Installing pants behind a firewall

[Niccolum]

Hi!

I want to use pants internally at my company. I've reread the documentation and the source code, but I have several questions related to the company blocking access to all external resources, including GitHub. It's easier to forgive me in advance if it's customary to ask one question per thread, but mine are very related.

1. Can sci-pants only be downloaded via brew and GitHub releases? Is there a way to install it locally by downloading the binary? On linux, for example. Inside the сurl variant, downloads from GitHub releases still occur. bin tool also need GitHub releases

2. I've encountered a problem with sci-pants pulling its own Python versions for its own operation. Can I set a common path to them, or is the only way to specify them in PANTS_BOOTSTRAP_URLS?

3. Can I replace the Python used by uv/pyenv for pants' internal operation? I've seen some news that this might be problematic, but having local copies of all Pythons in an internal repository also seems like a strange idea.

Thanks in advance for your answers. I've been looking through the document for several days and still haven't been able to find the answers. Thank you.

[sureshjoshi]

1. Can sci-pants only be downloaded via brew and GitHub releases? Is there a way to install it locally by downloading the binary? On linux, for example. Inside the сurl variant, downloads from GitHub releases still occur. bin tool also need GitHub releases

I'm not entirely sure what this means, but yes?

scie-pants, pants, and a lot of the internal machinery pulls artifacts from Github Releases by default. The curl script is basically just an automated way to pull from Github (this is inside the file: URL="https://github.com/pantsbuild/scie-pants/releases/${version}/scie-pants-${OS}-${ARCH}")

Is there a way to install it locally by downloading the binary?

This was specifically the part I was confused about. The binaries are hosted on Github, so in order to download the binary, you're grabbing from Github.

Is the issue you're having exclusively related to CI? Or are you just entirely blocked from using Github at all (which I assume is not the case, as you're asking a question here). Just trying to get a more precise problem statement - as there might be workarounds/partial workarounds based on that.

2. I've encountered a problem with sci-pants pulling its own Python versions for its own operation. Can I set a common path to them, or is the only way to specify them in PANTS_BOOTSTRAP_URLS?

Correct, scie-pants is basically a "pants runner" in simpler terms. It comes bundled with its own Python versions (pulled from Python Build Standalone on Github) to match the version that Pants expects/requires to run. It does neat stuff on the fly and more than I'm stating, but think of it as:
"Reads pants.toml, downloads that Pants version, downloads the associated python version, bundles stuff together, unpacks it, runs it"

You can specify different URLs in PANTS_BOOTSTRAP_URLS (per platform) and those can be file:// locations too as I'm guessing you read here: https://github.com/pantsbuild/scie-pants/?tab=readme-ov-file#firewall-support.

Simple partial example: pantsbuild/scie-pants#486 (comment)

Before scie-pants, Pants was run using the script described here (uses system Pythons): https://www.pantsbuild.org/2.26/docs/getting-started/manual-installation

3. Can I replace the Python used by uv/pyenv for pants' internal operation? I've seen some news that this might be problematic, but having local copies of all Pythons in an internal repository also seems like a strange idea.

I don't really know what this means, as I don't know what copies there are. When running your repo, Pants picks up your system python interpreter (via interpreter_constraints - but when running Pants itself, it uses the downloaded/bundled Pythons if you use the runner).

[benjyw]

I'm guessing that the OP wants to download from Github or wherever one time, vet those downloads, and then stash them behind the firewall?

[sureshjoshi]

That's roughly my guess, but good to find out the use case and limitation.

There's also a possibility to just create a fat-scie, to save some downloads - similar to how we're considering trialing Pants deployments. Still question marks around it though.

[Niccolum]

Thanks for the quick replies and help. I, in turn, figured out how to work with all this at the same time, so I'll write about each point:

1. At first, I didn't realize that the scie-pants release is a binary and can be run immediately after downloading it. I thought I needed to install it somehow. But no – I just downloaded it and it worked.

