Commit Graph

290 Commits

Author SHA1 Message Date
Zanie Blue 8968110455 Fix infinite loop when SSL_CERT_FILE is a directory (#17503)
Closes #17494

See https://github.com/rustls/pki-types/issues/98 for details.

I've posted an upstream fix https://github.com/rustls/pki-types/pull/99
but given the severity I think we should defensively patch this here as
well.

Co-authored-by: Claude <noreply@anthropic.com>
2026-01-16 07:12:55 -06:00
konsti 20f468167a Log when response arrives (#17488)
Looking at #17485, I noticed we don't log when a request finishes,
making the log harder to read than necessary.

Example new log message:

```
TRACE Received response for revalidation request with status 304 Not Modified for: https://pypi.org/simple/idna/
```
2026-01-15 17:23:50 +00:00
konsti 6db2c62906 Normalize test snapshots (#17486)
This reduces the churn when changing test snapshots, as insta updates
the quotes when the contents change. Instead, we decouple it by updating
the quotes in bulk here.

Created by:

```
cargo insta test --accept --force-update-snapshots
```
2026-01-15 17:50:10 +01:00
William Woodruff 9ddaae2244 Initial PEP 792 types and index parsing (#17311) 2026-01-07 16:35:39 +00:00
William Woodruff dbe5481d5c Use DisplaySafeUrl to readact a URL in a trace log (#17346) 2026-01-07 15:55:08 +00:00
Eli Uriegas e67dbce3fe Allow setting proxy variables via global / user configuration (#16918)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

<!-- What's the purpose of the change? What does it do, and why? -->

This allows users to set the HTTP, HTTPS, and no proxy variables via the
configuration files like ~pyproject.toml~ and uv.toml.

Users can set like so:

`uv.toml`
```toml
https-proxy = "http://my_cool_proxy:10500"
http-proxy = "http://my_cool_proxy:10500"
no-proxy = [
  "dontproxyme.com",
  "localhost",
]
```

Resolves https://github.com/astral-sh/uv/issues/9472

## Test Plan

<!-- How was it tested? -->
It also adds a new integration test for the proxy support in
`uv-client`.

This was tested on some of our developer machines with our proxy setup
using `~/.config/uv/uv.toml` with values like:

```toml
https-proxy = "http://my_cool_proxy:10500"
http-proxy = "http://my_cool_proxy:10500"
no-proxy = [
  "dontproxyme.com",
  "localhost",
]

```

---------

Signed-off-by: Eli Uriegas <eliuriegas@meta.com>
Co-authored-by: Zanie Blue <contact@zanie.dev>
2026-01-06 11:13:59 -06:00
konsti 4950dd475b Remove retries duplication uv_client error (#17325)
Previously, we had a retry count both on the top level error type, and
on an error variant, and had a conversion step in between. When
reviewing #17274, I noticed we can simplify that.
2026-01-06 09:20:02 +00:00
Tomasz Kramkowski df62ee6f4d Track retry counts originating from early middleware errors (#17274)
## Summary

Fixes #17266.

The retry count was getting dropped by
`ErrorKind::from_retry_middleware` and `<Error as
From<ErrorKind>>::from` so we were doing more retries than we should
have.

## Test Plan

Added a testcase for the specific error path in the issue. Added an
expect to the other retry test too.
2026-01-05 20:06:38 +00:00
konsti 24cc4a789b Fix some Rust 1.92 clippy lints (#17324)
Saw this as a build failure in a CI job.

Excluding https://github.com/zkat/miette/pull/459
2026-01-05 11:11:43 +00:00
konsti e2a775d727 Use the same retry logic across uv (#17105)
We were using slightly different retry code in multiple places, this PR
unifies it.

Also fixes retry undercounting in publish if the retry middleware was
involved.

---------

Co-authored-by: Tomasz Kramkowski <tom@astral.sh>
2025-12-18 12:44:37 +00:00
konsti a25d4f953f Fix retry counts in cached client (#17104)
Previously, we dropped the counts from the middleware layer, potentially
doing to many retries and/or reporting too few.

