Enable uploads via pre-signed URLs #17349

charliermarsh · 2026-01-07T18:24:13Z

Summary

For pyx, we can allow uploads that bypass the registry and send the file directly to S3. This is an opt-in feature, enabled via the --direct flag.

crates/uv-cli/src/lib.rs

zanieb · 2026-01-07T19:17:45Z

crates/uv-publish/src/lib.rs

+    })?;
+
+    // Use a raw reqwest client for S3 (no auth middleware).
+    let s3_response = client


Since this is a streaming request, does it need to have an outer retry wrapper?

zanieb

This looks reasonable though @woodruffw or @konstin should be final reviewers.

konstin · 2026-01-08T12:48:25Z

crates/uv/src/commands/publish.rs

+                &form_metadata,
+                &publish_url,
+                &upload_client,
+                &oidc_client,


nit: we should rename this client

konstin · 2026-01-08T12:50:03Z

crates/uv-publish/src/lib.rs

+        )
+    })?;
+
+    let s3_response = s3_client


That's the client with the regular settings wrt to retries and timeouts, and with no auth middleware

konstin · 2026-01-08T12:53:33Z

crates/uv-publish/src/lib.rs

+    };
+
+    debug!(
+        "Got pre-signed URL for upload: {}",


Is that URL confidential, should we redact it in logs?

konstin · 2026-01-08T12:55:03Z

crates/uv-publish/src/lib.rs

+    let reader = ProgressReader::new(file, move |read| {
+        reporter_clone.on_upload_progress(idx, read as u64);
+    });
+    let file_reader = Body::wrap_stream(ReaderStream::new(reader));


We need a retry loop here, streaming uploads can't be retried otherwise

konstin · 2026-01-08T12:56:10Z

crates/uv-publish/src/lib.rs

+    let reserve_request = build_metadata_request(
+        &group.raw_filename,
+        &reserve_url,
+        client,


That's the client without retries, I think that should be the regular client, plus/minus auth settings?

woodruffw

LGTM, one note and one comment but neither is blocking IMO. I'll follow up with some comments on the pyx side too.

woodruffw · 2026-01-08T15:16:55Z

crates/uv-cli/src/lib.rs

+    /// Use direct upload to the registry.
+    ///
+    /// When enabled, the publish command will use a direct two-phase upload protocol
+    /// that uploads files directly to storage, bypassing the registry's upload endpoint.
+    #[arg(long, hide = true)]
+    pub direct: bool,


Seems reasonable to me, although noting that we could in principle do this without a flag by having uv send an Accept: ... header that indicates support, to which pyx would then respond with the pre-signed URL.

(That might be nice for enabling this implicit/by default in the future, but seems like not worth doing initially!)

woodruffw · 2026-01-08T15:18:17Z

crates/uv-publish/src/lib.rs

+    let status = response.status();
+
+    let reserve_response: ReserveResponse = match status {
+        StatusCode::OK => {


Q, minor: should we use HTTP 409 (Conflict) for this, given that we're not tied to PyPI's response code semantics for our own upload scheme?

Would 409 be for the case in which it already exists and isn't the same file? Or already exists and is the same file? Here I'm using 200 for "already exists and is the same" (and 201 for "created, now proceed to upload").

Oh, good point. 409 would be for "exists but with different content" I believe, 200 is semantically correct for "exists with the same content already."

codspeed-hq · 2026-01-08T18:03:04Z

Merging this PR will not alter performance

Summary

✅ 5 untouched benchmarks

_{Comparing charlie/direct-s3 (fa48051) with main (25d691e)}

konstin · 2026-01-09T11:13:47Z

crates/uv/src/commands/publish.rs

-    let oidc_client = client_builder
+    let unauthenticated_client = client_builder
        .clone()
+        .retries(0)


For the OIDC client, we need retries (GitHub's networking is too unreliable) and ideally the default timeouts, the S3 is separate in that it uses its own retry loop, upload timeouts and no auth middleware.

