Private repos failing to install #272

woodpav · 2018-10-24T20:19:35Z

My serverless.yml is:

plugins:
  - serverless-python-requirements
custom:
    pythonRequirements:
        dockerizePip: true
        dockerSsh: true

I have my ssh key in ~/.ssh/id_rsa (it's my only one). Installing the requirements works when I do not use sls deploy.

Permission denied (publickey).
fatal: Could not read from remote repository.

Changing to dockerizePip: false fixes the error. I'd like to use dockerizePip: true.

The text was updated successfully, but these errors were encountered:

dschep · 2018-10-25T15:55:55Z

Hmm that's odd. Could you provide some more environment details? IE OS, sls version, & plugin version.

cc @cgrimal, Any idea why this might be failing?

woodpav · 2018-10-25T15:58:58Z

I'm on MacOS 10.13.6, serverless-python-requirements: 4.2.4, sls: 1.30.3

smartinspereira · 2018-11-26T19:01:32Z

I get the same error if my ssh key is password protected, removing the password resolves the error.

There is a mention of the ssh-agent in the README.md:69-70 w.r.t a password protected ssh key @dschep @cgrimal, but I do not really grasp what

If your SSH key is password protected, you can use ssh-agent because $SSH_AUTH_SOCK is also mounted & the env var set.

means in this context, if it only tells me to add the ssh-key prior to sls deploy, what I think it does, that is not changing anything. :-(

edit: MacOS 10.14.1 (18B75), serverless-python-requirements: 4.2.5, sls: 1.33.2

bsamuel-ui · 2018-11-29T19:11:26Z

Try this:

eval `ssh-agent`           # Don't do this on Mac OS X
ssh-add                    # To add the default .ssh/id_* keys
ssh-add ~/.ssh/foobar.pem  # To add a specific key

The ssh-add command will ask for your password, and after that, the unencrypted ssh key is now living in that agent. You should be able to run the process normally after that point.

Mac OS X manages ssh-agent for you, but on linux the eval command is setting an environment variable (SSH_AUTH_SOCK) corresponding to a domain socket that an agent process is listening to in the background. When you run ssh, it will forward the request through that socket to the agent process which will negotiate the crypto. The point of that dance is so your unencrypted key never leaves the agent.

smartinspereira · 2018-11-30T11:11:35Z

This is what I did. It is not working. I get the same error as @woodpav but there is a longer stack trace I could post later.

dschep · 2018-11-30T14:41:18Z

just to clarify, your private package is in your requirements.txt as something like git+ssh://github.com/foo/bar, yes?

smartinspereira · 2018-12-01T16:48:50Z

@dschep yes, exactly.
See the output of the commands:

echo "$(less requirements.txt)"
SLS_DEBUG=* sls deploy
cd && git clone ssh://[email protected]/foo/bar

$ echo "$(less requirements.txt)"
psycopg2
git+ssh://[email protected]/foo/bar

$ SLS_DEBUG=* sls deploy
Serverless: Load command config
Serverless: Load command config:credentials
Serverless: Load command create
Serverless: Load command install
Serverless: Load command package
Serverless: Load command deploy
Serverless: Load command deploy:function
Serverless: Load command deploy:list
Serverless: Load command deploy:list:functions
Serverless: Load command invoke
Serverless: Load command invoke:local
Serverless: Load command info
Serverless: Load command logs
Serverless: Load command login
Serverless: Load command logout
Serverless: Load command metrics
Serverless: Load command print
Serverless: Load command remove
Serverless: Load command rollback
Serverless: Load command rollback:function
Serverless: Load command slstats
Serverless: Load command plugin
Serverless: Load command plugin
Serverless: Load command plugin:install
Serverless: Load command plugin
Serverless: Load command plugin:uninstall
Serverless: Load command plugin
Serverless: Load command plugin:list
Serverless: Load command plugin
Serverless: Load command plugin:search
Serverless: Load command config
Serverless: Load command config:credentials
Serverless: Load command rollback
Serverless: Load command rollback:function
Serverless: Load command requirements
Serverless: Load command requirements:clean
Serverless: Load command requirements:install
Serverless: Load command requirements:cleanCache
Serverless: Invoke deploy
Serverless: Invoke package
Serverless: Invoke aws:common:validate
Serverless: Invoke aws:common:cleanupTempDir
Serverless: Generated requirements from [...]/requirements.txt in [...]/.serverless/requirements.txt...
Serverless: Installing requirements from [...]/.serverless/requirements/requirements.txt ...
Serverless: Docker Image: lambci/lambda:build-python3.6
Collecting git+ssh://[email protected]/foo/bar.git (from -r /var/task/requirements.txt (line 1))
  Cloning ssh://[email protected]/foo/bar.git to /tmp/pip-req-build-r_sjq8dd
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
 