2. I specified cpython-3.9.23+20250612 and cpython-3.11.13+20250612 in PANTS_BOOTSTRAP_URLS. Different ones for different OS and architectures (8 links in total), and it started working just fine.

3. I didn't find a way to do this, but in principle, this isn't a problem if we use PANTS_BOOTSTRAP_URLS, where we can specify all the necessary Pythons. The only thing is, it's all hardcoded, but I can live with that.

What I'd like to clarify:

1. Why was PANTS_BOOTSTRAP_URLS invented? What do you think about creating some kind of url_template in pants.toml for Python and pants.pex, respectively? Or alternative [bootstrap].urls in pants.toml?
2. I don't quite understand why pants needs both Python 3.9 and 3.11, and not just 3.11? I downloaded the latest pants 2.29.1, compiled for 3.11

[sureshjoshi]

1. This is a construct of scie-pants, not pants. https://github.com/pantsbuild/scie-pants/blob/e61e619599983ac4f6efd4fe627ec70f725d58ea/CHANGES.md?plain=1#L69

You can run pants without scie-pants, and using just a system interpreter if you want.

2. I created a ticket last week to only have one Python version downloaded by scie-pants:
   Remove always-installed py39 from scie-pants scie-pants#491

[Niccolum]

1. This is a construct of scie-pants, not pants. https://github.com/pantsbuild/scie-pants/blob/e61e619599983ac4f6efd4fe627ec70f725d58ea/CHANGES.md?plain=1#L69

scie-pants can't use pants.toml if it exists? Or is this inconsistent behavior?

You can run pants without scie-pants, and using just a system interpreter if you want.

Starts with 2.2x - I can't. And it's okay

% python pants.2.29.1-cp311-darwin_arm64.pex
Traceback (most recent call last):
  File "/Users/n.vidov/Library/Caches/pex/venvs/1/3d3247a78ec4abaa744ec0ab7db7e66d16ce7330/779eb2cc0ca9e2fdd204774cbc41848e4e7c5055/pex", line 374, in <module>
    boot(
  File "/Users/n.vidov/Library/Caches/pex/venvs/1/3d3247a78ec4abaa744ec0ab7db7e66d16ce7330/779eb2cc0ca9e2fdd204774cbc41848e4e7c5055/pex", line 362, in boot
    sys.exit(func())
             ^^^^^^
  File "/Users/n.vidov/Library/Caches/pex/venvs/1/3d3247a78ec4abaa744ec0ab7db7e66d16ce7330/779eb2cc0ca9e2fdd204774cbc41848e4e7c5055/lib/python3.11/site-packages/pants/bin/pants_loader.py", line 129, in main
    PantsLoader.main()
  File "/Users/n.vidov/Library/Caches/pex/venvs/1/3d3247a78ec4abaa744ec0ab7db7e66d16ce7330/779eb2cc0ca9e2fdd204774cbc41848e4e7c5055/lib/python3.11/site-packages/pants/bin/pants_loader.py", line 125, in main
    cls.run_default_entrypoint()
  File "/Users/n.vidov/Library/Caches/pex/venvs/1/3d3247a78ec4abaa744ec0ab7db7e66d16ce7330/779eb2cc0ca9e2fdd204774cbc41848e4e7c5055/lib/python3.11/site-packages/pants/bin/pants_loader.py", line 106, in run_default_entrypoint
    exit_code = runner.run(start_time)
                ^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/n.vidov/Library/Caches/pex/venvs/1/3d3247a78ec4abaa744ec0ab7db7e66d16ce7330/779eb2cc0ca9e2fdd204774cbc41848e4e7c5055/lib/python3.11/site-packages/pants/bin/pants_runner.py", line 101, in run
    raise RuntimeError(
RuntimeError: The `pants` launcher binary is now the only supported way of running Pants. See https://www.pantsbuild.org/2.29/docs/getting-started/installing-pants for details.

[nrontsis]

Ran into similar issues myself and opened

#22942