Installing private packages in app engine from a google artifact registry - google-app-engine

Question

I am trying to modularize our code, and running into difficulties installing private packages on app engine.
We have a repository on GCP in the same project, so I would think this is not too difficult.
My requirement.txt looks like:
--extra-index-url=https://us-central1-python.pkg.dev/myproject/my-python-repo/simple/
Flask==2.0.1
my-new-package
I can pip install the package locally, and it uses the keyrings.google-artifactregistry-auth package to authenticate.
The deployment fails with:
File "/opt/python3.8/lib/python3.8/site-packages/pip/_internal/utils/misc.py", line 218, in ask_input
return input(message)
EOFError: EOF when reading a line
This is clearly pip asking for a username, where i
Is google's own keyring package not available in its own environment? This Suggests so. Of course adding it to requirements.txt has no effect, as it is too late.
How can I install packages properly?

Answer 1

A possible solution is to:
--extra-index-url=_json_key_base64:KEY#us-central1-python.pkg.dev/myproject/my-python-repo/simple/
Where KEY is the result of base64 -w 0 < credentials.json
Of course this then requires some rewriting of the requirements.txt file in your deployment pipeline to ensure service account credentials are secured in repository variables.