Use a global BaseClientBuilder (#15548)

Alternative to #15105

Instead of building a `BaseClientBuilder` from `NetworkSettings` each
time we need a client, we instead build a single `BaseClientBuilder` and
pass it around. The `RegistryClientBuilder` then uses
`BaseClientBuilder` exclusively for configuration. This removes a chunk
of copy-and-paste code, and also moves the fallible `retries_from_env`
into a single place

Borrow vs. clone is mostly ad-hoc, we can change it in either direction
if it matters.

Closes #15105

crates/uv-bench/benches/uv.rs

@@ -3,7 +3,7 @@ use std::str::FromStr;
 
 use uv_bench::criterion::{Criterion, criterion_group, criterion_main, measurement::WallTime};
 use uv_cache::Cache;
-use uv_client::RegistryClientBuilder;
+use uv_client::{BaseClientBuilder, RegistryClientBuilder};
 use uv_distribution_types::Requirement;
 use uv_python::PythonEnvironment;
 use uv_resolver::Manifest;
@@ -63,7 +63,7 @@ fn setup(manifest: Manifest) -> impl Fn(bool) {
     let interpreter = PythonEnvironment::from_root("../../.venv", &cache)
         .unwrap()
         .into_interpreter();
-    let client = RegistryClientBuilder::new(cache.clone()).build();
+    let client = RegistryClientBuilder::new(BaseClientBuilder::default(), cache.clone()).build();
 
     move |universal| {
         runtime

crates/uv-client/src/base_client.rs

@@ -123,12 +123,6 @@ impl Debug for ExtraMiddleware {
 
 impl Default for BaseClientBuilder<'_> {
     fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl BaseClientBuilder<'_> {
-    pub fn new() -> Self {
         Self {
             keyring: KeyringProviderType::default(),
             allow_insecure_host: vec![],
@@ -150,6 +144,21 @@ impl BaseClientBuilder<'_> {
     }
 }
 
+impl BaseClientBuilder<'_> {
+    pub fn new(
+        connectivity: Connectivity,
+        native_tls: bool,
+        allow_insecure_host: Vec<TrustedHost>,
+    ) -> Self {
+        Self {
+            allow_insecure_host,
+            native_tls,
+            connectivity,
+            ..Self::default()
+        }
+    }
+}
+
 impl<'a> BaseClientBuilder<'a> {
     /// Use a custom reqwest client instead of creating a new one.
     ///
@@ -157,7 +166,7 @@ impl<'a> BaseClientBuilder<'a> {
     /// Note that some configuration options from this builder will still be applied
     /// to the client via middleware.
     #[must_use]
-    pub fn with_custom_client(mut self, client: Client) -> Self {
+    pub fn custom_client(mut self, client: Client) -> Self {
         self.custom_client = Some(client);
         self
     }
@@ -267,6 +276,10 @@ impl<'a> BaseClientBuilder<'a> {
         self
     }
 
+    pub fn is_native_tls(&self) -> bool {
+        self.native_tls
+    }
+
     pub fn is_offline(&self) -> bool {
         matches!(self.connectivity, Connectivity::Offline)
     }

crates/uv-client/src/registry_client.rs

@@ -17,8 +17,8 @@ use url::Url;
 
 use uv_auth::Indexes;
 use uv_cache::{Cache, CacheBucket, CacheEntry, WheelCache};
+use uv_configuration::IndexStrategy;
 use uv_configuration::KeyringProviderType;
-use uv_configuration::{IndexStrategy, TrustedHost};
 use uv_distribution_filename::{DistFilename, SourceDistFilename, WheelFilename};
 use uv_distribution_types::{
     BuiltDist, File, IndexCapabilities, IndexFormat, IndexLocations, IndexMetadataRef,
@@ -55,22 +55,20 @@ pub struct RegistryClientBuilder<'a> {
     base_client_builder: BaseClientBuilder<'a>,
 }
 
-impl RegistryClientBuilder<'_> {
-    pub fn new(cache: Cache) -> Self {
+impl<'a> RegistryClientBuilder<'a> {
+    pub fn new(base_client_builder: BaseClientBuilder<'a>, cache: Cache) -> Self {
         Self {
             index_locations: IndexLocations::default(),
             index_strategy: IndexStrategy::default(),
             torch_backend: None,
             cache,
-            base_client_builder: BaseClientBuilder::new(),
+            base_client_builder,
         }
     }
-}
 
-impl<'a> RegistryClientBuilder<'a> {
     #[must_use]
     pub fn with_reqwest_client(mut self, client: reqwest::Client) -> Self {
-        self.base_client_builder = self.base_client_builder.with_custom_client(client);
+        self.base_client_builder = self.base_client_builder.custom_client(client);
         self
     }
 
@@ -98,37 +96,6 @@ impl<'a> RegistryClientBuilder<'a> {
         self
     }
 
-    #[must_use]
-    pub fn allow_insecure_host(mut self, allow_insecure_host: Vec<TrustedHost>) -> Self {
-        self.base_client_builder = self
-            .base_client_builder
-            .allow_insecure_host(allow_insecure_host);
-        self
-    }
-
-    #[must_use]
-    pub fn connectivity(mut self, connectivity: Connectivity) -> Self {
-        self.base_client_builder = self.base_client_builder.connectivity(connectivity);
-        self
-    }
-
-    #[must_use]
-    pub fn retries(mut self, retries: u32) -> Self {
-        self.base_client_builder = self.base_client_builder.retries(retries);
-        self
-    }
-
-    pub fn retries_from_env(mut self) -> anyhow::Result<Self> {
-        self.base_client_builder = self.base_client_builder.retries_from_env()?;
-        Ok(self)
-    }
-
-    #[must_use]
-    pub fn native_tls(mut self, native_tls: bool) -> Self {
-        self.base_client_builder = self.base_client_builder.native_tls(native_tls);
-        self
-    }
-
     #[must_use]
     pub fn built_in_root_certs(mut self, built_in_root_certs: bool) -> Self {
         self.base_client_builder = self
@@ -239,20 +206,6 @@ impl<'a> RegistryClientBuilder<'a> {
     }
 }
 
-impl<'a> TryFrom<BaseClientBuilder<'a>> for RegistryClientBuilder<'a> {
-    type Error = std::io::Error;
-
-    fn try_from(value: BaseClientBuilder<'a>) -> Result<Self, Self::Error> {
-        Ok(Self {
-            index_locations: IndexLocations::default(),
-            index_strategy: IndexStrategy::default(),
-            torch_backend: None,
-            cache: Cache::temp()?,
-            base_client_builder: value,
-        })
-    }
-}
-
 /// A client for fetching packages from a `PyPI`-compatible index.
 #[derive(Debug, Clone)]
 pub struct RegistryClient {
@@ -1275,7 +1228,7 @@ mod tests {
     use uv_pypi_types::PypiSimpleDetail;
     use uv_redacted::DisplaySafeUrl;
 
-    use crate::{SimpleMetadata, SimpleMetadatum, html::SimpleHtml};
+    use crate::{BaseClientBuilder, SimpleMetadata, SimpleMetadatum, html::SimpleHtml};
 
     use crate::RegistryClientBuilder;
     use uv_cache::Cache;
@@ -1324,7 +1277,7 @@ mod tests {
         let redirect_server_url = DisplaySafeUrl::parse(&redirect_server.uri())?;
 
         let cache = Cache::temp()?;
-        let registry_client = RegistryClientBuilder::new(cache)
+        let registry_client = RegistryClientBuilder::new(BaseClientBuilder::default(), cache)
             .allow_cross_origin_credentials()
             .build();
         let client = registry_client.cached_client().uncached();
@@ -1384,7 +1337,7 @@ mod tests {
         let redirect_server_url = DisplaySafeUrl::parse(&redirect_server.uri())?.join("foo/")?;
 
         let cache = Cache::temp()?;
-        let registry_client = RegistryClientBuilder::new(cache)
+        let registry_client = RegistryClientBuilder::new(BaseClientBuilder::default(), cache)
             .allow_cross_origin_credentials()
             .build();
         let client = registry_client.cached_client().uncached();
@@ -1432,7 +1385,7 @@ mod tests {
             .await;
 
         let cache = Cache::temp()?;
-        let registry_client = RegistryClientBuilder::new(cache)
+        let registry_client = RegistryClientBuilder::new(BaseClientBuilder::default(), cache)
             .allow_cross_origin_credentials()
             .build();
         let client = registry_client.cached_client().uncached();

crates/uv-client/tests/it/remote_metadata.rs

@@ -3,7 +3,7 @@ use std::str::FromStr;
 use anyhow::Result;
 
 use uv_cache::Cache;
-use uv_client::RegistryClientBuilder;
+use uv_client::{BaseClientBuilder, RegistryClientBuilder};
 use uv_distribution_filename::WheelFilename;
 use uv_distribution_types::{BuiltDist, DirectUrlBuiltDist, IndexCapabilities};
 use uv_pep508::VerbatimUrl;
@@ -12,7 +12,7 @@ use uv_redacted::DisplaySafeUrl;
 #[tokio::test]
 async fn remote_metadata_with_and_without_cache() -> Result<()> {
     let cache = Cache::temp()?.init()?;
-    let client = RegistryClientBuilder::new(cache).build();
+    let client = RegistryClientBuilder::new(BaseClientBuilder::default(), cache).build();
 
     // The first run is without cache (the tempdir is empty), the second has the cache from the
     // first run.

crates/uv-client/tests/it/user_agent_version.rs

@@ -12,8 +12,8 @@ use std::str::FromStr;
 use tokio::net::TcpListener;
 use url::Url;
 use uv_cache::Cache;
-use uv_client::LineHaul;
 use uv_client::RegistryClientBuilder;
+use uv_client::{BaseClientBuilder, LineHaul};
 use uv_pep508::{MarkerEnvironment, MarkerEnvironmentBuilder};
 use uv_platform_tags::{Arch, Os, Platform};
 use uv_redacted::DisplaySafeUrl;
@@ -52,7 +52,7 @@ async fn test_user_agent_has_version() -> Result<()> {
 
     // Initialize uv-client
     let cache = Cache::temp()?.init()?;
-    let client = RegistryClientBuilder::new(cache).build();
+    let client = RegistryClientBuilder::new(BaseClientBuilder::default(), cache).build();
 
     // Send request to our dummy server
     let url = DisplaySafeUrl::from_str(&format!("http://{addr}"))?;
@@ -128,7 +128,8 @@ async fn test_user_agent_has_linehaul() -> Result<()> {
 
     // Initialize uv-client
     let cache = Cache::temp()?.init()?;
-    let mut builder = RegistryClientBuilder::new(cache).markers(&markers);
+    let mut builder =
+        RegistryClientBuilder::new(BaseClientBuilder::default(), cache).markers(&markers);
 
     let linux = Platform::new(
         Os::Manylinux {

crates/uv-dev/src/validate_zip.rs

@@ -6,7 +6,7 @@ use futures::TryStreamExt;
 use tokio_util::compat::FuturesAsyncReadCompatExt;
 
 use uv_cache::{Cache, CacheArgs};
-use uv_client::RegistryClientBuilder;
+use uv_client::{BaseClientBuilder, RegistryClientBuilder};
 use uv_pep508::VerbatimUrl;
 use uv_pypi_types::ParsedUrl;
 
@@ -19,7 +19,7 @@ pub(crate) struct ValidateZipArgs {
 
 pub(crate) async fn validate_zip(args: ValidateZipArgs) -> Result<()> {
     let cache = Cache::try_from(args.cache_args)?.init()?;
-    let client = RegistryClientBuilder::new(cache).build();
+    let client = RegistryClientBuilder::new(BaseClientBuilder::default(), cache).build();
 
     let ParsedUrl::Archive(archive) = ParsedUrl::try_from(args.url.to_url())? else {
         bail!("Only archive URLs are supported");

crates/uv-dev/src/wheel_metadata.rs

@@ -5,7 +5,7 @@ use anyhow::{Result, bail};
 use clap::Parser;
 
 use uv_cache::{Cache, CacheArgs};
-use uv_client::RegistryClientBuilder;
+use uv_client::{BaseClientBuilder, RegistryClientBuilder};
 use uv_distribution_filename::WheelFilename;
 use uv_distribution_types::{BuiltDist, DirectUrlBuiltDist, IndexCapabilities, RemoteSource};
 use uv_pep508::VerbatimUrl;
@@ -20,7 +20,7 @@ pub(crate) struct WheelMetadataArgs {
 
 pub(crate) async fn wheel_metadata(args: WheelMetadataArgs) -> Result<()> {
     let cache = Cache::try_from(args.cache_args)?.init()?;
-    let client = RegistryClientBuilder::new(cache).build();
+    let client = RegistryClientBuilder::new(BaseClientBuilder::default(), cache).build();
     let capabilities = IndexCapabilities::default();
 
     let filename = WheelFilename::from_str(&args.url.filename()?)?;

crates/uv-publish/src/lib.rs

@@ -997,7 +997,7 @@ mod tests {
         project_urls: Source, https://github.com/unknown/tqdm
         "###);
 