Not pretty but fixes the bug.
2025-12-18 10:51:00 +00:00
stringscut 9f422e7515 Fix comment typos and improve wording (#17166)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

improve code comments clarity

<!-- What's the purpose of the change? What does it do, and why? -->

## Test Plan

<!-- How was it tested? -->

Signed-off-by: stringscut <stringscut@outlook.jp>
2025-12-18 11:47:43 +01:00
konsti 9360ca7778 Refactor uv retrayble strategy to use a single code path (#17099)
Refactoring that allows uv's retryable strategy to return
`Some(Retryable::Fatal)`, also helpful for
https://github.com/astral-sh/uv/pull/16245
2025-12-18 11:10:47 +01:00
Diyor Khayrutdinov b58f543e5e Support redirects in uv publish (#17130)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

Follow redirects for `uv publish`. Related issue:
https://github.com/astral-sh/uv/issues/17126.

## Test Plan

<!-- How was it tested? -->
Added a unit test to test the custom redirect logic.

---------

Co-authored-by: konstin <konstin@mailbox.org>
2025-12-16 09:04:28 +00:00
Tomasz Kramkowski d20948bec2 Support creating lock files on ExFAT on MacOS (#17115)
## Summary

Fix #16859 by falling back to simply creating the lock file and then
attempting to apply permissions in cases where the temporary lockfile
cannot be renamed without overwriting (persist_noclobber) due to lack of
underlying support from the filesystem.

I've also improved the error handling.

## Test Plan

Manually on MacOS with an ExFAT partition.

~~~ bash session
$ hdiutil create -size 1g -fs ExFAT -volname EXFATDISK exfat.dmg
$ hdiutil attach exfat.dmg
$ cd /Volumes/EXFATDISK
$ uv init --bare --cache-dir build/uv/cache -v 
~~~
2025-12-15 14:05:05 +00:00
konsti 62bf92132b Add a 5 min default timeout for deadlocks (#16342)
When a process is running and another calls `uv cache clean` or `uv
cache prune` we currently deadlock - sometimes until the CI timeout
(https://github.com/astral-sh/setup-uv/issues/588). To avoid this, we
add a default 5 min timeout waiting for a lock. 5 min balances allowing
in-progress builds to finish, especially with larger native
dependencies, while also giving timely errors for deadlocks on (remote)
systems.

Commit 1 is a refactoring.

This branch also fixes a problem with the logging where acquired and
released resources currently mismatch:

```
DEBUG Acquired lock for `https://github.com/tqdm/tqdm`
DEBUG Using existing Git source `https://github.com/tqdm/tqdm`
DEBUG Released lock at `C:\Users\Konsti\AppData\Local\uv\cache\git-v0\locks\16bb813afef8edd2`
```
2025-12-04 14:59:04 +01:00
konsti 05fa19c440 Use explicit credentials cache instead of global static (#16768)
Fixes https://github.com/astral-sh/uv/issues/16447

Passing this around explicitly uncovers some behaviors where we pass
e.g. the credentials store to reading the lockfile. The changes in this
PR should preserve the existing behavior for now, they only make the
locations we read from more explicit.

Labeling this PR as "Enhancement" instead of "Internal" in case this
changes behavior when it shouldn't have.
2025-12-03 14:51:25 +01:00
Zsolt Dollenstein 6b00d6522c Attach subcommand to User-Agent string (#16837) 2025-12-01 10:29:54 -05:00
samypr100 bf99f0a195 Add support for SSL_CERT_DIR (#16473)
## Summary

Closes https://github.com/astral-sh/uv/issues/16414

Adds support for the standard
[SSL_CERT_DIR](https://docs.openssl.org/3.6/man3/SSL_CTX_load_verify_locations)
which has gained recent proper support from
[rustls-native-certs](https://github.com/rustls/rustls-native-certs/pull/187)
in v0.8.2.

In addition, this PR clarifies documentation around `SSL_CERT_FILE` and
`SSL_CERT_DIR` when used in combination with `UV_NATIVE_TLS` as
mentioned in
https://github.com/astral-sh/uv/issues/16412#issuecomment-3434927201

