Skip to content

uv pip install not respecting index.authenticate on followup requests #13737

@JoshuaHassler

Description

@JoshuaHassler

Summary

PR #12470 updated the pip commands to respect the index.authenticate settings, however, this seems to only apply to the initial request. Once the package is found the subsequent request to download the package is first made unauthenticated. I can verify this both in the uv logs and by looking at the logs of our Python index. Due to the specifics of our index setup, this causes the download to fail.

UV logs
Initial good request:

DEBUG No cache entry for: https://<REPO_URL>/root/pypi/+simple/<PACKAGE>/
TRACE Sending fresh GET request for https://<REPO_URL>/root/pypi/+simple/<PACKAGE>/
TRACE Handling request for https://<REPO_URL>/root/pypi/+simple/<PACKAGE>/ with authentication policy always

Followup bad request:

DEBUG No cache entry for: https://<REPO_URL>/root/pypi/+<HASH>/<PACKAGE>-py3-none-any.whl
TRACE Sending fresh HEAD request for https://<REPO_URL>/root/pypi/+<HASH>/<PACKAGE>-py3-none-any.whl
TRACE Handling request for https://<REPO_URL>/root/pypi/+<HASH>/<PACKAGE>-py3-none-any.whl with authentication policy auto

Platform

Fedora Linux 6.14.6-300.fc42.x86_64 x86_64 GNU/Linux

Version

uv 0.7.8

Python version

Python 3.13.3

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions