tweak the order of index priority (#2083)

Previously, `uv` would always prioritize the index given by
`--index-url`. It would then try any indexes after that given by zero
or more `--extra-index-url` flags. This differed from `pip` in that any
priority was given at all, where `pip` doesn't guarantee any priority
ordering of indexes.

We could go in the direction of mimicing `pip`'s behavior here, but it
at present has issues with dependency confusion attacks where packages
may get installed from indexes you don't control. More specifically,
there is an issue of different trust levels. See discussion in #171 and
[PEP-0708] for more on the security impact.

In contrast, `uv` will only select versions for a package from a single
index. That is, even if `foo` is in indexes `a` and `b`, it will
only consider the versions from the index that it checks first. This
probably helps with respect to dependency confusion attacks, but also
means that `uv` doesn't quite cover all of the same use cases as `pip`.

In this PR, we retain the notion of prioritizing indexes, but
tweak it so that PyPI is preferred last as opposed to first. Or
more precisely, the `--index-url` flag specifies a fallback index,
not the primary index, and is deprioritized beneath every index
specified by `--extra-index-url`. The ordering among indexes given by
`--extra-index-url` remains the same: earlier indexes are prioritized
over later indexes.

While this tweak likely won't hit all use cases, I believe it will
resolve some of the most common pain points without exacerbating
dependency confusion problems.

Ref #171, Fixes #1377, Fixes #1451, Fixes #1600

[PEP-0708]: https://peps.python.org/pep-0708/

crates/distribution-types/src/index_url.rs

@@ -288,12 +288,12 @@ impl Default for IndexUrls {
 }
 
 impl<'a> IndexUrls {
-    /// Return the primary [`IndexUrl`] entry.
+    /// Return the fallback [`IndexUrl`] entry.
     ///
     /// If `--no-index` is set, return `None`.
     ///
     /// If no index is provided, use the `PyPI` index.
-    pub fn index(&'a self) -> Option<&'a IndexUrl> {
+    fn index(&'a self) -> Option<&'a IndexUrl> {
         if self.no_index {
             None
         } else {
@@ -305,7 +305,7 @@ impl<'a> IndexUrls {
     }
 
     /// Return an iterator over the extra [`IndexUrl`] entries.
-    pub fn extra_index(&'a self) -> impl Iterator<Item = &'a IndexUrl> + 'a {
+    fn extra_index(&'a self) -> impl Iterator<Item = &'a IndexUrl> + 'a {
         if self.no_index {
             Either::Left(std::iter::empty())
         } else {
@@ -314,13 +314,11 @@ impl<'a> IndexUrls {
     }
 
     /// Return an iterator over all [`IndexUrl`] entries.
+    ///
+    /// If `no_index` was enabled, then this always returns an empty
+    /// iterator.
     pub fn indexes(&'a self) -> impl Iterator<Item = &'a IndexUrl> + 'a {
-        self.index().into_iter().chain(self.extra_index())
-    }
-
-    /// Return `true` if no index is configured.
-    pub fn no_index(&self) -> bool {
-        self.no_index
+        self.extra_index().chain(self.index())
     }
 }