-        let client = BaseClientBuilder::new().build();
+        let client = BaseClientBuilder::default().build();
         let (request, _) = build_request(
             &file,
             raw_filename,
@@ -1149,7 +1149,7 @@ mod tests {
         requires_dist: requests ; extra == 'telegram'
         "###);
 
-        let client = BaseClientBuilder::new().build();
+        let client = BaseClientBuilder::default().build();
         let (request, _) = build_request(
             &file,
             raw_filename,

crates/uv-requirements-txt/src/lib.rs

@@ -1406,7 +1406,7 @@ mod test {
         let actual = RequirementsTxt::parse(
             requirements_txt.clone(),
             &working_dir,
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap();
@@ -1455,10 +1455,13 @@ mod test {
         let requirements_txt = temp_dir.path().join(path);
         fs::write(&requirements_txt, contents).unwrap();
 
-        let actual =
-            RequirementsTxt::parse(&requirements_txt, &working_dir, &BaseClientBuilder::new())
-                .await
-                .unwrap();
+        let actual = RequirementsTxt::parse(
+            &requirements_txt,
+            &working_dir,
+            &BaseClientBuilder::default(),
+        )
+        .await
+        .unwrap();
 
         let snapshot = format!("line-endings-{}", path.to_string_lossy());
 
@@ -1477,10 +1480,13 @@ mod test {
         let working_dir = workspace_test_data_dir().join("requirements-txt");
         let requirements_txt = working_dir.join(path);
 
-        let actual =
-            RequirementsTxt::parse(requirements_txt, &working_dir, &BaseClientBuilder::new())
-                .await
-                .unwrap();
+        let actual = RequirementsTxt::parse(
+            requirements_txt,
+            &working_dir,
+            &BaseClientBuilder::default(),
+        )
+        .await
+        .unwrap();
 
         let snapshot = format!("parse-unix-{}", path.to_string_lossy());
 
@@ -1499,10 +1505,13 @@ mod test {
         let working_dir = workspace_test_data_dir().join("requirements-txt");
         let requirements_txt = working_dir.join(path);
 
-        let actual =
-            RequirementsTxt::parse(requirements_txt, &working_dir, &BaseClientBuilder::new())
-                .await
-                .unwrap_err();
+        let actual = RequirementsTxt::parse(
+            requirements_txt,
+            &working_dir,
+            &BaseClientBuilder::default(),
+        )
+        .await
+        .unwrap_err();
 
         let snapshot = format!("parse-unix-{}", path.to_string_lossy());
 
@@ -1521,10 +1530,13 @@ mod test {
         let working_dir = workspace_test_data_dir().join("requirements-txt");
         let requirements_txt = working_dir.join(path);
 
-        let actual =
-            RequirementsTxt::parse(requirements_txt, &working_dir, &BaseClientBuilder::new())
-                .await
-                .unwrap();
+        let actual = RequirementsTxt::parse(
+            requirements_txt,
+            &working_dir,
+            &BaseClientBuilder::default(),
+        )
+        .await
+        .unwrap();
 
         let snapshot = format!("parse-windows-{}", path.to_string_lossy());
 
@@ -1547,7 +1559,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1592,7 +1604,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1625,7 +1637,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1658,7 +1670,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1691,7 +1703,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1722,7 +1734,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1755,7 +1767,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1786,7 +1798,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1818,7 +1830,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1851,7 +1863,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -1894,7 +1906,7 @@ mod test {
         let requirements = RequirementsTxt::parse(
             parent_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap();
@@ -1958,7 +1970,7 @@ mod test {
         let requirements = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap();
@@ -2033,7 +2045,7 @@ mod test {
         let requirements = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap();
@@ -2135,7 +2147,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();
@@ -2183,7 +2195,7 @@ mod test {
         let requirements = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap();
@@ -2398,7 +2410,7 @@ mod test {
         let requirements = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap();
@@ -2740,7 +2752,7 @@ mod test {
         let error = RequirementsTxt::parse(
             requirements_txt.path(),
             temp_dir.path(),
-            &BaseClientBuilder::new(),
+            &BaseClientBuilder::default(),
         )
         .await
         .unwrap_err();

crates/uv-requirements/src/lib.rs

@@ -31,9 +31,6 @@ pub enum Error {
     #[error(transparent)]
     WheelFilename(#[from] uv_distribution_filename::WheelFilenameError),
 
-    #[error("Failed to construct HTTP client")]
-    ClientError(#[source] anyhow::Error),
-
     #[error(transparent)]
     Io(#[from] std::io::Error),
 }

crates/uv-requirements/src/upgrade.rs

@@ -41,7 +41,8 @@ pub async fn read_requirements_txt(
     let requirements_txt = RequirementsTxt::parse(
         output_file,
         &*CWD,
-        &BaseClientBuilder::new().connectivity(Connectivity::Offline),
+        // Pseudo-client for reading local-only requirements.
+        &BaseClientBuilder::default().connectivity(Connectivity::Offline),
     )
     .await?;
 

crates/uv/src/commands/build_frontend.rs

@@ -49,7 +49,7 @@ use crate::commands::pip::operations;
 use crate::commands::project::{ProjectError, find_requires_python};
 use crate::commands::reporters::PythonDownloadReporter;
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverSettings};
+use crate::settings::ResolverSettings;
 
 #[derive(Debug, Error)]
 enum Error {
@@ -114,7 +114,7 @@ pub(crate) async fn build_frontend(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     settings: &ResolverSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     no_config: bool,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
@@ -139,7 +139,7 @@ pub(crate) async fn build_frontend(
         python.as_deref(),
         install_mirrors,
         settings,
-        network_settings,
+        client_builder,
         no_config,
         python_preference,
         python_downloads,
@@ -182,7 +182,7 @@ async fn build_impl(
     python_request: Option<&str>,
     install_mirrors: PythonInstallMirrors,
     settings: &ResolverSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     no_config: bool,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
@@ -212,12 +212,6 @@ async fn build_impl(
         sources,
     } = settings;
 
-    let client_builder = BaseClientBuilder::default()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
     // Determine the source to build.
     let src = if let Some(src) = src {
         let src = std::path::absolute(src)?;
@@ -552,8 +546,7 @@ async fn build_package(
     );
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder.clone(), cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(index_strategy)
         .keyring(keyring_provider)

crates/uv/src/commands/pip/compile.rs

@@ -55,7 +55,6 @@ use crate::commands::pip::loggers::DefaultResolveLogger;
 use crate::commands::pip::{operations, resolution_environment};
 use crate::commands::{ExitStatus, OutputWriter, diagnostics};
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Resolve a set of requirements into a set of pinned versions.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -94,7 +93,7 @@ pub(crate) async fn pip_compile(
     torch_backend: Option<TorchMode>,
     dependency_metadata: DependencyMetadata,
     keyring_provider: KeyringProviderType,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     config_settings: ConfigSettings,
     config_settings_package: PackageConfigSettings,
     build_isolation: BuildIsolation,
@@ -195,12 +194,7 @@ pub(crate) async fn pip_compile(
         ));
     }
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(keyring_provider);
 
     // Read all requirements from the provided sources.
     let RequirementsSpecification {
@@ -420,8 +414,7 @@ pub(crate) async fn pip_compile(
         .transpose()?;
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder.clone(), cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(index_strategy)
         .torch_backend(torch_backend.clone())
@@ -559,7 +552,7 @@ pub(crate) async fn pip_compile(
     {
         Ok(resolution) => resolution,
         Err(err) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }

crates/uv/src/commands/pip/install.rs

@@ -47,7 +47,6 @@ use crate::commands::pip::operations::{report_interpreter, report_target_environ
 use crate::commands::pip::{operations, resolution_markers, resolution_tags};
 use crate::commands::{ExitStatus, diagnostics};
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Install packages into the current environment.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -70,7 +69,7 @@ pub(crate) async fn pip_install(
     torch_backend: Option<TorchMode>,
     dependency_metadata: DependencyMetadata,
     keyring_provider: KeyringProviderType,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     reinstall: Reinstall,
     link_mode: LinkMode,
     compile: bool,
@@ -111,12 +110,7 @@ pub(crate) async fn pip_install(
         );
     }
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(keyring_provider);
 
     // Read all requirements from the provided sources.
     let RequirementsSpecification {
@@ -383,8 +377,7 @@ pub(crate) async fn pip_install(
         .transpose()?;
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder.clone(), cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(index_strategy)
         .torch_backend(torch_backend.clone())
@@ -557,9 +550,11 @@ pub(crate) async fn pip_install(
         {
             Ok(graph) => Resolution::from(graph),
             Err(err) => {
-                return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
-                    .report(err)
-                    .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
+                return diagnostics::OperationDiagnostic::native_tls(
+                    client_builder.is_native_tls(),
+                )
+                .report(err)
+                .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
             }
         };
 
@@ -622,7 +617,7 @@ pub(crate) async fn pip_install(
     {
         Ok(..) => {}
         Err(err) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }

crates/uv/src/commands/pip/list.rs

@@ -34,7 +34,6 @@ use crate::commands::pip::latest::LatestClient;
 use crate::commands::pip::operations::report_target_environment;
 use crate::commands::reporters::LatestVersionReporter;
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Enumerate the installed packages in the current environment.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -47,7 +46,7 @@ pub(crate) async fn pip_list(
     index_locations: IndexLocations,
     index_strategy: IndexStrategy,
     keyring_provider: KeyringProviderType,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     concurrency: Concurrency,
     strict: bool,
     exclude_newer: ExcludeNewer,
@@ -88,21 +87,18 @@ pub(crate) async fn pip_list(
     let latest = if outdated && !results.is_empty() {
         let capabilities = IndexCapabilities::default();
 
-        let client_builder = BaseClientBuilder::new()
-            .retries_from_env()?
-            .connectivity(network_settings.connectivity)
-            .native_tls(network_settings.native_tls)
-            .keyring(keyring_provider)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone());
+        let client_builder = client_builder.clone().keyring(keyring_provider);
 
         // Initialize the registry client.
-        let client = RegistryClientBuilder::try_from(client_builder)?
-            .cache(cache.clone().with_refresh(Refresh::All(Timestamp::now())))
-            .index_locations(index_locations)
-            .index_strategy(index_strategy)
-            .markers(environment.interpreter().markers())
-            .platform(environment.interpreter().platform())
-            .build();
+        let client = RegistryClientBuilder::new(
+            client_builder,
+            cache.clone().with_refresh(Refresh::All(Timestamp::now())),
+        )
+        .index_locations(index_locations)
+        .index_strategy(index_strategy)
+        .markers(environment.interpreter().markers())
+        .platform(environment.interpreter().platform())
+        .build();
         let download_concurrency = Semaphore::new(concurrency.downloads);
 
         // Determine the platform tags.

crates/uv/src/commands/pip/sync.rs

@@ -45,7 +45,6 @@ use crate::commands::pip::operations::{report_interpreter, report_target_environ
 use crate::commands::pip::{operations, resolution_markers, resolution_tags};
 use crate::commands::{ExitStatus, diagnostics};
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Install a set of locked requirements into the current Python environment.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -64,7 +63,7 @@ pub(crate) async fn pip_sync(
     torch_backend: Option<TorchMode>,
     dependency_metadata: DependencyMetadata,
     keyring_provider: KeyringProviderType,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     allow_empty_requirements: bool,
     installer_metadata: bool,
     config_settings: &ConfigSettings,
@@ -99,12 +98,7 @@ pub(crate) async fn pip_sync(
         );
     }
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(keyring_provider);
 
     // Initialize a few defaults.
     let overrides = &[];
@@ -307,8 +301,7 @@ pub(crate) async fn pip_sync(
         .transpose()?;
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder.clone(), cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(index_strategy)
         .torch_backend(torch_backend.clone())
@@ -488,9 +481,11 @@ pub(crate) async fn pip_sync(
         {
             Ok(resolution) => Resolution::from(resolution),
             Err(err) => {
-                return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
-                    .report(err)
-                    .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
+                return diagnostics::OperationDiagnostic::native_tls(
+                    client_builder.is_native_tls(),
+                )
+                .report(err)
+                .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
             }
         };
 