  Error --------------------------------------------------
 
  null
 
     For debugging logs, run again after setting the "SLS_DEBUG=*" environment variable.
 
  Stack Trace --------------------------------------------
 
Error: null
    at installRequirements ([...]/node_modules/serverless-python-requirements/lib/pip.js:262:11)
    at installRequirementsIfNeeded ([...]/node_modules/serverless-python-requirements/lib/pip.js:451:3)
    at ServerlessPythonRequirements.installAllRequirements ([...]/node_modules/serverless-python-requirements/lib/pip.js:530:29)
From previous event:
    at PluginManager.invoke (/usr/local/lib/node_modules/serverless/lib/classes/PluginManager.js:391:22)
    at PluginManager.spawn (/usr/local/lib/node_modules/serverless/lib/classes/PluginManager.js:409:17)
    at Deploy.BbPromise.bind.then (/usr/local/lib/node_modules/serverless/lib/plugins/deploy/deploy.js:117:50)
From previous event:
    at Object.before:deploy:deploy [as hook] (/usr/local/lib/node_modules/serverless/lib/plugins/deploy/deploy.js:107:10)
    at BbPromise.reduce (/usr/local/lib/node_modules/serverless/lib/classes/PluginManager.js:391:55)
From previous event:
    at PluginManager.invoke (/usr/local/lib/node_modules/serverless/lib/classes/PluginManager.js:391:22)
    at PluginManager.run (/usr/local/lib/node_modules/serverless/lib/classes/PluginManager.js:422:17)
    at variables.populateService.then.then (/usr/local/lib/node_modules/serverless/lib/Serverless.js:157:33)
    at processImmediate (timers.js:632:19)
    at process.topLevelDomainCallback (domain.js:120:23)
From previous event:
    at Serverless.run (/usr/local/lib/node_modules/serverless/lib/Serverless.js:144:8)
    at serverless.init.then (/usr/local/lib/node_modules/serverless/bin/serverless:44:28)
 
  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Issues:        forum.serverless.com
 
  Your Environment Information -----------------------------
     OS:                     darwin
     Node Version:           11.2.0
     Serverless Version:     1.34.1

$ cd && git clone ssh://[email protected]/foo/bar
Cloning into 'bar'...
remote: Enumerating objects: ..., done.
remote: Counting objects: ..., done.
remote: Compressing objects: ..., done.
remote: Total ..., reused ..., pack-reused ...
Receiving objects: ..., done.
Resolving deltas: ..., done.

dschep · 2018-12-03T19:20:48Z

Issue confirmed. I think it's an issue with shell-quote turning /path/to/sock:/tmp/sock:z into /path/to/sock\:/tmp/sock\:z 😢

smartinspereira · 2018-12-03T20:10:00Z

Oh no 😞.

~~Just did a little testing, maybe it helps. Using v1.2.0 seem to work, no error on sls package. Starting with v2.0.0, sls package is giving me the same error.~~

fixing /path/to/sock\:/tmp/sock\:z into /path/to/sock:/tmp/sock:z and fixing all the other escaped / neither helps.

dschep · 2018-12-03T21:22:47Z

~~Looks like the typescript plugin is to blame: https://github.com/prisma/serverless-plugin-typescript/search?q=.build&unscoped_q=.build~~

commented on the wrong pr in the wrong repo

smartinspereira · 2018-12-03T21:27:50Z

See comment above, but i found:

so maybe we can't easily fix that issue?

