From 3adfe9b59473261fd2fa9cd4e5d9ab469531cb9f Mon Sep 17 00:00:00 2001 From: s-stumbo Date: Mon, 8 Jun 2026 12:44:00 -0400 Subject: [PATCH 1/2] Mention r2 migration and URL normalization on Python global config Signed-off-by: s-stumbo --- .../libraries/python/global-configuration.md | 61 +++++++++++-------- 1 file changed, 35 insertions(+), 26 deletions(-) diff --git a/content/chainguard/libraries/python/global-configuration.md b/content/chainguard/libraries/python/global-configuration.md index d49a8b3cf7..73805c40c1 100644 --- a/content/chainguard/libraries/python/global-configuration.md +++ b/content/chainguard/libraries/python/global-configuration.md @@ -51,6 +51,15 @@ approach. Refer to the [direct access documentation for build tools](/chainguard/libraries/python/build-configuration/#direct-access) for more information. +### Upcoming infrastructure migration + +Chainguard is migrating Python Libraries serving from `/python/files/...` paths to new R2-backed `/python/simple/...` paths. To avoid breaking existing environments, this migration is being rolled out with a 60-day transition window from June 10, 2026 through August 9, 2026. During this window, both path styles are served. + +- Ensure your firewall allows HTTPS access to `9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com`. +- If you use lockfiles that retain artifact URLs, such as with `pip` hash pinning or `uv`, plan to refresh those lockfiles during the migration window so they resolve to the new paths before August 9, 2026. +- If you manage Python package access through a repository manager, review your configuration and validate package retrieval in a staging environment before the end of the migration window. + + ### Considerations for fallback approach Before configuring your repo manager, consider how you want to handle packages that aren't @@ -164,26 +173,26 @@ Before configuring the repositories, you must create a secret with the [password value as retrieved with chainctl](/chainguard/libraries/access/): 1. Navigate to the **Secret Manager** -1. Press **Create secret**. +1. Click **Create secret**. 1. Set the **Name** to *chainguard-libraries-python*. 1. Use the **Password** from chainctl output to set the **Secret value**. -1. Press **Create secret**. +1. Click **Create secret**. Navigate to Artifact Registry and select **Repositories** in the left hand navigation under the **Artifact Registry** label to configure a remote repository for the Pypi Package Index: -1. Press **Create a Repository** or the **+** button. +1. Click **Create a Repository** or the **+** button. 1. Set the **Name** to *python-public*. 1. Set the **Format** to *Python*. 1. Select *Remote* for the **Mode**. 1. Select *PyPi* for the **Remote repository source**. 1. Choose a suitable **Region** for your development in **Location type**. -1. Press **Create**. +1. Click **Create**. Configure a remote repository for the Chainguard Libraries for Python repository: -1. Press the **+** button to add another repository. +1. Click **+** to add another repository. 1. Set the **Name** to *python-chainguard*. 1. Set the **Format** to *Python*. 1. Select *Remote* for the **Mode**. @@ -195,26 +204,26 @@ Configure a remote repository for the Chainguard Libraries for Python repository 1. Select the *chainguard-libraries-python* secret in the list for the **Secret** input. 1. Choose the same suitable **Region** for your development in **Location type** as configured for the *python-public* repository. -1. Press **Create**. +1. Click **Create**. Combine the two repositories in a new virtual repository: -1. Press the **+** button to add another repository. -1. Set the **Name** to *python-all*. -1. Set the **Format** to *Python*. -1. Select *Virtual* for the **Mode**. -1. Press **Add upstream repository** in **Virtual upstream repositories**. -1. Use the **Browse** button to locate and select the *python-chainguard* +1. Click **+** to add another repository. +1. Set the **Name** to `python-all`. +1. Set the **Format** to `Python`. +1. Set the **Mode** to `Virtual`. +1. Click **Add upstream repository** in **Virtual upstream repositories**. +1. Click **Browse**, then locate and select the `python-chainguard` repository as **Repository 1** and set the **Policy name 1** to - *python-chainguard*. -1. Use the **Browse** button to locate and select the *python-public* repository - as **Repository 2** and set the **Policy name 2** to *python-public*. -1. Press **Add upstream repository** in **Virtual upstream repositories**. -1. Set the **Priority** value for the *python-chainguard* policy name to a higher - value than the *python-public* priority value. + `python-chainguard`. +1. Click **Browse**, then locate and select the `python-public` repository + as **Repository 2** and set the **Policy name 2** to `python-public`. +1. Click **Add upstream repository** in **Virtual upstream repositories**. +1. Set the **Priority** value for the `python-chainguard` policy name to a higher + value than the `python-public` priority value. 1. Choose the same suitable **Region** for your development in **Location type** - as configured for the *python-public* repository. -1. Press **Create**. + as configured for the `python-public` repository. +1. Click **Create**. @@ -233,7 +242,7 @@ PyPI public index as remote repositories and combine them as a virtual repository: 1. Log in as a user with administrator privileges. -1. Press **Administration** in the top navigation bar. +1. Click **Administration** in the top navigation bar. 1. Select **Repositories** in the left hand navigation. Configure a remote repository for the Chainguard Libraries for Python index: @@ -246,10 +255,10 @@ Configure a remote repository for the Chainguard Libraries for Python index: with chainctl](/chainguard/libraries/access/). 1. Set the **PyPI Settings - Registry URL** to `https://libraries.cgr.dev/python/`. -1. Optionally click the **Test** button to verify connection and authentication. -1. Access the **Advanced** configuration tab and deactivate the **Block - Mismatching Mime Types** setting in the **Others** section. -1. Press **Create Remote Repository**. +1. Optionally click **Test** to verify connection and authentication. +1. Click the **Advanced** configuration tab. Disable **URL Normalization** and disable **Block + Mismatching Mime Types** in the **Others** section. +1. Click **Create Remote Repository**. If you want to use the separate repository with [remediated Python libraries](/chainguard/libraries/python/overview/#cve-remediation) repeat the @@ -268,7 +277,7 @@ Configure a remote repository for the PyPI public index: Combine the two repositories in a new virtual repository: -1. Press **Create a Repository** and choose the **Virtual** option. +1. Click **Create a Repository** and choose the **Virtual** option. 1. Select *PyPI* as the Package type. 1. Set the **Repository Key** to `python-all`. 1. In the **Repositories** section, find the `python-chainguard` and From fcaaa61499c58b46a0ea259b94f6a00a44603724 Mon Sep 17 00:00:00 2001 From: s-stumbo Date: Mon, 8 Jun 2026 14:06:07 -0400 Subject: [PATCH 2/2] remove migration info Signed-off-by: s-stumbo --- .../chainguard/libraries/python/global-configuration.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/content/chainguard/libraries/python/global-configuration.md b/content/chainguard/libraries/python/global-configuration.md index 73805c40c1..bc1737ccd8 100644 --- a/content/chainguard/libraries/python/global-configuration.md +++ b/content/chainguard/libraries/python/global-configuration.md @@ -51,15 +51,6 @@ approach. Refer to the [direct access documentation for build tools](/chainguard/libraries/python/build-configuration/#direct-access) for more information. -### Upcoming infrastructure migration - -Chainguard is migrating Python Libraries serving from `/python/files/...` paths to new R2-backed `/python/simple/...` paths. To avoid breaking existing environments, this migration is being rolled out with a 60-day transition window from June 10, 2026 through August 9, 2026. During this window, both path styles are served. - -- Ensure your firewall allows HTTPS access to `9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com`. -- If you use lockfiles that retain artifact URLs, such as with `pip` hash pinning or `uv`, plan to refresh those lockfiles during the migration window so they resolve to the new paths before August 9, 2026. -- If you manage Python package access through a repository manager, review your configuration and validate package retrieval in a staging environment before the end of the migration window. - - ### Considerations for fallback approach Before configuring your repo manager, consider how you want to handle packages that aren't