@@ -553,7 +548,7 @@ pub(crate) async fn pip_sync(
     {
         Ok(_) => {}
         Err(err) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }

crates/uv/src/commands/pip/tree.rs

@@ -29,7 +29,6 @@ use crate::commands::pip::latest::LatestClient;
 use crate::commands::pip::operations::report_target_environment;
 use crate::commands::reporters::LatestVersionReporter;
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Display the installed packages in the current environment as a dependency tree.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -45,7 +44,7 @@ pub(crate) async fn pip_tree(
     index_locations: IndexLocations,
     index_strategy: IndexStrategy,
     keyring_provider: KeyringProviderType,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     concurrency: Concurrency,
     strict: bool,
     exclude_newer: ExcludeNewer,
@@ -88,21 +87,18 @@ pub(crate) async fn pip_tree(
     let latest = if outdated && !packages.is_empty() {
         let capabilities = IndexCapabilities::default();
 
-        let client_builder = BaseClientBuilder::new()
-            .retries_from_env()?
-            .connectivity(network_settings.connectivity)
-            .native_tls(network_settings.native_tls)
-            .keyring(keyring_provider)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone());
+        let client_builder = client_builder.keyring(keyring_provider);
 
         // Initialize the registry client.
-        let client = RegistryClientBuilder::try_from(client_builder)?
-            .cache(cache.clone().with_refresh(Refresh::All(Timestamp::now())))
-            .index_locations(index_locations)
-            .index_strategy(index_strategy)
-            .markers(environment.interpreter().markers())
-            .platform(environment.interpreter().platform())
-            .build();
+        let client = RegistryClientBuilder::new(
+            client_builder,
+            cache.clone().with_refresh(Refresh::All(Timestamp::now())),
+        )
+        .index_locations(index_locations)
+        .index_strategy(index_strategy)
+        .markers(environment.interpreter().markers())
+        .platform(environment.interpreter().platform())
+        .build();
         let download_concurrency = Semaphore::new(concurrency.downloads);
 
         // Determine the platform tags.

crates/uv/src/commands/pip/uninstall.rs

@@ -22,7 +22,6 @@ use uv_requirements::{RequirementsSource, RequirementsSpecification};
 use crate::commands::pip::operations::report_target_environment;
 use crate::commands::{ExitStatus, elapsed};
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Uninstall packages from the current environment.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -35,19 +34,14 @@ pub(crate) async fn pip_uninstall(
     prefix: Option<Prefix>,
     cache: Cache,
     keyring_provider: KeyringProviderType,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     dry_run: DryRun,
     printer: Printer,
     preview: Preview,
 ) -> Result<ExitStatus> {
     let start = std::time::Instant::now();
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(keyring_provider);
 
     // Read all requirements from the provided sources.
     let spec = RequirementsSpecification::from_simple_sources(sources, &client_builder).await?;

crates/uv/src/commands/project/add.rs

@@ -60,7 +60,7 @@ use crate::commands::project::{
 use crate::commands::reporters::{PythonDownloadReporter, ResolverReporter};
 use crate::commands::{ExitStatus, ScriptPath, diagnostics, project};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverInstallerSettings};
+use crate::settings::ResolverInstallerSettings;
 
 /// Add one or more packages to the project requirements.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -90,7 +90,7 @@ pub(crate) async fn add(
     workspace: Option<bool>,
     install_mirrors: PythonInstallMirrors,
     settings: ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     script: Option<ScriptPath>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
@@ -191,12 +191,6 @@ pub(crate) async fn add(
             );
         }
 
-        let client_builder = BaseClientBuilder::new()
-            .retries_from_env()?
-            .connectivity(network_settings.connectivity)
-            .native_tls(network_settings.native_tls)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
         // If we found a script, add to the existing metadata. Otherwise, create a new inline
         // metadata tag.
         let script = match script {
@@ -227,7 +221,7 @@ pub(crate) async fn add(
         let interpreter = ScriptInterpreter::discover(
             (&script).into(),
             python.as_deref().map(PythonRequest::parse),
-            &network_settings,
+            &client_builder,
             python_preference,
             python_downloads,
             &install_mirrors,
@@ -297,7 +291,7 @@ pub(crate) async fn add(
                 project_dir,
                 &defaulted_groups,
                 python.as_deref().map(PythonRequest::parse),
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -319,7 +313,7 @@ pub(crate) async fn add(
                 &defaulted_groups,
                 python.as_deref().map(PythonRequest::parse),
                 &install_mirrors,
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 no_sync,
@@ -345,12 +339,9 @@ pub(crate) async fn add(
         })
         .ok();
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(settings.resolver.keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder
+        .clone()
+        .keyring(settings.resolver.keyring_provider);
 
     // Read the requirements.
     let RequirementsSpecification {
@@ -400,7 +391,7 @@ pub(crate) async fn add(
             let sources = SourceStrategy::Enabled;
 
             // Initialize the registry client.
-            let client = RegistryClientBuilder::try_from(client_builder)?
+            let client = RegistryClientBuilder::new(client_builder.clone(), cache.clone())
                 .index_locations(settings.resolver.index_locations.clone())
                 .index_strategy(settings.resolver.index_strategy)
                 .markers(target.interpreter().markers())
@@ -745,7 +736,7 @@ pub(crate) async fn add(
         bounds,
         constraints,
         &settings,
-        &network_settings,
+        &client_builder,
         installer_metadata,
         concurrency,
         cache,
@@ -760,7 +751,7 @@ pub(crate) async fn add(
                 let _ = snapshot.revert();
             }
             match err {
-                ProjectError::Operation(err) => diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls).with_hint(format!("If you want to add the package regardless of the failed resolution, provide the `{}` flag to skip locking and syncing.", "--frozen".green()))
+                ProjectError::Operation(err) => diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls()).with_hint(format!("If you want to add the package regardless of the failed resolution, provide the `{}` flag to skip locking and syncing.", "--frozen".green()))
                     .report(err)
                     .map_or(Ok(ExitStatus::Failure), |err| Err(err.into())),
                 err => Err(err.into()),
@@ -976,7 +967,7 @@ async fn lock_and_sync(
     bound_kind: Option<AddBoundsKind>,
     constraints: Vec<NameRequirementSpecification>,
     settings: &ResolverInstallerSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     installer_metadata: bool,
     concurrency: Concurrency,
     cache: &Cache,
@@ -990,7 +981,7 @@ async fn lock_and_sync(
             LockMode::Write(target.interpreter())
         },
         &settings.resolver,
-        network_settings,
+        client_builder,
         &lock_state,
         Box::new(DefaultResolveLogger),
         concurrency,
@@ -1112,7 +1103,7 @@ async fn lock_and_sync(
                     LockMode::Write(target.interpreter())
                 },
                 &settings.resolver,
-                network_settings,
+                client_builder,
                 &lock_state,
                 Box::new(SummaryResolveLogger),
                 concurrency,
@@ -1165,7 +1156,7 @@ async fn lock_and_sync(
         Modifications::Sufficient,
         None,
         settings.into(),
-        network_settings,
+        client_builder,
         &sync_state,
         Box::new(DefaultInstallLogger),
         installer_metadata,

crates/uv/src/commands/project/environment.rs

@@ -8,10 +8,11 @@ use crate::commands::project::{
     EnvironmentSpecification, PlatformState, ProjectError, resolve_environment, sync_environment,
 };
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverInstallerSettings};
+use crate::settings::ResolverInstallerSettings;
 
 use uv_cache::{Cache, CacheBucket};
 use uv_cache_key::{cache_digest, hash_digest};
+use uv_client::BaseClientBuilder;
 use uv_configuration::{Concurrency, Constraints, TargetTriple};
 use uv_distribution_types::{Name, Resolution};
 use uv_fs::PythonExt;
@@ -113,7 +114,7 @@ impl CachedEnvironment {
         interpreter: &Interpreter,
         python_platform: Option<&TargetTriple>,
         settings: &ResolverInstallerSettings,
-        network_settings: &NetworkSettings,
+        client_builder: &BaseClientBuilder<'_>,
         state: &PlatformState,
         resolve: Box<dyn ResolveLogger>,
         install: Box<dyn InstallLogger>,
@@ -133,7 +134,7 @@ impl CachedEnvironment {
                 python_platform,
                 build_constraints.clone(),
                 &settings.resolver,
-                network_settings,
+                client_builder,
                 state,
                 resolve,
                 concurrency,
@@ -201,7 +202,7 @@ impl CachedEnvironment {
             Modifications::Exact,
             build_constraints,
             settings.into(),
-            network_settings,
+            client_builder,
             state,
             install,
             installer_metadata,

crates/uv/src/commands/project/export.rs

@@ -7,6 +7,7 @@ use itertools::Itertools;
 use owo_colors::OwoColorize;
 
 use uv_cache::Cache;
+use uv_client::BaseClientBuilder;
 use uv_configuration::{
     Concurrency, DependencyGroups, EditableMode, ExportFormat, ExtrasSpecification, InstallOptions,
 };
@@ -29,7 +30,7 @@ use crate::commands::project::{
 };
 use crate::commands::{ExitStatus, OutputWriter, diagnostics};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverSettings};
+use crate::settings::ResolverSettings;
 
 #[derive(Debug, Clone)]
 #[allow(clippy::large_enum_variant)]
@@ -72,7 +73,7 @@ pub(crate) async fn export(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     settings: ResolverSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     concurrency: Concurrency,
@@ -134,7 +135,7 @@ pub(crate) async fn export(
             ExportTarget::Script(script) => ScriptInterpreter::discover(
                 script.into(),
                 python.as_deref().map(PythonRequest::parse),
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -152,7 +153,7 @@ pub(crate) async fn export(
                 project_dir,
                 &groups,
                 python.as_deref().map(PythonRequest::parse),
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -189,7 +190,7 @@ pub(crate) async fn export(
     let lock = match LockOperation::new(
         mode,
         &settings,
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultResolveLogger),
         concurrency,
@@ -203,7 +204,7 @@ pub(crate) async fn export(
     {
         Ok(result) => result.into_lock(),
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }

crates/uv/src/commands/project/format.rs

@@ -16,7 +16,6 @@ use crate::child::run_to_completion;
 use crate::commands::ExitStatus;
 use crate::commands::reporters::BinaryDownloadReporter;
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Run the formatter.
 pub(crate) async fn format(
@@ -25,7 +24,7 @@ pub(crate) async fn format(
     diff: bool,
     extra_args: Vec<String>,
     version: Option<String>,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     cache: Cache,
     printer: Printer,
     preview: Preview,
@@ -46,12 +45,7 @@ pub(crate) async fn format(
     // Parse version if provided
     let version = version.as_deref().map(Version::from_str).transpose()?;
 
-    let client = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone())
-        .build();
+    let client = client_builder.build();
 
     // Get the path to Ruff, downloading it if necessary
     let reporter = BinaryDownloadReporter::single(printer);

crates/uv/src/commands/project/init.rs

@@ -36,7 +36,6 @@ use crate::commands::ExitStatus;
 use crate::commands::project::{find_requires_python, init_script_python_requirement};
 use crate::commands::reporters::PythonDownloadReporter;
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Add one or more packages to the project requirements.
 #[allow(clippy::single_match_else, clippy::fn_params_excessive_bools)]
@@ -57,7 +56,7 @@ pub(crate) async fn init(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     no_workspace: bool,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     no_config: bool,
@@ -75,7 +74,7 @@ pub(crate) async fn init(
                 path,
                 python,
                 install_mirrors,
-                network_settings,
+                client_builder,
                 python_preference,
                 python_downloads,
                 cache,
@@ -145,7 +144,7 @@ pub(crate) async fn init(
                 python,
                 install_mirrors,
                 no_workspace,
-                network_settings,
+                client_builder,
                 python_preference,
                 python_downloads,
                 no_config,
@@ -191,7 +190,7 @@ async fn init_script(
     script_path: &Path,
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     cache: &Cache,
@@ -216,11 +215,6 @@ async fn init_script(
     if package {
         warn_user_once!("`--package` is a no-op for Python scripts, which are standalone");
     }
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
 
     let reporter = PythonDownloadReporter::single(printer);
 
@@ -257,7 +251,7 @@ async fn init_script(
         python_preference,
         python_downloads,
         no_config,
-        &client_builder,
+        client_builder,
         cache,
         &reporter,
         preview,
@@ -291,7 +285,7 @@ async fn init_project(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     no_workspace: bool,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     no_config: bool,
@@ -347,11 +341,6 @@ async fn init_project(
     };
 
     let reporter = PythonDownloadReporter::single(printer);
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
 
