PyPI Repositories

The Python Package Index, or PyPI, is a vast repository of open-source Python packages supplied by the worldwide community of Python developers. The official index is available at https://pypi.org, and the site itself is maintained by the Python Software Foundation.

Both Nexus Repository Manager Pro and Nexus Repository Manager OSS support proxying the Python Package Index. This allows the repository manager to take advantage of the packages in the official Python Package Index without incurring repeated downloads. This will reduce time and bandwidth usage for accessing Python packages.

Also, you can publish your packages to a private index as a hosted repository on the repository manager, then expose the remote and private repositories as a repository group, which is a repository that merges and exposes the contents of multiple repositories in one convenient URL.

You can set up a PyPI proxy repository to access a remote package index. To proxy a PyPI package index, you simply create a new PyPI (proxy) recipe.

Minimal configuration steps are:

The repository manager can access Python packages and tools from the remote index. The proxy repository for PyPI packages provides a cache of files available on the index making access to components from the Python Package Index more reliable. Users will be able to browse and search assets against the remote, as mentioned in Browsing PyPI Repositories and Searching Packages.

Creating a PyPI-hosted repository allows you to upload packages in the repository manager. The hosted repository acts as an authoritative location for packages fetched from the Python index.

To host a PyPI package, create a new PyPI (hosted) recipe.

Minimal configuration steps are:

A repository group is the recommended way to expose all your PyPI repositories from the repository manager to your users, with minimal additional client-side configuration. A repository group allows you to expose the aggregated content of multiple proxies and hosted repositories as well as other repository groups with one URL in the tool configuration. PyPI group repositories can be created with the PyPI (group) recipe.

Minimal configuration steps are:

The latest versions of such Linux distributions as CentOS and Ubuntu come packaged with Python and pip, a tool for installing and managing Python packages from the index. For Mac OS X and Microsoft Windows, download and install a Python version compatible with the repository manager from https://www.python.org/downloads/. This should come automatically with pip but you can see https://pip.pypa.io/en/stable/installation/if not.

Once you have installed all necessary client tools from the Python Package Index, you can create and configure a .pypirc file to reference packages stored in the repository manager. Depending on your Python configuration you can manage your repository groups with pip.conf (or setup.cfg) to have all commands, such as search and install, run against your project.

[distutils]
index-servers =
pypi
[pypi]
repository: http://localhost:8081/repository/pypi-internal/
username: admin
password: admin123

[global]
# pip search --index (XML-RPC search) 
# https://pip.pypa.io/en/stable/cli/pip_search/
index = http://localhost:8081/repository/pypi-all/pypi

# pip install --index-url 
# https://pip.pypa.io/en/stable/cli/pip_install/
index-url = http://localhost:8081/repository/pypi-all/simple

[easy_install]
index-url = http://localhost:8081/repository/pypi-proxy/simple

You can proxy Python packages over HTTPS to ensure a secure connection with a self-signed certificate. This works for proxy, hosted, and group repositories. To set up the repository manager to serve HTTPS follow the configuration steps in Configuring SSL.

Also, you can set up pip to use the certificate to enable SSL and fetch packages securely. Additional configuration is necessary for the HTTPS client implementation to work. This assumes the repository manager has already been set up to use SSL, so verify your certificate works. Run the following command:

openssl verify <example-cerfificate>

When your certificate is proven to work, update your pip.conf. Here is an example configuration file for a repository group:

[global]
index = https://localhost:8443/repository/pypi-all/pypi
index-url = https://localhost:8443/repository/pypi-all/simple
cert = nexus.pem

You can browse PyPI repositories in the user interface inspecting the components and assets and their details, as described in Browsing Repositories and Repository Groups.

Searching for PyPI packages can be performed in the user interface, as described in Searching for Components. It finds all packages that are currently stored in the repository manager, either because they have been pushed to a hosted repository or they have been proxied from an upstream repository and cached in the repository manager.

From the command line, you can search available PyPI packages defined in your configuration. This method is limited to pip (pip.conf).

To search, run:

pip search example-package

After you configure your .pypirc you can upload packages from the index to the repository manager.

In the example below, twine is invoked to tell your repository what server to use when uploading a package. The -r flag is used to find the NXRM server in your .pypirc.

twine upload -r pypi <filename>

When a user requests a PyPI package without explicitly specifying a version,the PyPI client relies on the package metadata to select a version that satisfies the version constraints. If the selected version has policy violations and is quarantined by the Sonatype Repository Firewall, it will cause a build failure that requires a manual fix of the root cause.

By enabling this option, the Sonatype Repository Firewall will remove quarantined versions from the PyPI package metadata to prevent you from selecting a version with policy violations.

Two settings are needed to enable this behavior: