Able to install packages without authentication from GitLab package registry

How to Use GitLab
1
  • Self-managed GitLab version 15.11.13

In our self-managed GitLab instance, we have a group with various projects. In one of the projects, I have pushed a python package in its package registry. I then copy the command "pip install … " from the python package page and use it to install the package in another machine. The issue is that I have not defined any .pypirc file; so there is not access token in the machine, and still I am able to install the python package.

How can I enforce the endpoint to first authenticate with GitLab before proceeding to install the python package?

2

Current 17.x releases require authentication for Pypi packages in the registry. Not sure if 15.x supported that behavior, but I recommend upgrading to supported 17.3+.

3

Hi @dnsmichi,

In this page (installing pypi packages), it specifically states to use a token, but I am still able to install a package without a token. Does it mean that I am following some incorrect process, or the information on the page is incorrect?

4

Maybe a bug or security problem in 15.11.