## Test Plan

Manually tested with custom cert chains in multiple directories and
loading them via SSL_CERT_DIR. We didn't have tests for `SSL_CERT_FILE`
or `SSL_CERT_DIR` environment variables so I added a basic one using our
own test-only certificate generation and dummy https server. I also
moved some things around for better reuse.
2025-11-16 11:48:31 -06:00
Zsolt Dollenstein e96354a6dd Always attach linehaul data (#16705) 2025-11-12 17:10:15 +00:00
William Woodruff ae1edef9c0 Reject ambiguously parsed URLs (#16622)
Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-11-12 16:27:57 +00:00
konsti 92c2bfcca0 Remove unnecessary DisplaySafeUrl::from (#16689)
For #16622
2025-11-11 19:12:20 +00:00
Charlie Marsh c1c1950dce Add support for the Simple index API top-level route (#16656)
## Summary

At present, we only have support for the detail routes (e.g.,
`https://pypi.org/simple/requests`), but not the top-level index route
(e.g., `https://pypi.org/simple/`). I need this for some downstream work
so pulling it into its own PR.
2025-11-10 14:50:19 -05:00
Charlie Marsh 82aa0d0ef5 Avoid pluralizing 'retry' for single value (#16535) 2025-10-31 10:28:51 -04:00
liam ae6607d5dc Deterministically order --find-links distributions (#16446)
Made to address this comment:
https://github.com/astral-sh/uv/pull/16103#discussion_r2437498249

This PR sorts the distributions collected by
`FlatIndexClient::read_from_directory` (used for `--find-links`) so
results are ordered deterministically by filename and index.
2025-10-26 21:53:32 -04:00
Andrei Berenda 51e8da2d1c Move parsing http retries to EnvironmentOptions (#16284)
## Summary
- Move  parsing `UV_HTTP_RETRIES` to `EnvironmentOptions`

Relates https://github.com/astral-sh/uv/issues/14720

## Test Plan

- Tests with existing tests
2025-10-21 11:14:37 +02:00
Mark Dodgson c12e8bb343 Implement RFC9457 compliant messaging (#16199)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

HTTP1.1 [RFC 9112 -
HTTP/1.1](https://www.rfc-editor.org/rfc/rfc9112.html#name-status-line)
section 4 defines the response status code to optionally include a text
description (human readable) of the reason for the status code.

[RFC9113 - HTTP/2](https://www.rfc-editor.org/rfc/rfc9113) is the HTTP2
protocol standard and the response status only considers the [status
code](https://www.rfc-editor.org/rfc/rfc9113#name-response-pseudo-header-fiel)
and not the reason phrase, and as such important information can be lost
in helping the client determine a route cause of a failure.

As per discussion on this
[PR](https://github.com/astral-sh/uv/pull/15979) the current feeling is
that implementing the RFC9457 standard might be the preferred route.
This PR makes those changes to aid the discussion which has also been
moved to the [PEP
board](https://discuss.python.org/t/block-download-of-components-when-violating-policy/104021/1)

## Test Plan

Pulling components that violate our policy over HTTP2 and without any
RFC9457 implementation the following message is presented to the user:
<img width="1482" height="104" alt="image"
src="https://github.com/user-attachments/assets/0afcd0d8-ca67-4f94-a6c2-131e3b6d8dcc"
/>


With the RFC9457 standard implemented, below you can see the advantage
in the extra context as to why the component has been blocked:
<img width="2171" height="127" alt="image"
src="https://github.com/user-attachments/assets/25bb5465-955d-4a76-9f30-5477fc2c866f"
/>

---------

Co-authored-by: konstin <konstin@mailbox.org>
2025-10-16 19:53:49 +00:00
konsti 52cc3c8b94 Add missing UV_TEST_NO_HTTP_RETRY_DELAY check and better logging (#16313)
The `install_http_retries` test goes from 15s to 0.3s. Additionally, we
log the retry delay.
2025-10-15 20:45:21 +02:00
Andrei Berenda a58d031157 Add UV_UPLOAD_HTTP_TIMEOUT and respect UV_HTTP_TIMEOUT in uploads (#16040)
## Summary
- Move parsing `UV_HTTP_TIMEOUT`, `UV_REQUEST_TIMEOUT` and
`HTTP_TIMEOUT` to `EnvironmentOptions`
- Add new env varialbe `UV_UPLOAD_HTTP_TIMEOUT`

Relates https://github.com/astral-sh/uv/issues/14720

## Test Plan

Tests with existing tests
2025-10-09 12:28:30 -05:00
konsti 5ee728b3e3 Retry all h2 errors (#16038)
The h2 errors, a specific type nested in reqwest errors, all look like
they shouldn't happen in regular operations and should be retried. This
covers all `io::Error`s going through h2 (i.e., only HTTP 2
connections).