dschep · 2018-12-03T21:35:38Z

Hmm. you're right. I removed the quote_single to test and it also fails :(

bsamuel-ui · 2018-12-10T21:48:47Z

I saw this referenced, it's basically using a TTY channel to forward the socket into the container which is a total hack, but one of the less awful ways I can think of doing it.

dschep · 2018-12-10T22:03:51Z

good find ben! that is one hell of a hack tho 😂

nkantar · 2019-03-27T23:27:59Z

Is there a way to specify which key gets used for said ssh access? For me personally it might be acceptable to create a separate deploy key (sans passphrase) to use for this. Alternately, is there a way to get access to the Docker host in a script?

wviana · 2019-04-15T17:23:50Z

Any news on it?
I'm having the same issue, I'm almot removinng the password from my id_rsa.

I did create a new key without password just for this, but I've notice that it just mount id_rsa into docker. I saw it at line 197 from https://github.com/UnitedIncome/serverless-python-requirements/blob/c017f718843ce1eb8547bd20d1ef078081c64f47/lib/pip.js

May we could at least add another custom parameter for using another key instead of id_rsa

Add a `keyFile` option, so you could replace the default keyfile for one that is not `id_rds` This change was made to make possible a work arround for serverless#272 But it mey also be a interesting feature.

wviana · 2019-04-15T17:52:41Z

It worked for me as a workarround, but may be a feature.

Here is it wviana#1

revmischa · 2019-09-02T14:34:18Z

I am also unable to use docker with SSH_AGENT on macOS 10.14. I added keys and spawned the agent as normal but it isn't picking them up.

Serverless: Running docker run --rm -v /Users/cyber/Library/Caches/serverless-python-requirements/93546f9eec2c9cd50799cbdcf3a464f1_slspyc\:/var/task\:z -v /Users/cyber/.ssh/id_rsa\:/root/.ssh/id_rsa\:z -v /Users/cyber/.ssh/known_hosts\:/root/.ssh/known_hosts\:z -v /var/folders/n8/rmzyc9yx2zvbc978_p6y_by40000gn/T//ssh-JaouMxpaYmZO/agent.87072\:/tmp/ssh_sock\:z -e SSH_AUTH_SOCK\=/tmp/ssh_sock -v /Users/cyber/Library/Caches/serverless-python-requirements/downloadCacheslspyc\:/var/useDownloadCache\:z -u 0 lambci/lambda\:build-python3.7 /bin/sh -c 'python3.7 -m pip install -t /var/task/ -r /var/task/requirements.txt --cache-dir /var/useDownloadCache && find /var/task -name \\*.so -exec strip \\{\\} \\;'...
 
  Error --------------------------------------------------
   Running command git clone -q ssh://[email protected]/......git /tmp/pip-install-1zfu73s_/jb
  Permission denied (publickey).
  fatal: Could not read from remote repository.

wviana · 2019-09-09T10:03:47Z

The solution I'm using is changing the code to copy my entire .ssh/ into contianer.

AkA84 · 2020-08-03T07:53:47Z

I can confirm the issue. I had to create a new set of key pairs without a passphrase, and following @wviana suggestion I had to manually amend pip.js to make it point to the new private key https://github.com/wviana/serverless-python-requirements/blob/be395cd2a7a36e50994949aaceed747f504efd7b/lib/pip.js#L197

spawn-guy · 2020-11-06T14:50:23Z

i just made a different approach. it fixes the build-on-windows with private ssh keys problem. the drawback is ssh keys must be without passwords. pulls some git+ssh private repos like a charm 😗

based on https://nickjanetakis.com/blog/docker-tip-56-volume-mounting-ssh-keys-into-a-docker-container

all files are in the same project root folder

serverless.yaml additions

custom:
  pythonRequirements:
    dockerizePip: non-linux
    dockerFile: ./Dockerfile
    dockerRunCmdExtraArgs: [ '-v', "${env:USERPROFILE, ''}${env:HOME, ''}/.ssh:/tmp/.ssh:ro" ]

USERPROFILE is on windows, HOME on linux/mac/???

