since the token is visible, is it possible for someone to copy the token and do an HTTP request to upload a dummy/malicious release to PyPI to hijack the package?

@roycaihw

roycaihw commented Mar 9, 2020

Copy link
Copy Markdown
Member Author

Will the deploy stage run on any pull request

The deployment is triggered on tag. I think tagging requires write access to this repo and cannot be achieved with a PR.

Since the token is visible, is it possible for someone to copy the token

The pypi API token is encrypted through travis encrypt your-api-token --add deploy.password and can only be used by travis ci. See https://docs.travis-ci.com/user/deployment/pypi for more details.

@micw523

micw523 commented Mar 9, 2020

Copy link
Copy Markdown
Contributor

/lgtm
This sounds good to me!

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 9, 2020
@k8s-ci-robot
k8s-ci-robot merged commit 6b560a4 into kubernetes-client:master Mar 9, 2020
@roycaihw
roycaihw deleted the redo-pypi-token branch March 9, 2020 22:45
@roycaihw

roycaihw commented Mar 9, 2020

Copy link
Copy Markdown
Member Author

Tested again with tag v0.0.0-travis-experiment2. The server complained about the semver this time. Hopefully this means we've made through the authentication :)

HTTPError: 400 Client Error: '11.0.0-snapshot' is an invalid value for Version. Error: Start and end with a letter or numeral containing only ASCII numeric and '.', '_' and '-'. See https://packaging.python.org/specifications/core-metadata for url: https://upload.pypi.org/legacy/

I'm going to create an experimental branch to test with a real semver generated (v0.0.0a1)

@roycaihw

roycaihw commented Mar 10, 2020

Copy link
Copy Markdown
Member Author

I experimented in this branch. v0.0.0a2 was deployed to pypi successfully in this job. The py34 job failed because some installation requires py35+. The remaining jobs in the build skipped pypi deploy because v0.0.0a2 existed already

@palnabarun

palnabarun commented Mar 10, 2020

Copy link
Copy Markdown
Member

I have tested the package by running https://github.com/kubernetes-client/python/blob/master/examples/out_of_cluster_config.py against Python 2.7, 3.4, 3.5, 3.6, 3.7 and 3.8.

The build failure on Py3.4 will be handled when I push the multi stage build pipeline.

@fabianvf

fabianvf commented Mar 10, 2020

Copy link
Copy Markdown
Contributor

For further improvements it may make sense to move the deploy step into a separate stage, so that it will only run if all prior tests pass. We could also add an early validation stage that will fail out if a non-semver tag is set, to catch a malformed tag

This was referenced Mar 12, 2020
Merged
Merged
k8s-ci-robot added a commit that referenced this pull request Mar 12, 2020
@k8s-ci-robot
Merge pull request #1109 from palnabarun/automated-cherry-pick-of-#1099-
973911e 
#1100-#1101-#1102-upstream-release-10.0

Automated cherry pick of #1099 #1100 #1101 #1102
k8s-ci-robot added a commit that referenced this pull request Mar 12, 2020
@k8s-ci-robot
Merge pull request #1108 from palnabarun/automated-cherry-pick-of-#1099-
6b268fb 
#1100-#1101-#1102-upstream-release-11.0

Automated cherry pick of #1099 #1100 #1101 #1102
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fabianvf fabianvf Awaiting requested review from fabianvf
@palnabarun palnabarun Awaiting requested review from palnabarun

Assignees

See More

@micw523 micw523

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@roycaihw @k8s-ci-robot @micw523 @palnabarun @fabianvf