     // First, determine if there is an request for Python
     let python_request = if let Some(request) = python {
@@ -432,7 +421,7 @@ async fn init_project(
                         EnvironmentPreference::OnlySystem,
                         python_preference,
                         python_downloads,
-                        &client_builder,
+                        client_builder,
                         cache,
                         Some(&reporter),
                         install_mirrors.python_install_mirror.as_deref(),
@@ -460,7 +449,7 @@ async fn init_project(
                     EnvironmentPreference::OnlySystem,
                     python_preference,
                     python_downloads,
-                    &client_builder,
+                    client_builder,
                     cache,
                     Some(&reporter),
                     install_mirrors.python_install_mirror.as_deref(),
@@ -527,7 +516,7 @@ async fn init_project(
                 EnvironmentPreference::OnlySystem,
                 python_preference,
                 python_downloads,
-                &client_builder,
+                client_builder,
                 cache,
                 Some(&reporter),
                 install_mirrors.python_install_mirror.as_deref(),
@@ -555,7 +544,7 @@ async fn init_project(
             EnvironmentPreference::OnlySystem,
             python_preference,
             python_downloads,
-            &client_builder,
+            client_builder,
             cache,
             Some(&reporter),
             install_mirrors.python_install_mirror.as_deref(),

crates/uv/src/commands/project/lock.rs

@@ -48,7 +48,7 @@ use crate::commands::project::{
 use crate::commands::reporters::{PythonDownloadReporter, ResolverReporter};
 use crate::commands::{ExitStatus, ScriptPath, diagnostics, pip};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverSettings};
+use crate::settings::ResolverSettings;
 
 /// The result of running a lock operation.
 #[derive(Debug, Clone)]
@@ -86,7 +86,7 @@ pub(crate) async fn lock(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     settings: ResolverSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     script: Option<ScriptPath>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
@@ -99,11 +99,6 @@ pub(crate) async fn lock(
     // If necessary, initialize the PEP 723 script.
     let script = match script {
         Some(ScriptPath::Path(path)) => {
-            let client_builder = BaseClientBuilder::new()
-                .retries_from_env()?
-                .connectivity(network_settings.connectivity)
-                .native_tls(network_settings.native_tls)
-                .allow_insecure_host(network_settings.allow_insecure_host.clone());
             let reporter = PythonDownloadReporter::single(printer);
             let requires_python = init_script_python_requirement(
                 python.as_deref(),
@@ -149,7 +144,7 @@ pub(crate) async fn lock(
                 // Don't enable any groups' requires-python for interpreter discovery
                 &DependencyGroupsWithDefaults::none(),
                 python.as_deref().map(PythonRequest::parse),
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -165,7 +160,7 @@ pub(crate) async fn lock(
             LockTarget::Script(script) => ScriptInterpreter::discover(
                 script.into(),
                 python.as_deref().map(PythonRequest::parse),
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -196,7 +191,7 @@ pub(crate) async fn lock(
     match LockOperation::new(
         mode,
         &settings,
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultResolveLogger),
         concurrency,
@@ -240,7 +235,7 @@ pub(crate) async fn lock(
             Ok(ExitStatus::Failure)
         }
         Err(ProjectError::Operation(err)) => {
-            diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()))
         }
@@ -265,7 +260,7 @@ pub(super) struct LockOperation<'env> {
     mode: LockMode<'env>,
     constraints: Vec<NameRequirementSpecification>,
     settings: &'env ResolverSettings,
-    network_settings: &'env NetworkSettings,
+    client_builder: &'env BaseClientBuilder<'env>,
     state: &'env UniversalState,
     logger: Box<dyn ResolveLogger>,
     concurrency: Concurrency,
@@ -280,7 +275,7 @@ impl<'env> LockOperation<'env> {
     pub(super) fn new(
         mode: LockMode<'env>,
         settings: &'env ResolverSettings,
-        network_settings: &'env NetworkSettings,
+        client_builder: &'env BaseClientBuilder<'env>,
         state: &'env UniversalState,
         logger: Box<dyn ResolveLogger>,
         concurrency: Concurrency,
@@ -293,7 +288,7 @@ impl<'env> LockOperation<'env> {
             mode,
             constraints: vec![],
             settings,
-            network_settings,
+            client_builder,
             state,
             logger,
             concurrency,
@@ -339,7 +334,7 @@ impl<'env> LockOperation<'env> {
                     Some(existing),
                     self.constraints,
                     self.settings,
-                    self.network_settings,
+                    self.client_builder,
                     self.state,
                     self.logger,
                     self.concurrency,
@@ -381,7 +376,7 @@ impl<'env> LockOperation<'env> {
                     existing,
                     self.constraints,
                     self.settings,
-                    self.network_settings,
+                    self.client_builder,
                     self.state,
                     self.logger,
                     self.concurrency,
@@ -412,7 +407,7 @@ async fn do_lock(
     existing_lock: Option<Lock>,
     external: Vec<NameRequirementSpecification>,
     settings: &ResolverSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     state: &UniversalState,
     logger: Box<dyn ResolveLogger>,
     concurrency: Concurrency,
@@ -621,12 +616,7 @@ async fn do_lock(
         PythonRequirement::from_requires_python(interpreter, requires_python.clone());
 
     // Initialize the client.
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(*keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(*keyring_provider);
 
     for index in target.indexes() {
         if let Some(credentials) = index.credentials() {
@@ -639,8 +629,7 @@ async fn do_lock(
     }
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder, cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(*index_strategy)
         .markers(interpreter.markers())

crates/uv/src/commands/project/mod.rs

@@ -57,9 +57,7 @@ use crate::commands::project::install_target::InstallTarget;
 use crate::commands::reporters::{PythonDownloadReporter, ResolverReporter};
 use crate::commands::{capitalize, conjunction, pip};
 use crate::printer::Printer;
-use crate::settings::{
-    InstallerSettingsRef, NetworkSettings, ResolverInstallerSettings, ResolverSettings,
-};
+use crate::settings::{InstallerSettingsRef, ResolverInstallerSettings, ResolverSettings};
 
 pub(crate) mod add;
 pub(crate) mod environment;
@@ -652,7 +650,7 @@ impl ScriptInterpreter {
     pub(crate) async fn discover(
         script: Pep723ItemRef<'_>,
         python_request: Option<PythonRequest>,
-        network_settings: &NetworkSettings,
+        client_builder: &BaseClientBuilder<'_>,
         python_preference: PythonPreference,
         python_downloads: PythonDownloads,
         install_mirrors: &PythonInstallMirrors,
@@ -702,12 +700,6 @@ impl ScriptInterpreter {
             Err(err) => warn!("Ignoring existing script environment: {err}"),
         }
 
-        let client_builder = BaseClientBuilder::new()
-            .retries_from_env()?
-            .connectivity(network_settings.connectivity)
-            .native_tls(network_settings.native_tls)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
         let reporter = PythonDownloadReporter::single(printer);
 
         let interpreter = PythonInstallation::find_or_download(
@@ -715,7 +707,7 @@ impl ScriptInterpreter {
             EnvironmentPreference::Any,
             python_preference,
             python_downloads,
-            &client_builder,
+            client_builder,
             cache,
             Some(&reporter),
             install_mirrors.python_install_mirror.as_deref(),
@@ -892,7 +884,7 @@ impl ProjectInterpreter {
         project_dir: &Path,
         groups: &DependencyGroupsWithDefaults,
         python_request: Option<PythonRequest>,
-        network_settings: &NetworkSettings,
+        client_builder: &BaseClientBuilder<'_>,
         python_preference: PythonPreference,
         python_downloads: PythonDownloads,
         install_mirrors: &PythonInstallMirrors,
@@ -986,12 +978,6 @@ impl ProjectInterpreter {
             Err(err) => return Err(err.into()),
         }
 
-        let client_builder = BaseClientBuilder::default()
-            .retries_from_env()?
-            .connectivity(network_settings.connectivity)
-            .native_tls(network_settings.native_tls)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
         let reporter = PythonDownloadReporter::single(printer);
 
         // Locate the Python interpreter to use in the environment.
@@ -1000,7 +986,7 @@ impl ProjectInterpreter {
             EnvironmentPreference::OnlySystem,
             python_preference,
             python_downloads,
-            &client_builder,
+            client_builder,
             cache,
             Some(&reporter),
             install_mirrors.python_install_mirror.as_deref(),
@@ -1274,7 +1260,7 @@ impl ProjectEnvironment {
         groups: &DependencyGroupsWithDefaults,
         python: Option<PythonRequest>,
         install_mirrors: &PythonInstallMirrors,
-        network_settings: &NetworkSettings,
+        client_builder: &BaseClientBuilder<'_>,
         python_preference: PythonPreference,
         python_downloads: PythonDownloads,
         no_sync: bool,
@@ -1303,7 +1289,7 @@ impl ProjectEnvironment {
             workspace.install_path().as_ref(),
             groups,
             python,
-            network_settings,
+            client_builder,
             python_preference,
             python_downloads,
             install_mirrors,
@@ -1505,7 +1491,7 @@ impl ScriptEnvironment {
     pub(crate) async fn get_or_init(
         script: Pep723ItemRef<'_>,
         python_request: Option<PythonRequest>,
-        network_settings: &NetworkSettings,
+        client_builder: &BaseClientBuilder<'_>,
         python_preference: PythonPreference,
         python_downloads: PythonDownloads,
         install_mirrors: &PythonInstallMirrors,
@@ -1532,7 +1518,7 @@ impl ScriptEnvironment {
         match ScriptInterpreter::discover(
             script,
             python_request,
-            network_settings,
+            client_builder,
             python_preference,
             python_downloads,
             install_mirrors,
@@ -1670,7 +1656,7 @@ pub(crate) async fn resolve_names(
     requirements: Vec<UnresolvedRequirementSpecification>,
     interpreter: &Interpreter,
     settings: &ResolverInstallerSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     state: &SharedState,
     concurrency: Concurrency,
     cache: &Cache,
@@ -1720,17 +1706,10 @@ pub(crate) async fn resolve_names(
         reinstall: _,
     } = settings;
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()
-        .map_err(|err| uv_requirements::Error::ClientError(err.into()))?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(*keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(*keyring_provider);
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder, cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(*index_strategy)
         .markers(interpreter.markers())
@@ -1850,7 +1829,7 @@ pub(crate) async fn resolve_environment(
     python_platform: Option<&TargetTriple>,
     build_constraints: Constraints,
     settings: &ResolverSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     state: &PlatformState,
     logger: Box<dyn ResolveLogger>,
     concurrency: Concurrency,
@@ -1890,12 +1869,7 @@ pub(crate) async fn resolve_environment(
         ..
     } = spec.requirements;
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(*keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(*keyring_provider);
 
     // Determine the tags, markers, and interpreter to use for resolution.
     let tags = pip::resolution_tags(None, python_platform, interpreter)?;
@@ -1903,8 +1877,7 @@ pub(crate) async fn resolve_environment(
     let python_requirement = PythonRequirement::from_interpreter(interpreter);
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder, cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(*index_strategy)
         .markers(interpreter.markers())
@@ -2045,7 +2018,7 @@ pub(crate) async fn sync_environment(
     modifications: Modifications,
     build_constraints: Constraints,
     settings: InstallerSettingsRef<'_>,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     state: &PlatformState,
     logger: Box<dyn InstallLogger>,
     installer_metadata: bool,
@@ -2072,12 +2045,7 @@ pub(crate) async fn sync_environment(
         sources,
     } = settings;
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(keyring_provider);
 
     let site_packages = SitePackages::from_environment(&venv)?;
 
@@ -2086,8 +2054,7 @@ pub(crate) async fn sync_environment(
     let tags = venv.interpreter().tags()?;
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder, cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(index_strategy)
         .markers(interpreter.markers())
@@ -2206,7 +2173,7 @@ pub(crate) async fn update_environment(
     build_constraints: Constraints,
     extra_build_requires: ExtraBuildRequires,
     settings: &ResolverInstallerSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     state: &SharedState,
     resolve: Box<dyn ResolveLogger>,
     install: Box<dyn InstallLogger>,
@@ -2245,12 +2212,7 @@ pub(crate) async fn update_environment(
         reinstall,
     } = settings;
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(*keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(*keyring_provider);
 
     // Respect all requirements from the provided sources.
     let RequirementsSpecification {
@@ -2313,8 +2275,7 @@ pub(crate) async fn update_environment(
     }
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder, cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(*index_strategy)
         .markers(interpreter.markers())

crates/uv/src/commands/project/remove.rs

@@ -8,6 +8,7 @@ use owo_colors::OwoColorize;
 use tracing::{debug, warn};
 
 use uv_cache::Cache;
+use uv_client::BaseClientBuilder;
 use uv_configuration::{
     Concurrency, DependencyGroups, DryRun, EditableMode, ExtrasSpecification, InstallOptions,
 };
@@ -35,7 +36,7 @@ use crate::commands::project::{
 };
 use crate::commands::{ExitStatus, diagnostics, project};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverInstallerSettings};
+use crate::settings::ResolverInstallerSettings;
 
