git-buckets

The end-user CLI for git-buckets deployments: git repos and Python package registries backed by S3, sitting behind a private deployment you don't operate.

Install

uv tool install git-buckets

Gives you gb, a keyring backend for private package indexes, and a keyring CLI.

Private package indexes

uv sync / pip install can reach a private index with no login step: the keyring backend turns your ambient AWS profile into a short-lived token, in-process only, never written to disk.

export GB_KEYRING_HOSTS=git.example.cloud   # comma-separated allowlist, required
export GB_KEYRING_PROFILE=my-profile        # optional: AWS profile to mint with, else AWS_PROFILE / default chain

[tool.uv]
keyring-provider = "subprocess"

[[tool.uv.index]]
name = "tools"
url = "https://gb@git.example.cloud/packages/tools/pypi/"
explicit = true

[tool.uv.sources]
my-package = { index = "tools" }

The gb@ in the URL is load-bearing: uv only does keyring discovery when the index URL carries a username.

Print a token by hand:

keyring get https://git.example.cloud/packages/tools/pypi/ gb

Publishing

gb publish

Publishes built distributions (dist/* by default) to the package index of the repo behind your project's origin remote. See gb publish --help for --bucket, --repo, --profile, and --dry-run.

Troubleshooting

Set GB_KEYRING_DEBUG=1 to have the backend print one line to stderr explaining why a lookup declined (wrong username, host not allowlisted, mint failure).

git-buckets-keyring is deprecated; its backend is merged into this package.