Fixes https://github.com/astral-sh/uv/issues/15916
2025-10-09 13:53:14 +00:00
Zanie Blue 4c2d9e19b0 Use EnvVars in linehaul (#15931) 2025-09-18 14:08:58 +00:00
Zanie Blue 0aa3c4e094 Propagate preview flag to client for native-auth feature (#15872)
Somehow propagation of this got dropped during a rebase, so we never
actually used the native store during resolution.

Part of https://github.com/astral-sh/uv/issues/15818
2025-09-15 10:51:44 -05:00
Charlie Marsh b770639c91 Rename provides_extras to provides_extra (#15825)
## Summary

This is now consistent with `requires_dist` (singular).
2025-09-14 13:27:45 +00:00
konsti 4a1813f228 Extract IO errors from h2 for streaming retries of Connection Reset (#15675)
Our streaming retries were missing connection reset errors as h2 was
shadowing IO errors (https://github.com/hyperium/h2/issues/862).

**Test plan**

In one terminal:

```
cargo python uninstall 3.12 && cargo run python install 3.12 -vv
```

In another:

```
sudo tcpkill -i wlp2s0 port 443
```

Output:

```
error: Failed to install cpython-3.12.11-linux-x86_64-gnu
  Caused by: Request failed after 3 retries
  Caused by: Failed to download https://github.com/astral-sh/python-build-standalone/releases/download/20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz
  Caused by: error sending request for url (https://github.com/astral-sh/python-build-standalone/releases/download/20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz)
  Caused by: client error (SendRequest)
  Caused by: connection error
  Caused by: connection reset
```

I don't know how to test that from inside Rust.

Fix #14171 (again, hopefully)
2025-09-04 14:45:00 +02:00
Charlie Marsh 4e48d759c4 Add zstandard support for wheels (#15645)
## Summary

This PR allows pyx to send down hashes for zstandard-compressed
tarballs. If the hash is present, then the file is assumed to be present
at `${wheel_url}.tar.zst`, similar in design to PEP 658
`${wheel_metadata}.metadata` files. The intent here is that the index
must include the wheel (to support all clients and support
random-access), but can optionally include a zstandard-compressed
version alongside it.
2025-09-03 01:38:31 +00:00
Charlie Marsh b57ad179b6 Allow registries to pre-provide core metadata (#15644)
## Summary

This PR adds support for the `application/vnd.pyx.simple.v1` content
type, similar to `application/vnd.pypi.simple.v1` with the exception
that it can also include core metadata for package-versions directly.
2025-09-03 00:56:29 +00:00
Charlie Marsh f88aaa8740 Add pyx support to uv auth commands (#15636)
## Summary

This PR adds support for pyx to `uv auth login`, `uv auth logout`, and
`uv auth token`. These are generic uv commands that can be used to store
credentials for arbitrary indexes and other URLs, but we include a
fast-path for pyx that initiates the appropriate login or logout flow.
2025-09-02 18:18:09 -04:00
Zanie Blue 709e0ba238 Remove the native system store from the keyring providers (#15612)
We're not sure what the best way to expose the native store to users is
yet and it's a bit weird that you can use this in the `uv auth` commands
but can't use any of the other keyring provider options. The simplest
path forward is to just not expose it to users as a keyring provider,
and instead frame it as a preview alternative to the plaintext uv
credentials store. We can revisit the best way to expose configuration
before stabilization.

Note this pull request retains the _internal_ keyring provider
implementation — we can refactor it out later but I wanted to avoid a
bunch of churn here.
2025-09-02 13:16:52 -05:00
Zanie Blue 4ad5ae5e6f Add preview warnings to native-keyring usage (#15555)
The refactor here was all done by Claude Code.
2025-09-02 13:16:52 -05:00
Zanie Blue 460ea6e9eb Add uv auth commands (login, logout, and token) (#15539)
Picks up the work from

- #14559
- https://github.com/astral-sh/uv/pull/14896

There are some high-level changes from those pull requests

1. We do not stash seen credentials in the keyring automatically
2. We use `auth login` and `auth logout` (for future consistency)
3. We add a `token` command for showing the credential that will be used

As well as many smaller changes to API, messaging, testing, etc.