docker-entrypoint.sh
this script sets the proper permissions for the keys - as you can NOT disable permissions check in any ssh client (SODD FTW). and win-docker absence of filesystem metadata availability (no read/write/owner meta on files)
also fixes problem where not All the keys are named id_rsa... github recommends a different hash algo nowadays so the filename is different

#!/bin/sh
set -e

cp -R /tmp/.ssh /root/.ssh
chmod 700 /root/.ssh
find /root/.ssh/ -type f ! -name "*.*" -exec chmod 600 {} +
find /root/.ssh/ -type f -name "*.pub" -exec chmod 644 {} +

exec "$@"

and the Dockerfile for python 3.8

FROM lambci/lambda:build-python3.8

COPY ./docker-entrypoint.sh /bin/docker-entrypoint.sh

RUN yum install -y dos2unix && \
    dos2unix /bin/docker-entrypoint.sh && \
    yum remove -y dos2unix && \
    yum clean all

RUN chmod +x /bin/docker-entrypoint.sh

ENTRYPOINT ["/bin/docker-entrypoint.sh"]

dos2unix fixes line endings if the file is created on Windows

dschep added bug confirmed bug confirmed labels Dec 3, 2018

wviana mentioned this issue Apr 15, 2019

Update pip.js wviana/serverless-python-requirements#1

Open

wviana mentioned this issue Apr 26, 2019

Update pip.js #356

Closed

woodpav mentioned this issue Aug 29, 2019

PubSub: ImportError after deploying Cloud Function with python3.7 and serverless googleapis/google-cloud-python#9102

Closed

zhizhenw mentioned this issue Feb 1, 2021

Unable to add private repo to requirements.txt #560

Open

martinezpl mentioned this issue Feb 17, 2022

feat: Support dockerPrivateKey to specify path to SSH key #674

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Private repos failing to install #272

Private repos failing to install #272

woodpav commented Oct 24, 2018 •

edited

Loading

dschep commented Oct 25, 2018

woodpav commented Oct 25, 2018

smartinspereira commented Nov 26, 2018 •

edited

Loading

bsamuel-ui commented Nov 29, 2018

smartinspereira commented Nov 30, 2018

dschep commented Nov 30, 2018

smartinspereira commented Dec 1, 2018

dschep commented Dec 3, 2018

smartinspereira commented Dec 3, 2018 •

edited

Loading

dschep commented Dec 3, 2018 •

edited

Loading

smartinspereira commented Dec 3, 2018

dschep commented Dec 3, 2018

bsamuel-ui commented Dec 10, 2018

dschep commented Dec 10, 2018

nkantar commented Mar 27, 2019

wviana commented Apr 15, 2019

wviana commented Apr 15, 2019

revmischa commented Sep 2, 2019

wviana commented Sep 9, 2019

AkA84 commented Aug 3, 2020

spawn-guy commented Nov 6, 2020 •

edited

Loading

Private repos failing to install #272

Private repos failing to install #272

Comments

woodpav commented Oct 24, 2018 • edited Loading

dschep commented Oct 25, 2018

woodpav commented Oct 25, 2018

smartinspereira commented Nov 26, 2018 • edited Loading

bsamuel-ui commented Nov 29, 2018

smartinspereira commented Nov 30, 2018

dschep commented Nov 30, 2018

smartinspereira commented Dec 1, 2018

dschep commented Dec 3, 2018

smartinspereira commented Dec 3, 2018 • edited Loading

dschep commented Dec 3, 2018 • edited Loading

smartinspereira commented Dec 3, 2018

dschep commented Dec 3, 2018

bsamuel-ui commented Dec 10, 2018

dschep commented Dec 10, 2018

nkantar commented Mar 27, 2019

wviana commented Apr 15, 2019

wviana commented Apr 15, 2019

revmischa commented Sep 2, 2019

wviana commented Sep 9, 2019

AkA84 commented Aug 3, 2020

spawn-guy commented Nov 6, 2020 • edited Loading

woodpav commented Oct 24, 2018 •

edited

Loading

smartinspereira commented Nov 26, 2018 •

edited

Loading

smartinspereira commented Dec 3, 2018 •

edited

Loading

dschep commented Dec 3, 2018 •

edited

Loading

spawn-guy commented Nov 6, 2020 •

edited

Loading