 /// Remove one or more packages from the project requirements.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -51,7 +52,7 @@ pub(crate) async fn remove(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     settings: ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     script: Option<Pep723Script>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
@@ -220,7 +221,7 @@ pub(crate) async fn remove(
                     project_dir,
                     &groups,
                     python.as_deref().map(PythonRequest::parse),
-                    &network_settings,
+                    &client_builder,
                     python_preference,
                     python_downloads,
                     &install_mirrors,
@@ -242,7 +243,7 @@ pub(crate) async fn remove(
                     &groups,
                     python.as_deref().map(PythonRequest::parse),
                     &install_mirrors,
-                    &network_settings,
+                    &client_builder,
                     python_preference,
                     python_downloads,
                     no_sync,
@@ -263,7 +264,7 @@ pub(crate) async fn remove(
             let interpreter = ScriptInterpreter::discover(
                 (&script).into(),
                 python.as_deref().map(PythonRequest::parse),
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -303,7 +304,7 @@ pub(crate) async fn remove(
     let lock = match project::lock::LockOperation::new(
         mode,
         &settings.resolver,
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultResolveLogger),
         concurrency,
@@ -317,7 +318,7 @@ pub(crate) async fn remove(
     {
         Ok(result) => result.into_lock(),
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }
@@ -359,7 +360,7 @@ pub(crate) async fn remove(
         Modifications::Exact,
         None,
         (&settings).into(),
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultInstallLogger),
         installer_metadata,
@@ -374,7 +375,7 @@ pub(crate) async fn remove(
     {
         Ok(()) => {}
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }

crates/uv/src/commands/project/run.rs

@@ -72,7 +72,7 @@ use crate::commands::project::{
 use crate::commands::reporters::PythonDownloadReporter;
 use crate::commands::{ExitStatus, diagnostics, project};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverInstallerSettings, ResolverSettings};
+use crate::settings::{ResolverInstallerSettings, ResolverSettings};
 
 /// Run a command.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -99,7 +99,7 @@ pub(crate) async fn run(
     python_platform: Option<TargetTriple>,
     install_mirrors: PythonInstallMirrors,
     settings: ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     installer_metadata: bool,
@@ -240,7 +240,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
             let environment = ScriptEnvironment::get_or_init(
                 (&script).into(),
                 python.as_deref().map(PythonRequest::parse),
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -276,7 +276,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
             let lock = match project::lock::LockOperation::new(
                 mode,
                 &settings.resolver,
-                &network_settings,
+                &client_builder,
                 &lock_state,
                 if show_resolution {
                     Box::new(DefaultResolveLogger)
@@ -295,7 +295,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                 Ok(result) => result.into_lock(),
                 Err(ProjectError::Operation(err)) => {
                     return diagnostics::OperationDiagnostic::native_tls(
-                        network_settings.native_tls,
+                        client_builder.is_native_tls(),
                     )
                     .with_context("script")
                     .report(err)
@@ -322,7 +322,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                 modifications,
                 python_platform.as_ref(),
                 (&settings).into(),
-                &network_settings,
+                &client_builder,
                 &sync_state,
                 if show_resolution {
                     Box::new(DefaultInstallLogger)
@@ -342,7 +342,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                 Ok(()) => {}
                 Err(ProjectError::Operation(err)) => {
                     return diagnostics::OperationDiagnostic::native_tls(
-                        network_settings.native_tls,
+                        client_builder.is_native_tls(),
                     )
                     .with_context("script")
                     .report(err)
@@ -378,7 +378,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                 let environment = ScriptEnvironment::get_or_init(
                     (&script).into(),
                     python.as_deref().map(PythonRequest::parse),
-                    &network_settings,
+                    &client_builder,
                     python_preference,
                     python_downloads,
                     &install_mirrors,
@@ -426,7 +426,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                     build_constraints.unwrap_or_default(),
                     script_extra_build_requires,
                     &settings,
-                    &network_settings,
+                    &client_builder,
                     &sync_state,
                     if show_resolution {
                         Box::new(DefaultResolveLogger)
@@ -451,7 +451,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                     Ok(update) => Some(update.into_environment().into_interpreter()),
                     Err(ProjectError::Operation(err)) => {
                         return diagnostics::OperationDiagnostic::native_tls(
-                            network_settings.native_tls,
+                            client_builder.is_native_tls(),
                         )
                         .with_context("script")
                         .report(err)
@@ -464,7 +464,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                 let interpreter = ScriptInterpreter::discover(
                     (&script).into(),
                     python.as_deref().map(PythonRequest::parse),
-                    &network_settings,
+                    &client_builder,
                     python_preference,
                     python_downloads,
                     &install_mirrors,
@@ -636,11 +636,6 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
 
                 // If we're isolating the environment, use an ephemeral virtual environment as the
                 // base environment for the project.
-                let client_builder = BaseClientBuilder::new()
-                    .retries_from_env()?
-                    .connectivity(network_settings.connectivity)
-                    .native_tls(network_settings.native_tls)
-                    .allow_insecure_host(network_settings.allow_insecure_host.clone());
 
                 // Resolve the Python request and requirement for the workspace.
                 let WorkspacePython {
@@ -703,7 +698,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                     &groups,
                     python.as_deref().map(PythonRequest::parse),
                     &install_mirrors,
-                    &network_settings,
+                    &client_builder,
                     python_preference,
                     python_downloads,
                     no_sync,
@@ -754,7 +749,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                 let result = match project::lock::LockOperation::new(
                     mode,
                     &settings.resolver,
-                    &network_settings,
+                    &client_builder,
                     &lock_state,
                     if show_resolution {
                         Box::new(DefaultResolveLogger)
@@ -773,7 +768,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                     Ok(result) => result,
                     Err(ProjectError::Operation(err)) => {
                         return diagnostics::OperationDiagnostic::native_tls(
-                            network_settings.native_tls,
+                            client_builder.is_native_tls(),
                         )
                         .report(err)
                         .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
@@ -841,7 +836,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                     modifications,
                     python_platform.as_ref(),
                     (&settings).into(),
-                    &network_settings,
+                    &client_builder,
                     &sync_state,
                     if show_resolution {
                         Box::new(DefaultInstallLogger)
@@ -861,7 +856,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                     Ok(()) => {}
                     Err(ProjectError::Operation(err)) => {
                         return diagnostics::OperationDiagnostic::native_tls(
-                            network_settings.native_tls,
+                            client_builder.is_native_tls(),
                         )
                         .report(err)
                         .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
@@ -880,12 +875,6 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
             debug!("No project found; searching for Python interpreter");
 
             let interpreter = {
-                let client_builder = BaseClientBuilder::new()
-                    .retries_from_env()?
-                    .connectivity(network_settings.connectivity)
-                    .native_tls(network_settings.native_tls)
-                    .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
                 // (1) Explicit request from user
                 let python_request = if let Some(request) = python.as_deref() {
                     Some(PythonRequest::parse(request))
@@ -951,12 +940,6 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
     let spec = if requirements.is_empty() {
         None
     } else {
-        let client_builder = BaseClientBuilder::new()
-            .retries_from_env()?
-            .connectivity(network_settings.connectivity)
-            .native_tls(network_settings.native_tls)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
         let spec =
             RequirementsSpecification::from_simple_sources(&requirements, &client_builder).await?;
 
@@ -1002,7 +985,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                 &base_interpreter,
                 python_platform.as_ref(),
                 &settings,
-                &network_settings,
+                &client_builder,
                 &sync_state,
                 if show_resolution {
                     Box::new(DefaultResolveLogger)
@@ -1026,7 +1009,7 @@ hint: If you are running a script with `{}` in the shebang, you may need to incl
                 Ok(resolution) => resolution,
                 Err(ProjectError::Operation(err)) => {
                     return diagnostics::OperationDiagnostic::native_tls(
-                        network_settings.native_tls,
+                        client_builder.is_native_tls(),
                     )
                     .with_context("`--with`")
                     .report(err)
@@ -1660,7 +1643,7 @@ impl std::fmt::Display for RunCommand {
 /// Resolve a GitHub Gist URL to its raw file URL using the GitHub API.
 async fn resolve_gist_url(
     url: &DisplaySafeUrl,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
 ) -> anyhow::Result<DisplaySafeUrl> {
     // Extract the Gist ID from the URL.
     let gist_id = url
@@ -1671,12 +1654,7 @@ async fn resolve_gist_url(
     // Build the API URL.
     let api_url = format!("https://api.github.com/gists/{gist_id}");
 
-    let client = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone())
-        .build();
+    let client = client_builder.build();
 
     // Build the request with appropriate headers.
     let api_url_parsed = DisplaySafeUrl::parse(&api_url)?;
@@ -1722,7 +1700,7 @@ impl RunCommand {
     #[allow(clippy::fn_params_excessive_bools)]
     pub(crate) async fn from_args(
         command: &ExternalCommand,
-        network_settings: NetworkSettings,
+        client_builder: BaseClientBuilder<'_>,
         module: bool,
         script: bool,
         gui_script: bool,
@@ -1758,7 +1736,7 @@ impl RunCommand {
 
                 // If it's a Gist URL, use the GitHub API to get the raw URL.
                 if url.host_str() == Some("gist.github.com") {
-                    url = resolve_gist_url(&url, &network_settings).await?;
+                    url = resolve_gist_url(&url, &client_builder).await?;
                 }
 
                 let file_stem = url
@@ -1771,12 +1749,7 @@ impl RunCommand {
                     .suffix(".py")
                     .tempfile()?;
 
-                let client = BaseClientBuilder::new()
-                    .retries_from_env()?
-                    .connectivity(network_settings.connectivity)
-                    .native_tls(network_settings.native_tls)
-                    .allow_insecure_host(network_settings.allow_insecure_host.clone())
-                    .build();
+                let client = client_builder.build();
                 let response = client
                     .for_host(&url)
                     .get(Url::from(url.clone()))

crates/uv/src/commands/project/sync.rs

@@ -50,9 +50,7 @@ use crate::commands::project::{
 };
 use crate::commands::{ExitStatus, diagnostics};
 use crate::printer::Printer;
-use crate::settings::{
-    InstallerSettingsRef, NetworkSettings, ResolverInstallerSettings, ResolverSettings,
-};
+use crate::settings::{InstallerSettingsRef, ResolverInstallerSettings, ResolverSettings};
 
 /// Sync the project environment.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -75,7 +73,7 @@ pub(crate) async fn sync(
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     settings: ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     script: Option<Pep723Script>,
     installer_metadata: bool,
     concurrency: Concurrency,
@@ -154,7 +152,7 @@ pub(crate) async fn sync(
                 &groups,
                 python.as_deref().map(PythonRequest::parse),
                 &install_mirrors,
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 false,
@@ -171,7 +169,7 @@ pub(crate) async fn sync(
             ScriptEnvironment::get_or_init(
                 script.into(),
                 python.as_deref().map(PythonRequest::parse),
-                &network_settings,
+                &client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -257,7 +255,7 @@ pub(crate) async fn sync(
                 build_constraints.unwrap_or_default(),
                 script_extra_build_requires,
                 &settings,
-                &network_settings,
+                &client_builder,
                 &PlatformState::default(),
                 Box::new(DefaultResolveLogger),
                 Box::new(DefaultInstallLogger),
@@ -290,7 +288,7 @@ pub(crate) async fn sync(
                 // TODO(zanieb): We should respect `--output-format json` for the error case
                 Err(ProjectError::Operation(err)) => {
                     return diagnostics::OperationDiagnostic::native_tls(
-                        network_settings.native_tls,
+                        client_builder.is_native_tls(),
                     )
                     .report(err)
                     .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
@@ -322,7 +320,7 @@ pub(crate) async fn sync(
     let outcome = match LockOperation::new(
         mode,
         &settings.resolver,
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultResolveLogger),
         concurrency,
@@ -336,7 +334,7 @@ pub(crate) async fn sync(
     {
         Ok(result) => Outcome::Success(result),
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }
@@ -393,7 +391,7 @@ pub(crate) async fn sync(
         modifications,
         python_platform.as_ref(),
         (&settings).into(),
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultInstallLogger),
         installer_metadata,
@@ -408,7 +406,7 @@ pub(crate) async fn sync(
     {
         Ok(()) => {}
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }
@@ -566,7 +564,7 @@ pub(super) async fn do_sync(
     modifications: Modifications,
     python_platform: Option<&TargetTriple>,
     settings: InstallerSettingsRef<'_>,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     state: &PlatformState,
     logger: Box<dyn InstallLogger>,
     installer_metadata: bool,
@@ -643,12 +641,7 @@ pub(super) async fn do_sync(
     }
     .into_inner();
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .keyring(keyring_provider)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
+    let client_builder = client_builder.clone().keyring(keyring_provider);
 
