awslabs / awslabs/amazon-kinesis-client-python

Add option to skip JAR downloads during pip install

Open
#302 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
377
Forks
228
PR merge metrics
No merged PRs in 30d

Description

Currently, the amazon_kclpy package performs mandatory JAR downloads during pip install, which causes several challenges in enterprise environments:

- Security Compliance:
pip install fails when internal Nexus or Artifactory repositories flag known CVEs in the default JAR versions.

- Flexible Dependency Management:
Enterprise teams need the ability to manage and package approved JAR versions separately to meet internal security policies and control upgrades independently.

- Installation Performance:
Mandatory downloads increase pip install time, even in cases where the JARs are already packaged or retrieved via internal build pipelines.

Proposed Improvement:
Introduce options to skip JAR downloads and make them available via:
- An optional environment variable KCL_SKIP_JAR_DOWNLOAD=1/true to bypass JAR fetching automatically during installation

This would:

- Allow clean separation of Python packaging and Java dependencies.
- Enable enterprises to pre-stage and control JAR dependencies.
- Reduce installation errors and improve reproducibility.
- Improve install performance in CI/CD pipelines.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.