---------

Co-authored-by: John Mumm <jtfmumm@gmail.com>
2025-09-02 13:16:52 -05:00
konsti d5bcc0535a Add test case for status code retries (#15617)
When migrating from the `reqwest_retry` crate, we want to ensure that
the status codes we retry stay the same. This also helps us to
intentionally migrate to a different list later, by enumerating the list
of status codes that are retried.
2025-09-02 15:41:54 +02:00
konsti 22f80ca00d Retry streaming Python and bin download errors (#15567)
When there is an error during the streaming download and unpack for
Python interpreter and bin installs, we would previously fail, causing a
lot of CI flakes on GitHub Actions.

The problem was that the error is not one of the extended IO errors we
were previously handling, but a regular reqwest error, nested below
layers of errors of other crates processing the stream, including some
IO errors. We now handle nested reqwest errors, too.

This surfaced another problem: Our manual retry loop couldn't inform the
retry middleware that it already performed the limit of retries, and
that the middleware should not retry anymore. While too many retries are
more a problem for debugging than for the user, this causes confusing
error output. To work around this, we disable the retries in the client
and handle all retry errors in our loop.

Fixes https://github.com/astral-sh/uv/issues/14171

Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
2025-08-31 15:07:22 +00:00
konsti 289ed86e63 Use a global BaseClientBuilder (#15548)
Alternative to #15105

Instead of building a `BaseClientBuilder` from `NetworkSettings` each
time we need a client, we instead build a single `BaseClientBuilder` and
pass it around. The `RegistryClientBuilder` then uses
`BaseClientBuilder` exclusively for configuration. This removes a chunk
of copy-and-paste code, and also moves the fallible `retries_from_env`
into a single place

Borrow vs. clone is mostly ad-hoc, we can change it in either direction
if it matters.

Closes #15105
2025-08-29 13:30:51 -05:00
konsti 882c9d9482 Make cache_index_credentials() misuse resistant (#15546)
https://github.com/astral-sh/uv/issues/11836#issuecomment-3022735011 was
caused by a missing `cache_index_credentials()` call. This call was
always preceding a registry client builder. We can improve this
situation by caching index credentials in the registry client builder.
2025-08-29 15:11:54 +00:00
Charlie Marsh 615e076beb Rename some Simple API structs (#15530)
## Summary

For clarity.
2025-08-26 13:55:58 +00:00
Nils Koch 4bc6c77f02 Allow passing custom reqwest client to RegistryClient (#15281)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

<!-- What's the purpose of the change? What does it do, and why? -->
We are using UV as a library and we would like to provide an custom
reqwest client to the `RegistryClient`/`BaseClient`. We have a central
place in our repo where we configure the reqwest client to our needs
(certs, proxy, ...) and it is safer for us to just pass the same client
to UV rather than trying to reproduce the same client config with the
APIs that UV exposes.

Are you ok with that change?


## Test Plan

<!-- How was it tested? -->
2025-08-14 12:00:09 -05:00
samypr100 57df0146e2 Update Rust toolchain to 1.89 (#15157)
## Summary

Bumps Rust toolchain to 1.89, but not the MSRV.

Lifetime changes is related to a new lint rule explained in
https://blog.rust-lang.org/2025/08/07/Rust-1.89.0/#mismatched-lifetime-syntaxes-lint

## Test Plan

Existing Tests
2025-08-08 13:01:52 +00:00
konsti 59558b13c1 Respect UV_HTTP_RETRIES in uv publish (#15106)
Previously, publish would always use the default retries, now it
respects `UV_HTTP_RETRIES`

Some awkward error handling to avoid pulling anyhow into uv-publish.
2025-08-06 17:59:17 +02:00
Zanie Blue b2e7b2b279 Improve HTTP response caching log messages (#15067)
"Cached request ... is not storable" doesn't make sense from a user
perspective, it's leaking our internal `CachedClient` abstraction. I
think it makes more sense to talk about this as "Response from ... is
not storable"
2025-08-05 14:34:12 -05:00
adamnemecek 3f83390e34 Make the use of Self consistent. (#15074)
## Summary

Make the use of `Self` consistent. Mostly done by running `cargo clippy
--fix -- -A clippy::all -W clippy::use_self`.

## Test Plan

<!-- How was it tested? -->
No need.
2025-08-05 20:17:12 +01:00