     // Validate that the Python version is supported by the lockfile.
     if !target
@@ -722,8 +715,7 @@ pub(super) async fn do_sync(
     store_credentials_from_target(target);
 
     // Initialize the registry client.
-    let client = RegistryClientBuilder::try_from(client_builder)?
-        .cache(cache.clone())
+    let client = RegistryClientBuilder::new(client_builder, cache.clone())
         .index_locations(index_locations.clone())
         .index_strategy(index_strategy)
         .markers(venv.interpreter().markers())

crates/uv/src/commands/project/tree.rs

@@ -6,7 +6,7 @@ use futures::StreamExt;
 use tokio::sync::Semaphore;
 use uv_cache::{Cache, Refresh};
 use uv_cache_info::Timestamp;
-use uv_client::RegistryClientBuilder;
+use uv_client::{BaseClientBuilder, RegistryClientBuilder};
 use uv_configuration::{Concurrency, DependencyGroups, TargetTriple};
 use uv_distribution_types::IndexCapabilities;
 use uv_normalize::DefaultGroups;
@@ -29,7 +29,7 @@ use crate::commands::project::{
 use crate::commands::reporters::LatestVersionReporter;
 use crate::commands::{ExitStatus, diagnostics};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverSettings};
+use crate::settings::ResolverSettings;
 
 /// Run a command.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -51,7 +51,7 @@ pub(crate) async fn tree(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     settings: ResolverSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     script: Option<Pep723Script>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
@@ -80,8 +80,6 @@ pub(crate) async fn tree(
     };
     let groups = groups.with_defaults(default_groups);
 
-    let native_tls = network_settings.native_tls;
-
     // Find an interpreter for the project, unless `--frozen` and `--universal` are both set.
     let interpreter = if frozen && universal {
         None
@@ -90,7 +88,7 @@ pub(crate) async fn tree(
             LockTarget::Script(script) => ScriptInterpreter::discover(
                 script.into(),
                 python.as_deref().map(PythonRequest::parse),
-                network_settings,
+                client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -108,7 +106,7 @@ pub(crate) async fn tree(
                 project_dir,
                 &groups,
                 python.as_deref().map(PythonRequest::parse),
-                network_settings,
+                client_builder,
                 python_preference,
                 python_downloads,
                 &install_mirrors,
@@ -143,7 +141,7 @@ pub(crate) async fn tree(
     let lock = match LockOperation::new(
         mode,
         &settings,
-        network_settings,
+        client_builder,
         &state,
         Box::new(DefaultResolveLogger),
         concurrency,
@@ -157,7 +155,7 @@ pub(crate) async fn tree(
     {
         Ok(result) => result.into_lock(),
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }
@@ -217,12 +215,9 @@ pub(crate) async fn tree(
 
             // Initialize the registry client.
             let client = RegistryClientBuilder::new(
+                client_builder.clone(),
                 cache.clone().with_refresh(Refresh::All(Timestamp::now())),
             )
-            .retries_from_env()?
-            .native_tls(network_settings.native_tls)
-            .connectivity(network_settings.connectivity)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone())
             .index_locations(index_locations.clone())
             .keyring(*keyring_provider)
             .build();

crates/uv/src/commands/project/version.rs

@@ -9,6 +9,7 @@ use tracing::debug;
 use uv_cache::Cache;
 use uv_cli::version::VersionInfo;
 use uv_cli::{VersionBump, VersionFormat};
+use uv_client::BaseClientBuilder;
 use uv_configuration::{
     Concurrency, DependencyGroups, DependencyGroupsWithDefaults, DryRun, EditableMode,
     ExtrasSpecification, InstallOptions,
@@ -37,7 +38,7 @@ use crate::commands::project::{
 };
 use crate::commands::{ExitStatus, diagnostics, project};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverInstallerSettings};
+use crate::settings::ResolverInstallerSettings;
 
 /// Display version information for uv itself (`uv self version`)
 pub(crate) fn self_version(
@@ -69,7 +70,7 @@ pub(crate) async fn project_version(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     settings: ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     installer_metadata: bool,
@@ -101,7 +102,7 @@ pub(crate) async fn project_version(
             python,
             install_mirrors,
             &settings,
-            network_settings,
+            client_builder,
             python_preference,
             python_downloads,
             concurrency,
@@ -303,7 +304,7 @@ pub(crate) async fn project_version(
             python,
             install_mirrors,
             &settings,
-            network_settings,
+            client_builder,
             python_preference,
             python_downloads,
             installer_metadata,
@@ -406,7 +407,7 @@ async fn print_frozen_version(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     settings: &ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     concurrency: Concurrency,
@@ -423,7 +424,7 @@ async fn print_frozen_version(
         project_dir,
         &DependencyGroupsWithDefaults::none(),
         python.as_deref().map(PythonRequest::parse),
-        &network_settings,
+        &client_builder,
         python_preference,
         python_downloads,
         &install_mirrors,
@@ -446,7 +447,7 @@ async fn print_frozen_version(
     let lock = match project::lock::LockOperation::new(
         LockMode::Frozen,
         &settings.resolver,
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultResolveLogger),
         concurrency,
@@ -460,7 +461,7 @@ async fn print_frozen_version(
     {
         Ok(result) => result.into_lock(),
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }
@@ -502,7 +503,7 @@ async fn lock_and_sync(
     python: Option<String>,
     install_mirrors: PythonInstallMirrors,
     settings: &ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     installer_metadata: bool,
@@ -532,7 +533,7 @@ async fn lock_and_sync(
             project_dir,
             &groups,
             python.as_deref().map(PythonRequest::parse),
-            &network_settings,
+            &client_builder,
             python_preference,
             python_downloads,
             &install_mirrors,
@@ -554,7 +555,7 @@ async fn lock_and_sync(
             &groups,
             python.as_deref().map(PythonRequest::parse),
             &install_mirrors,
-            &network_settings,
+            &client_builder,
             python_preference,
             python_downloads,
             no_sync,
@@ -586,7 +587,7 @@ async fn lock_and_sync(
     let lock = match project::lock::LockOperation::new(
         mode,
         &settings.resolver,
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultResolveLogger),
         concurrency,
@@ -600,7 +601,7 @@ async fn lock_and_sync(
     {
         Ok(result) => result.into_lock(),
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }
@@ -644,7 +645,7 @@ async fn lock_and_sync(
         Modifications::Sufficient,
         None,
         settings.into(),
-        &network_settings,
+        &client_builder,
         &state,
         Box::new(DefaultInstallLogger),
         installer_metadata,
@@ -659,7 +660,7 @@ async fn lock_and_sync(
     {
         Ok(()) => {}
         Err(ProjectError::Operation(err)) => {
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
         }

crates/uv/src/commands/publish.rs

@@ -21,14 +21,13 @@ use uv_warnings::{warn_user_once, write_error_chain};
 use crate::commands::reporters::PublishReporter;
 use crate::commands::{ExitStatus, human_readable_bytes};
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 pub(crate) async fn publish(
     paths: Vec<String>,
     publish_url: DisplaySafeUrl,
     trusted_publishing: TrustedPublishing,
     keyring_provider: KeyringProviderType,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     username: Option<String>,
     password: Option<String>,
     check_url: Option<IndexUrl>,
@@ -36,7 +35,7 @@ pub(crate) async fn publish(
     cache: &Cache,
     printer: Printer,
 ) -> Result<ExitStatus> {
-    if network_settings.connectivity.is_offline() {
+    if client_builder.is_offline() {
         bail!("Unable to publish files in offline mode");
     }
 
@@ -57,18 +56,18 @@ pub(crate) async fn publish(
     //   shouldn't try cloning the request to make an unauthenticated request first, but we want
     //   keyring integration. For trusted publishing, we use an OIDC auth routine without keyring
     //   or other auth integration.
-    let upload_client = BaseClientBuilder::new()
+    let upload_client = client_builder
+        .clone()
         .retries(0)
         .keyring(keyring_provider)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone())
         // Don't try cloning the request to make an unauthenticated request first.
         .auth_integration(AuthIntegration::OnlyAuthenticated)
         // Set a very high timeout for uploads, connections are often 10x slower on upload than
         // download. 15 min is taken from the time a trusted publishing token is valid.
         .default_timeout(Duration::from_secs(15 * 60))
         .build();
-    let oidc_client = BaseClientBuilder::new()
+    let oidc_client = client_builder
+        .clone()
         .auth_integration(AuthIntegration::NoAuthMiddleware)
         .wrap_existing(&upload_client);
     // We're only checking a single URL and one at a time, so 1 permit is sufficient
@@ -89,13 +88,10 @@ pub(crate) async fn publish(
 
     // Initialize the registry client.
     let check_url_client = if let Some(index_url) = &check_url {
-        let registry_client_builder = RegistryClientBuilder::new(cache.clone())
-            .retries_from_env()?
-            .native_tls(network_settings.native_tls)
-            .connectivity(network_settings.connectivity)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone())
-            .index_locations(index_locations)
-            .keyring(keyring_provider);
+        let registry_client_builder =
+            RegistryClientBuilder::new(client_builder.clone(), cache.clone())
+                .index_locations(index_locations)
+                .keyring(keyring_provider);
         Some(CheckUrlClient {
             index_url: index_url.clone(),
             registry_client_builder,
@@ -343,7 +339,7 @@ mod tests {
         username: Option<String>,
         password: Option<String>,
     ) -> Result<(DisplaySafeUrl, Credentials)> {
-        let client = BaseClientBuilder::new().build();
+        let client = BaseClientBuilder::default().build();
         gather_credentials(
             url,
             username,

crates/uv/src/commands/python/find.rs

@@ -3,6 +3,7 @@ use std::fmt::Write;
 use std::path::Path;
 
 use uv_cache::Cache;
+use uv_client::BaseClientBuilder;
 use uv_configuration::DependencyGroupsWithDefaults;
 use uv_fs::Simplified;
 use uv_preview::Preview;
@@ -19,7 +20,6 @@ use crate::commands::{
     project::{ScriptInterpreter, WorkspacePython, validate_project_requires_python},
 };
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Find a Python interpreter.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -118,7 +118,7 @@ pub(crate) async fn find(
 pub(crate) async fn find_script(
     script: Pep723ItemRef<'_>,
     show_version: bool,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     no_config: bool,
@@ -129,7 +129,7 @@ pub(crate) async fn find_script(
     let interpreter = match ScriptInterpreter::discover(
         script,
         None,
-        network_settings,
+        client_builder,
         python_preference,
         python_downloads,
         &PythonInstallMirrors::default(),

crates/uv/src/commands/python/install.rs

@@ -13,7 +13,7 @@ use itertools::{Either, Itertools};
 use owo_colors::{AnsiColors, OwoColorize};
 use rustc_hash::{FxHashMap, FxHashSet};
 use tracing::{debug, trace};
-
+use uv_client::BaseClientBuilder;
 use uv_fs::Simplified;
 use uv_platform::{Arch, Libc};
 use uv_preview::{Preview, PreviewFeatures};
@@ -36,7 +36,6 @@ use crate::commands::python::{ChangeEvent, ChangeEventKind};
 use crate::commands::reporters::PythonDownloadReporter;
 use crate::commands::{ExitStatus, elapsed};
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 struct InstallRequest {
@@ -163,7 +162,7 @@ pub(crate) async fn install(
     python_install_mirror: Option<String>,
     pypy_install_mirror: Option<String>,
     python_downloads_json_url: Option<String>,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     default: bool,
     python_downloads: PythonDownloads,
     no_config: bool,
@@ -403,12 +402,7 @@ pub(crate) async fn install(
         .collect::<Vec<_>>();
 
     // Download and unpack the Python versions concurrently
-    let client = uv_client::BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone())
-        .build();
+    let client = client_builder.build();
     let reporter = PythonDownloadReporter::new(printer, downloads.len() as u64);
     let mut tasks = FuturesUnordered::new();
 

crates/uv/src/commands/python/pin.rs

@@ -23,7 +23,6 @@ use crate::commands::{
     ExitStatus, project::find_requires_python, reporters::PythonDownloadReporter,
 };
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Pin to a specific Python version.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -37,7 +36,7 @@ pub(crate) async fn pin(
     global: bool,
     rm: bool,
     install_mirrors: PythonInstallMirrors,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     cache: &Cache,
     printer: Printer,
     preview: Preview,
@@ -116,11 +115,6 @@ pub(crate) async fn pin(
         bail!("Requests for arbitrary names (e.g., `{name}`) are not supported in version files");
     }
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
     let reporter = PythonDownloadReporter::single(printer);
 
     let python = match PythonInstallation::find_or_download(

crates/uv/src/commands/self_update.rs

@@ -5,12 +5,11 @@ use axoupdater::{AxoUpdater, AxoupdateError, UpdateRequest};
 use owo_colors::OwoColorize;
 use tracing::debug;
 
