Hosting Private Conda Packages - URL Contains Querystring - azure

Question

Per this very helpful Q&A on StackOverflow I am able to build a private conda package and then install it by placing it in a specific folder. I can also host it somewhere on the web and simply use the URL as the channel, with the prefix url://.
In order to keep my code private, I put the conda channel in Azure Blob Storage and created an SAS to access it. So in theory, the way to keep it private is that only someone with the full SAS URL including the token can access it.
The problem is, the SAS format is in the form of a URL query: https://<storage-name>.blob.core.windows.net/<container-name>?se=2019-07-24T02%3A53%3A48Z&sp=rl&sv=2018-03-28&sr=c&comp=list&restype=container&sig=REDACTED_TOKEN, so when I pass it to conda it breaks the URL after the ? and doesn't use the full URL, and gets a 404 in response. See the Microsoft docs for the full specification.
PowerShell example:
PS C:\Users\ydima> $sas = "https://REDACTED.blob.core.windows.net/conda-channel-1?se=2019-07-24T02%3A53%3A48Z&sp=rl&sv=2018-03-28&sr=c&comp=list&restype=container&sig=REDACTED"
PS C:\Users\ydima> conda install -c "url:///"$sas crawford-utils
Collecting package metadata (current_repodata.json): failed
CondaHTTPError: HTTP 000 CONNECTION FAILED for url <https://url/win-64/current_repodata.json>
Elapsed: -
An HTTP error occurred when trying to retrieve this URL.
HTTP errors are often intermittent, and a simple retry will get you on your way.
ConnectionError(MaxRetryError("HTTPSConnectionPool(host='url', port=443): Max retries exceeded with url: /win-64/current_repodata.json (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x0000026183E54EB8>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed'))"))
'sp' is not recognized as an internal or external command,
operable program or batch file.
'sv' is not recognized as an internal or external command,
operable program or batch file.
'sr' is not recognized as an internal or external command,
operable program or batch file.
Name of second file to compare:
Any idea how I can get conda to use a URL that includes queries in the body?

Answer 1

According to the source code of Channel class of conda tool as the figure below, it does not support the query string in an URL.
So if you want to use a container in Azure Blob Storage as a channel of a private conda mirror, you need to set public access level for the container or directly use the feature of static web hosting of Azure Storage.
Otherwise, a possible workaround solution is to set a custom proxy for conda tool to help automatically adding the sas token query string at the end of each resource url of conda channel, please refer to the document Using the .condarc conda configuration file to know how to set proxy server in the .condarc file.
Hope it helps.

Answer 2

So I found a cool solution. I create an Azure Storage account, and then create a blob container that is publicly accessible, but to protect it I name the blob container something random - like a long random string, which in effect can act as a token. So for example, in PowerShell:
PS C:> $azStorageName = "mystorage"
PS C:> $blobName = -join ((97..122) | Get-Random -Count 26 | ForEach-Object {[char]$_})
PS C:> "https://$azStorageName.blob.core.windows.net/$blobName"
https://mystorage.blob.core.windows.net/fwsjtizbpvaerukdomqhlgnycx
The code to generate the random string is based on this post.
It has 26^26 possible combinations, which I think is good enough for a secure token for this purpose.
I also plan on setting up CI in say Azure Pipelines, so that I can automate all this whenever I push code to the private GitHub repo.