Repository navigation
[Core] Fix #34227: az login: Prevent local redis directory from shadowing dependencies - #34256
Aditya Pujara (a0x1ab) wants to merge 4 commits into
Conversation
…m shadowing dependencies Root cause: src/azure-cli/azure/cli/__main__.py imported core with Python's implicit working-directory sys.path entry intact. _profile._create_identity_instance lazily imports auth.identity and auth.persistence, whose msal_extensions dependency imports portalocker. With the source-pinned portalocker 3.2.0, an empty local redis directory becomes a namespace package lacking client and crashes authentication. This is dependency shadowing at CLI startup, not account or cache configuration. Change: Remove only the interpreter-prepended unsafe sys.path entry at shared CLI entry-point execution, before timeit or CLI dependencies. Skip removal under safe-path or isolated mode, using getattr for Python 3.10 compatibility. Retain explicit PYTHONPATH entries, including duplicate current-directory entries, and normal extension loading. Add credential-free real CLI subprocess regressions for default/device login, the owned launcher, cached-account group list, control-directory equivalence, account show, help/version, explicit PYTHONPATH extensions and safe-path execution. Owned PIP, batch, PowerShell and curl module … Alternatives considered: - Launcher-only -P or PYTHONSAFEPATH misses direct module invocation and does not support Python 3.10. - Using -I everywhere discards explicit PYTHONPATH imports. Verified: - Trusted validation passed (1 command). - New or changed tests fail on the base revision and pass with the change: `src/azure-cli-core/azure/cli/core/tests/test_main.py::TestCliMain::test_default_login_from_redis_directory`, `src/azure-cli-core/azure/cli/core/tests/test_main.py::TestCliMain::test_group_list_from_redis_directory`, `src/azure-cli-core/azure/cli/core/tests/test_main.py::TestCliMain::test_login_equivalent_with_and_without_redis`. - Unit tests: 8 executed, 0 skipped. - flake8 and pylint passed. - Pre-publication gates passed: release-artifact, generated-ownership, command-help, lint, regression-test, independent-review. - Repository CI and live tests run on this PR. Fixes Azure#34227
x-engineering-agent
Bot
added
Request X Engineering Agent
Agent review: no blocking findingsThe startup change removes Python's implicit import path before CLI dependencies load, while preserving explicit The new subprocess tests exercise default/device login, cached-account commands, help/version, and explicit extension imports; authentication retains real persistence imports beneath network mocks ( Not verified: Actual Azure sign-in, Docker/Homebrew installations, and the supported OS/Python matrix were not independently exercised. No tests were run in this review. Test validation
⚖️ Risk assessment — 0/100 · LowThe Low rating reflects the detected change scope with no elevated security, reliability, customer, operational, dependency, sovereign-cloud, generated-output, or cross-component signal.
🧪 Live test — SkippedSkipping the live test for this revision because the only test file(s) changed are These
Ask the Agent Tick a box to queue an action. Requires write access to this repository.
|
|
/azp run |
x-engineering-agent
Bot
added this to the
November 2026 (2026-11-16)❗ Breaking change release ❗ milestone
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
microsoft-github-policy-service
Bot
added
Auto-Assign
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
![x-engineering-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
There was a problem hiding this comment.
Aditya Pujara (@a0x1ab) Ready for human review. See the X Engineering Agent Report.
x-engineering-agent
Bot
added
X Engineering Agent Reviewed
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
🟡 Changes recommended
The Windows batch launcher still adds the working directory through an empty PYTHONPATH component, leaving the reported failure possible.
1 open issue
What changed in this PR
This PR addresses #34227 by removing Python’s implicit import path at Azure CLI startup, preventing a local redis directory from shadowing authentication dependencies.
Changes:
- Remove the implicit path before loading CLI dependencies, while preserving explicit
PYTHONPATHentries and safe-path behavior. - Add subprocess regressions for authentication, cached-account commands, help/version, launcher execution, and extension imports.
| File | Description |
|---|---|
| src/azure-cli/azure/cli/__main__.py | Remove the implicit import path during CLI startup. |
| src/azure-cli-core/azure/cli/core/tests/test_main.py | Add startup and dependency-shadowing regression tests. |
Review effort: Balanced
| # Remove Python's implicit import path, but retain explicit PYTHONPATH entries. | ||
| sys.path.pop(0) |
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
🤖 PR Validation — ️✔️ All clear
Related command
az loginDescription
Fixes #34227.
Prevent local redis directory from shadowing dependencies.
Root cause: src/azure-cli/azure/cli/main.py imported core with Python's implicit working-directory sys.path entry intact. _profile._create_identity_instance lazily imports auth.identity and auth.persistence, whose msal_extensions dependency imports portalocker. With the source-pinned portalocker 3.2.0, an empty local redis directory becomes a namespace package lacking client and crashes authentication. This is dependency shadowing at CLI startup, not account or cache configuration.
Fix: Remove only the interpreter-prepended unsafe sys.path entry at shared CLI entry-point execution, before timeit or CLI dependencies. Skip removal under safe-path or isolated mode, using getattr for Python 3.10 compatibility. Retain explicit PYTHONPATH entries, including duplicate current-directory entries, and normal extension loading. Add credential-free real CLI subprocess regressions for default/device login, the owned launcher, cached-account group list, control-directory equivalence, account show, help/version, explicit PYTHONPATH extensions and safe-path execution. Owned PIP, batch, PowerShell and curl module …
Risks and limitations (from the job report):
Testing Guide
src/azure-cli-core/azure/cli/core/tests/test_main.py::TestCliMain::test_default_login_from_redis_directory,src/azure-cli-core/azure/cli/core/tests/test_main.py::TestCliMain::test_group_list_from_redis_directory,src/azure-cli-core/azure/cli/core/tests/test_main.py::TestCliMain::test_login_equivalent_with_and_without_redis.Reproduction run: https://github.com/Azure/issue-sentinel/actions/runs/39347404670
History Notes
[Core]
az login: Prevent local redis directory from shadowing dependenciesThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.
Independent review: an independent reviewer checked this change against 8 acceptance criteria derived from the issue (6 required). The sandbox could not check 3 of them, so the Agent re-ran the live reproduction of the issue on this PR head and it no longer fails.