Firebase Functions Python build cannot reliably install private Artifact Registry packages
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 35/100
- Issue 類型
- 缺陷
- 描述清晰度
- 基本清楚
- 活躍度
- 停滯
- 技術堆疊
- google-cloud, python
- 領域
- build-system, cloud
研究方向
首先檢查指定 builder image 中列出的 google.python.pip buildpack，以及指令 python3 -m pip install --requirement requirements.txt。使用範例 requirements.txt 重現失敗，並驗證 Cloud Build 服務帳戶的權限。當 Firebase Functions 部署能夠在不進行 vendoring、不使用自訂管線或容器化的情況下安裝私有 Artifact Registry 套件時，即視為完成。
由索引模型根據 Issue 內容生成。
描述
Summary
Deploying Firebase Functions written in Python cannot reliably install private Python packages hosted in Google Artifact Registry using the documented authentication mechanism.
Although Artifact Registry supports authentication via the keyrings.google-artifactregistry-auth backend, the Firebase Functions build process installs dependencies in a single pip invocation. This creates a bootstrapping problem where the authentication backend must already be installed before pip attempts to resolve private dependencies.
As a result, private packages cannot be consumed out-of-the-box during function deployment causing deployment issues and ultimately meaning private packages cannot be consumed in firebase functions. Private Python packages are a common pattern for shared internal libraries, and the current limitation makes this workflow difficult.
Expected Behaviour
A Firebase Functions deployment should be able to install private Python packages hosted in Artifact Registry without requiring custom build pipelines, vendored wheels, or containerization.
For example, the following requirements.txt should work:
--extra-index-url https://<LOCATION>-python.pkg.dev/<PROJECT>/<REPO>/simple/
private-package==0.0.1
provided that:
- the Cloud Build service account has artifactregistry.reader
- the repository contains the package
Actual Behaviour
The Artifact Registry authentication mechanism requires the keyring backend to be present before pip attempts to fetch packages.
However pip resolves and downloads packages before installing their dependencies, meaning that adding the backend as a dependency does not help.
Example attempt:
--extra-index-url https://<LOCATION>-python.pkg.dev/<PROJECT>/<REPO>/simple/
keyring
keyrings.google-artifactregistry-auth
private-package==0.0.1
This still fails because pip attempts to resolve private-package before installing the keyring backend. This creates a bootstrap race condition
Why this is a Problem
The current behavior makes it effectively impossible to use private Artifact Registry Python packages with Firebase Functions without workarounds such as:
- vendoring wheels into the repository
- migrating to cloud run where the build process can be controlled
Environment Details
Builder image:
europe-west2-docker.pkg.dev/serverless-runtimes/google-22-full/builder/python:python_20260224_RC00_lightweight
Buildpacks used:
google.utils.archive-source
google.python.runtime
google.python.functions-framework
google.python.pip
google.utils.label-image
google.python.link-runtime
The pip step is executed as:
python3 -m pip install --requirement requirements.txt
Python runtime:
Python 3.13.12
Suggested Solutions
Option 1: Preinstall Artifact Registry authentication backend
Ensure the build environment includes:
keyring
keyrings.google-artifactregistry-auth
before the pip install step.
Option 2: Two-phase dependency install
Modify the Python buildpack to run:
pip install keyring keyrings.google-artifactregistry-auth
pip install -r requirements.txt
- 主要語言
- Python
- 星號
- 167
- 分支
- 36
- 平均合併
- 4 天 3 小時
- 30 天內合併 PR
- 1
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
firebase/firebase-functions-python 的其他 Issue
-
難度 1/5 1 小時以內 新手友好度 85/100
-
Add support for VPC direct connect可能已有人在做 @IzaakGough 於 105 天前認領。 未關閉feature-request
難度 4/5 3-5 天 新手友好度 48/100
firebase/firebase-functions-python#275 · 1 則留言 · 1 個 reaction ·
-
[Bug] stability_digest_payload_from_ce_payload fails with AttributeError: 'dict' object has no attribute 'split'可能重新可做 關聯的 PR 已關閉且未合併。 未關閉bug unable to reproduce
難度 3/5 1-2 天 新手友好度 55/100
firebase/firebase-functions-python#260 · 6 則留言 ·
-
feature-request
難度 5/5 一週以上 新手友好度 25/100
firebase/firebase-functions-python#249 · 2 則留言 ·
-
logging library doesn't support Exceptions可能已有人在做 @IzaakGough 於 128 天前認領。 未關閉feature-request
難度 4/5 3-5 天 新手友好度 52/100
firebase/firebase-functions-python#172 · 3 則留言 ·
查看 firebase/firebase-functions-python 的全部 Issue
相似的 Issue
-
Harmony OPeNDAP SubSetter (HOSS) Geographic LARC_CLOUD PREFIRE_SAT2_AUX-SAT R01 production
難度 2/5 1-3 小時 新手友好度 68/100
nasa/harmony-autotester#245 ·
-
feature
難度 2/5 1-3 小時 新手友好度 66/100
-
L: github:actions L: php:composer
難度 2/5 1-3 小時 新手友好度 88/100
dependabot/dependabot-core#16493 ·
維護者通常 1 天內回覆
-
難度 1/5 1 小時以內 新手友好度 92/100
DataTalksClub/machine-learning-zoomcamp#730 ·
維護者通常 2 天內回覆
-
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 4 天內回覆