-use uv_client::WrappedReqwestError;
+use uv_client::{BaseClientBuilder, WrappedReqwestError};
 use uv_fs::Simplified;
 
 use crate::commands::ExitStatus;
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 /// Attempt to update the uv binary.
 pub(crate) async fn self_update(
@@ -18,9 +17,9 @@ pub(crate) async fn self_update(
     token: Option<String>,
     dry_run: bool,
     printer: Printer,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
 ) -> Result<ExitStatus> {
-    if network_settings.connectivity.is_offline() {
+    if client_builder.is_offline() {
         writeln!(
             printer.stderr(),
             "{}",

crates/uv/src/commands/tool/install.rs

@@ -42,7 +42,7 @@ use crate::commands::tool::common::{
 use crate::commands::tool::{Target, ToolRequest};
 use crate::commands::{diagnostics, reporters::PythonDownloadReporter};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverInstallerSettings, ResolverSettings};
+use crate::settings::{ResolverInstallerSettings, ResolverSettings};
 
 /// Install a tool.
 #[allow(clippy::fn_params_excessive_bools)]
@@ -61,7 +61,7 @@ pub(crate) async fn install(
     force: bool,
     options: ResolverInstallerOptions,
     settings: ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     installer_metadata: bool,
@@ -70,12 +70,6 @@ pub(crate) async fn install(
     printer: Printer,
     preview: Preview,
 ) -> Result<ExitStatus> {
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
     let reporter = PythonDownloadReporter::single(printer);
 
     let python_request = python.as_deref().map(PythonRequest::parse);
@@ -102,12 +96,6 @@ pub(crate) async fn install(
     let state = PlatformState::default();
     let workspace_cache = WorkspaceCache::default();
 
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
     // Parse the input requirement.
     let request = ToolRequest::parse(&package, from.as_deref())?;
 
@@ -152,7 +140,7 @@ pub(crate) async fn install(
                 requirement,
                 &interpreter,
                 &settings,
-                &network_settings,
+                &client_builder,
                 &state,
                 concurrency,
                 &cache,
@@ -277,7 +265,7 @@ pub(crate) async fn install(
                 spec.requirements.clone(),
                 &interpreter,
                 &settings,
-                &network_settings,
+                &client_builder,
                 &state,
                 concurrency,
                 &cache,
@@ -302,7 +290,7 @@ pub(crate) async fn install(
         spec.overrides,
         &interpreter,
         &settings,
-        &network_settings,
+        &client_builder,
         &state,
         concurrency,
         &cache,
@@ -479,7 +467,7 @@ pub(crate) async fn install(
             Constraints::from_requirements(build_constraints.iter().cloned()),
             ExtraBuildRequires::default(),
             &settings,
-            &network_settings,
+            &client_builder,
             &state,
             Box::new(DefaultResolveLogger),
             Box::new(DefaultInstallLogger),
@@ -495,9 +483,11 @@ pub(crate) async fn install(
         {
             Ok(update) => update.into_environment(),
             Err(ProjectError::Operation(err)) => {
-                return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
-                    .report(err)
-                    .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
+                return diagnostics::OperationDiagnostic::native_tls(
+                    client_builder.is_native_tls(),
+                )
+                .report(err)
+                .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
             }
             Err(err) => return Err(err.into()),
         };
@@ -520,7 +510,7 @@ pub(crate) async fn install(
             python_platform.as_ref(),
             Constraints::from_requirements(build_constraints.iter().cloned()),
             &settings.resolver,
-            &network_settings,
+            &client_builder,
             &state,
             Box::new(DefaultResolveLogger),
             concurrency,
@@ -557,7 +547,7 @@ pub(crate) async fn install(
                     .ok()
                     .flatten() else {
                         return diagnostics::OperationDiagnostic::native_tls(
-                            network_settings.native_tls,
+                            client_builder.is_native_tls(),
                         )
                         .report(err)
                         .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
@@ -575,7 +565,7 @@ pub(crate) async fn install(
                         python_platform.as_ref(),
                         Constraints::from_requirements(build_constraints.iter().cloned()),
                         &settings.resolver,
-                        &network_settings,
+                        &client_builder,
                         &state,
                         Box::new(DefaultResolveLogger),
                         concurrency,
@@ -588,7 +578,7 @@ pub(crate) async fn install(
                         Ok(resolution) => (resolution, interpreter),
                         Err(ProjectError::Operation(err)) => {
                             return diagnostics::OperationDiagnostic::native_tls(
-                                network_settings.native_tls,
+                                client_builder.is_native_tls(),
                             )
                             .report(err)
                             .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
@@ -615,7 +605,7 @@ pub(crate) async fn install(
             Modifications::Exact,
             Constraints::from_requirements(build_constraints.iter().cloned()),
             (&settings).into(),
-            &network_settings,
+            &client_builder,
             &state,
             Box::new(DefaultInstallLogger),
             installer_metadata,
@@ -632,9 +622,11 @@ pub(crate) async fn install(
         }) {
             Ok(environment) => environment,
             Err(ProjectError::Operation(err)) => {
-                return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
-                    .report(err)
-                    .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
+                return diagnostics::OperationDiagnostic::native_tls(
+                    client_builder.is_native_tls(),
+                )
+                .report(err)
+                .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
             }
             Err(err) => return Err(err.into()),
         }

crates/uv/src/commands/tool/run.rs

@@ -60,7 +60,7 @@ use crate::commands::tool::{Target, ToolRequest};
 use crate::commands::{diagnostics, project::environment::CachedEnvironment};
 use crate::printer::Printer;
 use crate::settings::ResolverInstallerSettings;
-use crate::settings::{NetworkSettings, ResolverSettings};
+use crate::settings::ResolverSettings;
 
 /// The user-facing command used to invoke a tool run.
 #[derive(Debug, Copy, Clone, PartialEq, Eq)]
@@ -95,7 +95,7 @@ pub(crate) async fn run(
     install_mirrors: PythonInstallMirrors,
     options: ResolverInstallerOptions,
     settings: ResolverInstallerSettings,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     invocation_source: ToolRunCommand,
     isolated: bool,
     python_preference: PythonPreference,
@@ -274,7 +274,7 @@ pub(crate) async fn run(
         install_mirrors,
         options,
         &settings,
-        &network_settings,
+        &client_builder,
         isolated,
         python_preference,
         python_downloads,
@@ -293,19 +293,21 @@ pub(crate) async fn run(
             // If the user ran `uvx run ...`, the `run` is likely a mistake. Show a dedicated hint.
             if from.is_none() && invocation_source == ToolRunCommand::Uvx && target == "run" {
                 let rest = args.iter().map(|s| s.to_string_lossy()).join(" ");
-                return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
-                    .with_hint(format!(
-                        "`{}` invokes the `{}` package. Did you mean `{}`?",
-                        format!("uvx run {rest}").green(),
-                        "run".cyan(),
-                        format!("uvx {rest}").green()
-                    ))
-                    .with_context("tool")
-                    .report(err)
-                    .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
+                return diagnostics::OperationDiagnostic::native_tls(
+                    client_builder.is_native_tls(),
+                )
+                .with_hint(format!(
+                    "`{}` invokes the `{}` package. Did you mean `{}`?",
+                    format!("uvx run {rest}").green(),
+                    "run".cyan(),
+                    format!("uvx {rest}").green()
+                ))
+                .with_context("tool")
+                .report(err)
+                .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
             }
 
-            return diagnostics::OperationDiagnostic::native_tls(network_settings.native_tls)
+            return diagnostics::OperationDiagnostic::native_tls(client_builder.is_native_tls())
                 .with_context("tool")
                 .report(err)
                 .map_or(Ok(ExitStatus::Failure), |err| Err(err.into()));
@@ -685,7 +687,7 @@ async fn get_or_create_environment(
     install_mirrors: PythonInstallMirrors,
     options: ResolverInstallerOptions,
     settings: &ResolverInstallerSettings,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     isolated: bool,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
@@ -695,12 +697,6 @@ async fn get_or_create_environment(
     printer: Printer,
     preview: Preview,
 ) -> Result<(ToolRequirement, PythonEnvironment), ProjectError> {
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
     let reporter = PythonDownloadReporter::single(printer);
 
     // Figure out what Python we're targeting, either explicitly like `uvx python@3`, or via the
@@ -748,7 +744,7 @@ async fn get_or_create_environment(
         EnvironmentPreference::OnlySystem,
         python_preference,
         python_downloads,
-        &client_builder,
+        client_builder,
         cache,
         Some(&reporter),
         install_mirrors.python_install_mirror.as_deref(),
@@ -798,7 +794,7 @@ async fn get_or_create_environment(
                         vec![spec],
                         &interpreter,
                         settings,
-                        network_settings,
+                        client_builder,
                         &state,
                         concurrency,
                         cache,
@@ -873,14 +869,9 @@ async fn get_or_create_environment(
     };
 
     // Read the `--with` requirements.
-    let spec = RequirementsSpecification::from_sources(
-        with,
-        constraints,
-        overrides,
-        None,
-        &client_builder,
-    )
-    .await?;
+    let spec =
+        RequirementsSpecification::from_sources(with, constraints, overrides, None, client_builder)
+            .await?;
 
     // Resolve the `--from` and `--with` requirements.
     let requirements = {
@@ -894,7 +885,7 @@ async fn get_or_create_environment(
                 spec.requirements.clone(),
                 &interpreter,
                 settings,
-                network_settings,
+                client_builder,
                 &state,
                 concurrency,
                 cache,
@@ -920,7 +911,7 @@ async fn get_or_create_environment(
         spec.overrides.clone(),
         &interpreter,
         settings,
-        network_settings,
+        client_builder,
         &state,
         concurrency,
         cache,
@@ -1018,7 +1009,7 @@ async fn get_or_create_environment(
 
     // Read the `--build-constraints` requirements.
     let build_constraints = Constraints::from_requirements(
-        operations::read_constraints(build_constraints, &client_builder)
+        operations::read_constraints(build_constraints, client_builder)
             .await?
             .into_iter()
             .map(|constraint| constraint.requirement),
@@ -1033,7 +1024,7 @@ async fn get_or_create_environment(
         &interpreter,
         python_platform.as_ref(),
         settings,
-        network_settings,
+        client_builder,
         &state,
         if show_resolution {
             Box::new(DefaultResolveLogger)
@@ -1067,7 +1058,7 @@ async fn get_or_create_environment(
                     &interpreter,
                     python_request.as_ref(),
                     &err,
-                    &client_builder,
+                    client_builder,
                     &reporter,
                     &install_mirrors,
                     python_preference,
@@ -1093,7 +1084,7 @@ async fn get_or_create_environment(
                     &interpreter,
                     python_platform.as_ref(),
                     settings,
-                    network_settings,
+                    client_builder,
                     &state,
                     if show_resolution {
                         Box::new(DefaultResolveLogger)

crates/uv/src/commands/tool/upgrade.rs

@@ -34,7 +34,7 @@ use crate::commands::reporters::PythonDownloadReporter;
 use crate::commands::tool::common::remove_entrypoints;
 use crate::commands::{ExitStatus, conjunction, tool::common::finalize_tool_install};
 use crate::printer::Printer;
-use crate::settings::{NetworkSettings, ResolverInstallerSettings};
+use crate::settings::ResolverInstallerSettings;
 
 /// Upgrade a tool.
 pub(crate) async fn upgrade(
@@ -44,7 +44,7 @@ pub(crate) async fn upgrade(
     install_mirrors: PythonInstallMirrors,
     args: ResolverInstallerOptions,
     filesystem: ResolverInstallerOptions,
-    network_settings: NetworkSettings,
+    client_builder: BaseClientBuilder<'_>,
     python_preference: PythonPreference,
     python_downloads: PythonDownloads,
     installer_metadata: bool,
@@ -83,11 +83,6 @@ pub(crate) async fn upgrade(
     }
 
     let reporter = PythonDownloadReporter::single(printer);
-    let client_builder = BaseClientBuilder::new()
-        .retries_from_env()?
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
 
     let python_request = python.as_deref().map(PythonRequest::parse);
 
