PyPI Integration

PIP resolves Python packages using the package index configured in pip.conf, pip.ini, or the --index-url command-line option. To route PIP traffic through the Lineaje Proxy, configure PIP to use the Proxy’s PyPI endpoint and authenticate with your Lineaje username and Personal Access Token (PAT).

---

Getting Started

1

Create a Lineaje Personal Access Token (PAT)

Follow the below instructions.

Authentication

2

Store the Lineaje PAT in a secure location

For example, add your SBOM360 email and Lineaje PAT as an environmental variable:

export ARTIFACTORY_CREDS_USR="[e-mail]"
export ARTIFACTORY_CREDS_PSW="by9...dPQ=="

For CICD pipelines, like GitHub Actions, this token can be stored as a repository-level secret or an organization-level secret. A sample GitHub Action is added below for your reference.

3

Configure pip.conf

Create or update this file:

~/.config/pip/pip.conf

Add the following configuration:

[global]
index-url = https://<ARTIFACTORY_CREDS_USR>:<ARTIFACTORY_CREDS_PSW>@observe.fortknox.v2.prod.veedna.com/artifactory/api/pypi/gos-all-proxy-python/simple
trusted-host = observe.fortknox.v2.prod.veedna.com

You can choose between observe mode or enforce mode. More details are here:

Modes of Operation

Never commit a pip.conf, pip.ini, or script that contains a real token or password.

4

Install Python packages

Now PIP is configured to connect with Lineaje GOS Artifactory and download secure Python packages through the Lineaje Proxy.

pip install -r requirements.txt

5

Alternative: Pass the Proxy URL Directly

Instead of configuring pip.conf, you can pass the Proxy URL directly using --index-url.

pip install urllib3==2.0.5 \
  --index-url https://<ARTIFACTORY_CREDS_USR>:<ARTIFACTORY_CREDS_PSW>@observe.fortknox.v2.prod.veedna.com/artifactory/api/pypi/gos-all-proxy-python/simple \
  -vvv

The -vvv flag enables verbose logging and helps confirm that packages are being resolved through the Lineaje Proxy.

Sample Configurations

GitHub Actions

This guide explains how to configure a GitHub Actions workflow to install Python dependencies from Lineaje GOS Artifactory and run unit tests.

1. Create GitHub Secrets

Create repository-level or organization-level secrets to store the Lineaje credentials.

1. Open your GitHub repository.

2. Go to Settings.

3. Open Secrets and variables.

4. Select Actions.

5. Click New repository secret.

6. Create the following secret:

ARTIFACTORY_CREDS_USR

Set the value to your SBOM360 email.

1. Create another secret:

ARTIFACTORY_CREDS_PSW

Set the value to your Lineaje PAT.

2. Add the GitHub Actions Workflow

1. Create the following workflow file in your repository:

.github/workflows/python-tests-gos-artifactory.yml

1. Add the below content:

name: Python Run Tests with GOS Artifactory

on:
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      mode:
        description: "FortKnox mode"
        required: false
        default: "observe"
        type: choice
        options:
          - observe
          - enforce

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set FortKnox mode
        run: |
          MODE="${{ github.event.inputs.mode || 'observe' }}"
          echo "FORTKNOX_MODE=$MODE" >> "$GITHUB_ENV"
          echo "Using FortKnox mode: $MODE"

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Configure pip
        env:
          ARTIFACTORY_CREDS_USR: ${{ secrets.ARTIFACTORY_CREDS_USR }}
          ARTIFACTORY_CREDS_PSW: ${{ secrets.ARTIFACTORY_CREDS_PSW }}
        run: |
          mkdir -p ~/.config/pip
          cat > ~/.config/pip/pip.conf <<EOF
          [global]
          index-url = https://${ARTIFACTORY_CREDS_USR}:${ARTIFACTORY_CREDS_PSW}@${FORTKNOX_MODE}.fortknox.v2.prod.veedna.com/artifactory/api/pypi/gos-all-proxy-python/simple
          trusted-host = ${FORTKNOX_MODE}.fortknox.v2.prod.veedna.com
          EOF

      - name: Install dependencies
        run: pip install -r requirements.txt -vvv

      - name: Run tests
        run: python -m pytest

Jenkins

This guide explains how to configure Jenkins to install Python dependencies using FortKnox Artifactory as the Python package index.

1. Configure Python in Jenkins

1. Ensure Python is available on the Jenkins agent.

2. Validate Python and PIP by running:

python3 --version
pip3 --version

1. If Python is not installed, install the required Python version or configure the Jenkins agent image to include Python and PIP.

2. Add Artifactory Credentials in Jenkins

1. Go to Manage Jenkins.

2. Open Credentials.

3. Select the appropriate credentials scope, usually:

Jenkins → Global credentials

1. Click Add Credentials.

2. Select credential type:

Username with password

1. Enter your SBOM360 email as the username and the Lineaje PAT as the password.

2. Set the credential ID, for example:

fortknox-artifactory-creds

1. Save the credential.

This credential ID will be used in the Jenkinsfile:

ARTIFACTORY_CREDS = credentials('fortknox-artifactory-creds')

3. Add the Jenkinsfile

1. Add the following Jenkinsfile to the root of the repository.

2. Replace the credential ID if needed.

pipeline {
    agent any

    parameters {
        choice(
            name: 'FORTKNOX_MODE',
            choices: ['observe', 'enforce'],
            description: 'FortKnox mode'
        )
    }

    environment {
        // Jenkins credential should be "Username with password"
        // Username should contain the SBOM360 email
        // Password should contain the Lineaje PAT
        ARTIFACTORY_CREDS = credentials('fortknox-artifactory-creds')
    }

    stages {
        stage('Build') {
            steps {
                script {
                    withEnv([
                        "PIP_INDEX_URL=https://${ARTIFACTORY_CREDS_USR}:${ARTIFACTORY_CREDS_PSW}@${params.FORTKNOX_MODE}.fortknox.v2.prod.veedna.com/artifactory/api/pypi/gos-all-proxy-python/simple",
                        "PIP_TRUSTED_HOST=${params.FORTKNOX_MODE}.fortknox.v2.prod.veedna.com"
                    ]) {
                        sh 'python3 --version'
                        sh 'pip3 --version'

                        sh 'pip3 install -r requirements.txt -vvv'

                        // Optional: run unit tests
                        sh 'python3 -m pytest'
                    }
                }
            }
        }
    }
}

4. Validate the Jenkins Pipeline

1. Open the Jenkins job.

2. Run Build with Parameters.

3. Select the FortKnox mode:

   1. observe

   2. enforce

4. Start the build.

5. Confirm that the pipeline completes the following steps:

   1. Prints the Python version.

   2. Prints the PIP version.

   3. Installs dependencies from Lineaje GOS Artifactory.

   4. Runs unit tests.

---

Verifying Proxy Routing

Use verbose mode to confirm that PIP is resolving packages through the Lineaje Proxy.

pip install urllib3==2.0.5 -vvv

In the logs, confirm that the Proxy URL appears.

Expected example:

Looking in indexes: https://<user>:****@observe.fortknox.v2.prod.veedna.com/artifactory/api/pypi/gos-all-proxy-python/simple

You may also see package download URLs similar to:

https://observe.fortknox.v2.prod.veedna.com/artifactory/api/pypi/gos-all-proxy-python/packages/...

To detect policy violations, search the build logs for the relevant Lineaje policy violation message. To learn more, see Detecting Policy Violations in Build Logs.