Azure / Azure/azure-sdk-for-python

CondaConfiguration.py directly calls pypi.org — breaks in CFS/network-isolated pools

Open
#46,448 0 comments 0 reactions 1 assignee Claimed by @scbedd View on GitHub
Dominant language
Python
Stars
5.6k
Forks
3.4k
Avg merge
1d 21h
Merged PRs (30d)
193

Description

## Summary

`eng/tools/azure-sdk-tools/ci_tools/conda/CondaConfiguration.py` → `get_package_sdist_url()` makes a direct HTTP call to `https://pypi.org/pypi/{package}/{version}/json` to fetch sdist URLs.

This will fail in CFS / network-isolated pool environments where egress to pypi.org is blocked.

## Location

https://github.com/Azure/azure-sdk-for-python/blob/main/eng/tools/azure-sdk-tools/ci_tools/conda/CondaConfiguration.py#L51-L64

## Suggested fix

Follow the same pattern used in the `IsPythonPackageVersionPublished` fix: use `pip download` (which respects `PIP_INDEX_URL` pointing at the Azure Artifacts feed with upstream to PyPI) instead of a direct pypi.org REST call. Alternatively, use the `PyPIClient` from `pypi_tools/pypi.py` which already supports AzDO feed backends via `PIP_INDEX_URL`.

## Context

Related to the broader CFS / network isolation migration. The release-path equivalent (`IsPythonPackageVersionPublished` in `Language-Settings.ps1`) has already been fixed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.