@@ -130,7 +125,7 @@ pub(crate) async fn upgrade(
             printer,
             &installed_tools,
             &args,
-            &network_settings,
+            &client_builder,
             cache,
             &filesystem,
             installer_metadata,
@@ -216,7 +211,7 @@ async fn upgrade_tool(
     printer: Printer,
     installed_tools: &InstalledTools,
     args: &ResolverInstallerOptions,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     cache: &Cache,
     filesystem: &ResolverInstallerOptions,
     installer_metadata: bool,
@@ -302,7 +297,7 @@ async fn upgrade_tool(
             python_platform,
             build_constraints.clone(),
             &settings.resolver,
-            network_settings,
+            client_builder,
             &state,
             Box::new(SummaryResolveLogger),
             concurrency,
@@ -320,7 +315,7 @@ async fn upgrade_tool(
             Modifications::Exact,
             build_constraints,
             (&settings).into(),
-            network_settings,
+            client_builder,
             &state,
             Box::new(DefaultInstallLogger),
             installer_metadata,
@@ -347,7 +342,7 @@ async fn upgrade_tool(
             build_constraints,
             ExtraBuildRequires::default(),
             &settings,
-            network_settings,
+            client_builder,
             &state,
             Box::new(SummaryResolveLogger),
             Box::new(UpgradeInstallLogger::new(name.clone())),

crates/uv/src/commands/venv.rs

@@ -39,7 +39,6 @@ use crate::commands::pip::operations::{Changelog, report_interpreter};
 use crate::commands::project::{WorkspacePython, validate_project_requires_python};
 use crate::commands::reporters::PythonDownloadReporter;
 use crate::printer::Printer;
-use crate::settings::NetworkSettings;
 
 use super::project::default_dependency_groups;
 
@@ -72,7 +71,7 @@ pub(crate) async fn venv(
     index_strategy: IndexStrategy,
     dependency_metadata: DependencyMetadata,
     keyring_provider: KeyringProviderType,
-    network_settings: &NetworkSettings,
+    client_builder: &BaseClientBuilder<'_>,
     prompt: uv_virtualenv::Prompt,
     system_site_packages: bool,
     seed: bool,
@@ -126,14 +125,6 @@ pub(crate) async fn venv(
             .unwrap_or(PathBuf::from(".venv")),
     );
 
-    // TODO(zanieb): We don't use [`BaseClientBuilder::retries_from_env`] here because it's a pain
-    // to map into a miette diagnostic. We should just remove miette diagnostics here, we're not
-    // using them elsewhere.
-    let client_builder = BaseClientBuilder::default()
-        .connectivity(network_settings.connectivity)
-        .native_tls(network_settings.native_tls)
-        .allow_insecure_host(network_settings.allow_insecure_host.clone());
-
     let reporter = PythonDownloadReporter::single(printer);
 
     // If the default dependency-groups demand a higher requires-python
@@ -163,7 +154,7 @@ pub(crate) async fn venv(
             EnvironmentPreference::OnlySystem,
             python_preference,
             python_downloads,
-            &client_builder,
+            client_builder,
             cache,
             Some(&reporter),
             install_mirrors.python_install_mirror.as_deref(),
@@ -224,12 +215,10 @@ pub(crate) async fn venv(
         let interpreter = venv.interpreter();
 
         // Instantiate a client.
-        let client = RegistryClientBuilder::try_from(client_builder)?
-            .cache(cache.clone())
+        let client = RegistryClientBuilder::new(client_builder.clone(), cache.clone())
             .index_locations(index_locations.clone())
             .index_strategy(index_strategy)
             .keyring(keyring_provider)
-            .allow_insecure_host(network_settings.allow_insecure_host.clone())
             .markers(interpreter.markers())
             .platform(interpreter.platform())
             .build();

crates/uv/src/lib.rs

@@ -28,6 +28,7 @@ use uv_cli::{
     ProjectCommand, PythonCommand, PythonNamespace, SelfCommand, SelfNamespace, ToolCommand,
     ToolNamespace, TopLevelArgs, compat::CompatArgs,
 };
+use uv_client::BaseClientBuilder;
 use uv_configuration::min_stack_size;
 use uv_fs::{CWD, Simplified};
 #[cfg(feature = "self-update")]
@@ -169,15 +170,15 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
         }) = &mut **command
         {
             let settings = GlobalSettings::resolve(&cli.top_level.global_args, filesystem.as_ref());
+            let client_builder = BaseClientBuilder::new(
+                settings.network_settings.connectivity,
+                settings.network_settings.native_tls,
+                settings.network_settings.allow_insecure_host,
+            )
+            .retries_from_env()?;
             Some(
-                RunCommand::from_args(
-                    command,
-                    settings.network_settings,
-                    *module,
-                    *script,
-                    *gui_script,
-                )
-                .await?,
+                RunCommand::from_args(command, client_builder, *module, *script, *gui_script)
+                    .await?,
             )
         } else {
             None
@@ -429,6 +430,14 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
     // Configure the cache.
     let cache = Cache::from_settings(cache_settings.no_cache, cache_settings.cache_dir)?;
 
+    // Configure the global network settings.
+    let client_builder = BaseClientBuilder::new(
+        globals.network_settings.connectivity,
+        globals.network_settings.native_tls,
+        globals.network_settings.allow_insecure_host.clone(),
+    )
+    .retries_from_env()?;
+
     match *cli.command {
         Commands::Help(args) => commands::help(
             args.command.unwrap_or_default().as_slice(),
@@ -511,7 +520,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.settings.torch_backend,
                 args.settings.dependency_metadata,
                 args.settings.keyring_provider,
-                &globals.network_settings,
+                &client_builder,
                 args.settings.config_setting,
                 args.settings.config_settings_package,
                 args.settings.build_isolation.clone(),
@@ -587,7 +596,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.settings.torch_backend,
                 args.settings.dependency_metadata,
                 args.settings.keyring_provider,
-                &globals.network_settings,
+                &client_builder,
                 args.settings.allow_empty_requirements,
                 globals.installer_metadata,
                 &args.settings.config_setting,
@@ -727,7 +736,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.settings.torch_backend,
                 args.settings.dependency_metadata,
                 args.settings.keyring_provider,
-                &globals.network_settings,
+                &client_builder,
                 args.settings.reinstall,
                 args.settings.link_mode,
                 args.settings.compile_bytecode,
@@ -788,7 +797,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.settings.prefix,
                 cache,
                 args.settings.keyring_provider,
-                &globals.network_settings,
+                &client_builder,
                 args.dry_run,
                 printer,
                 globals.preview,
@@ -837,7 +846,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.settings.index_locations,
                 args.settings.index_strategy,
                 args.settings.keyring_provider,
-                &globals.network_settings,
+                &client_builder,
                 globals.concurrency,
                 args.settings.strict,
                 args.settings.exclude_newer,
@@ -891,7 +900,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.settings.index_locations,
                 args.settings.index_strategy,
                 args.settings.keyring_provider,
-                globals.network_settings,
+                client_builder,
                 globals.concurrency,
                 args.settings.strict,
                 args.settings.exclude_newer,
@@ -976,7 +985,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.python,
                 args.install_mirrors,
                 &args.settings,
-                &globals.network_settings,
+                &client_builder,
                 cli.top_level.no_config,
                 globals.python_preference,
                 globals.python_downloads,
@@ -1039,7 +1048,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.settings.index_strategy,
                 args.settings.dependency_metadata,
                 args.settings.keyring_provider,
-                &globals.network_settings,
+                &client_builder,
                 uv_virtualenv::Prompt::from_args(prompt),
                 args.system_site_packages,
                 args.seed,
@@ -1064,6 +1073,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 globals,
                 cli.top_level.no_config,
                 cli.top_level.global_args.project.is_some(),
+                client_builder,
                 filesystem,
                 cache,
                 printer,
@@ -1078,16 +1088,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                     token,
                     dry_run,
                 }),
-        }) => {
-            commands::self_update(
-                target_version,
-                token,
-                dry_run,
-                printer,
-                globals.network_settings,
-            )
-            .await
-        }
+        }) => commands::self_update(target_version, token, dry_run, printer, client_builder).await,
         Commands::Self_(SelfNamespace {
             command:
                 SelfCommand::Version {
@@ -1202,7 +1203,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.install_mirrors,
                 args.options,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 invocation_source,
                 args.isolated,
                 globals.python_preference,
@@ -1292,7 +1293,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.force,
                 args.options,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 globals.python_preference,
                 globals.python_downloads,
                 globals.installer_metadata,
@@ -1340,7 +1341,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.install_mirrors,
                 args.args,
                 args.filesystem,
-                globals.network_settings,
+                client_builder,
                 globals.python_preference,
                 globals.python_downloads,
                 globals.installer_metadata,
@@ -1424,7 +1425,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.python_install_mirror,
                 args.pypy_install_mirror,
                 args.python_downloads_json_url,
-                globals.network_settings,
+                client_builder,
                 args.default,
                 globals.python_downloads,
                 cli.top_level.no_config,
@@ -1453,7 +1454,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.python_install_mirror,
                 args.pypy_install_mirror,
                 args.python_downloads_json_url,
-                globals.network_settings,
+                client_builder,
                 args.default,
                 globals.python_downloads,
                 cli.top_level.no_config,
@@ -1491,7 +1492,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 commands::python_find_script(
                     (&script).into(),
                     args.show_version,
-                    &globals.network_settings,
+                    &client_builder,
                     globals.python_preference,
                     globals.python_downloads,
                     cli.top_level.no_config,
@@ -1535,7 +1536,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 args.global,
                 args.rm,
                 args.install_mirrors,
-                globals.network_settings,
+                client_builder,
                 &cache,
                 printer,
                 globals.preview,
@@ -1625,7 +1626,7 @@ async fn run(mut cli: Cli) -> Result<ExitStatus> {
                 publish_url,
                 trusted_publishing,
                 keyring_provider,
-                &globals.network_settings,
+                &client_builder,
                 username,
                 password,
                 check_url,
@@ -1684,6 +1685,7 @@ async fn run_project(
     // TODO(zanieb): Determine a better story for passing `no_config` in here
     no_config: bool,
     explicit_project: bool,
+    client_builder: BaseClientBuilder<'_>,
     filesystem: Option<FilesystemOptions>,
     cache: Cache,
     printer: Printer,
@@ -1724,7 +1726,7 @@ async fn run_project(
                 args.python,
                 args.install_mirrors,
                 args.no_workspace,
-                &globals.network_settings,
+                &client_builder,
                 globals.python_preference,
                 globals.python_downloads,
                 no_config,
@@ -1785,7 +1787,7 @@ async fn run_project(
                 args.python_platform,
                 args.install_mirrors,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 globals.python_preference,
                 globals.python_downloads,
                 globals.installer_metadata,
@@ -1837,7 +1839,7 @@ async fn run_project(
                 globals.python_preference,
                 globals.python_downloads,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 script,
                 globals.installer_metadata,
                 globals.concurrency,
@@ -1881,7 +1883,7 @@ async fn run_project(
                 args.python,
                 args.install_mirrors,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 script,
                 globals.python_preference,
                 globals.python_downloads,
@@ -2003,7 +2005,7 @@ async fn run_project(
                 args.workspace,
                 args.install_mirrors,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 script,
                 globals.python_preference,
                 globals.python_downloads,
@@ -2047,7 +2049,7 @@ async fn run_project(
                 args.python,
                 args.install_mirrors,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 script,
                 globals.python_preference,
                 globals.python_downloads,
@@ -2088,7 +2090,7 @@ async fn run_project(
                 args.python,
                 args.install_mirrors,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 globals.python_preference,
                 globals.python_downloads,
                 globals.installer_metadata,
@@ -2133,7 +2135,7 @@ async fn run_project(
                 args.python,
                 args.install_mirrors,
                 args.resolver,
-                &globals.network_settings,
+                &client_builder,
                 script,
                 globals.python_preference,
                 globals.python_downloads,
@@ -2180,7 +2182,7 @@ async fn run_project(
                 args.python,
                 args.install_mirrors,
                 args.settings,
-                globals.network_settings,
+                client_builder,
                 globals.python_preference,
                 globals.python_downloads,
                 globals.concurrency,
@@ -2207,7 +2209,7 @@ async fn run_project(
                 args.diff,
                 args.extra_args,
                 args.version,
-                globals.network_settings,
+                client_builder,
                 cache,
                 printer,
                 globals.preview,

crates/uv/tests/it/common/mod.rs

@@ -1819,7 +1819,7 @@ pub async fn download_to_disk(url: &str, path: &Path) {
         .map(|h| uv_configuration::TrustedHost::from_str(h).unwrap())
         .collect();
 
-    let client = uv_client::BaseClientBuilder::new()
+    let client = uv_client::BaseClientBuilder::default()
         .allow_insecure_host(trusted_hosts)
         .build();
     let url = url.parse().unwrap();