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.9.22` → `0.9.24` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.9.24`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0924) [Compare Source](astral-sh/uv@0.9.23...0.9.24) Released on 2026-01-09. ##### Bug fixes - Fix handling of `UV_NO_SYNC=1 uv run ...` ([#17391](astral-sh/uv#17391)) - Rebuild dynamic distribution when version changes with `--no-cache` ([#17387](astral-sh/uv#17387)) ##### Documentation - Add Rust language classifier ([#17389](astral-sh/uv#17389)) ### [`v0.9.23`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0923) [Compare Source](astral-sh/uv@0.9.22...0.9.23) Released on 2026-01-09. ##### Enhancements - Only write portable paths in `RECORD` files ([#17339](astral-sh/uv#17339)) - Support relative paths in `UV_PYTHON_BIN_DIR` and `UV_TOOL_BIN_DIR` ([#17367](astral-sh/uv#17367)) ##### Preview features - Enable uploads to S3 via pre-signed URLs ([#17349](astral-sh/uv#17349)) ##### Configuration - Allow setting proxy variables via global / user configuration ([#16918](astral-sh/uv#16918)) - Manually parse and reconcile Boolean environment variables ([#17321](astral-sh/uv#17321)) ##### Bug fixes - Avoid broken build artifacts on build failure ([#17276](astral-sh/uv#17276)) - Fix missing dependencies on synthetic root in SBOM export ([#17363](astral-sh/uv#17363)) - Recognize `armv8l` as an alias for `armv7l` in platform tag parsing ([#17384](astral-sh/uv#17384)) - Fix redaction of a URL in a middleware trace log ([#17346](astral-sh/uv#17346)) ##### Documentation - Add `index.md` suggestion to `llms.txt` ([#17362](astral-sh/uv#17362)) - Clarify that `uv run` uses inexact syncing by default ([#17366](astral-sh/uv#17366)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

charliermarsh added the preview Experimental behavior label Jan 7, 2026

charliermarsh temporarily deployed to uv-test-registries January 7, 2026 18:25 — with GitHub Actions Inactive

charliermarsh temporarily deployed to uv-test-publish January 7, 2026 18:26 — with GitHub Actions Inactive

zanieb reviewed Jan 7, 2026

View reviewed changes

crates/uv-cli/src/lib.rs Outdated Show resolved Hide resolved

zanieb reviewed Jan 7, 2026

View reviewed changes

zanieb approved these changes Jan 7, 2026

View reviewed changes

Enable uploads via pre-signed URLs

3adbebb

charliermarsh force-pushed the charlie/direct-s3 branch from 33174d4 to 3adbebb Compare January 8, 2026 02:04

charliermarsh temporarily deployed to uv-test-registries January 8, 2026 02:07 — with GitHub Actions Inactive

charliermarsh temporarily deployed to uv-test-publish January 8, 2026 02:08 — with GitHub Actions Inactive

konstin reviewed Jan 8, 2026

View reviewed changes

charliermarsh temporarily deployed to uv-test-registries January 8, 2026 15:09 — with GitHub Actions Inactive

charliermarsh temporarily deployed to uv-test-publish January 8, 2026 15:10 — with GitHub Actions Inactive

woodruffw approved these changes Jan 8, 2026

View reviewed changes

charliermarsh marked this pull request as ready for review January 8, 2026 17:03

charliermarsh force-pushed the charlie/direct-s3 branch from c42705d to 7a7138d Compare January 8, 2026 17:46

charliermarsh temporarily deployed to uv-test-registries January 8, 2026 17:48 — with GitHub Actions Inactive

charliermarsh had a problem deploying to uv-test-publish January 8, 2026 17:48 — with GitHub Actions Failure

charliermarsh had a problem deploying to uv-test-publish January 8, 2026 18:13 — with GitHub Actions Failure

charliermarsh had a problem deploying to uv-test-publish January 8, 2026 18:32 — with GitHub Actions Failure

charliermarsh force-pushed the charlie/direct-s3 branch from 7a7138d to 7ea0b02 Compare January 8, 2026 20:31

charliermarsh temporarily deployed to uv-test-registries January 8, 2026 20:34 — with GitHub Actions Inactive

charliermarsh temporarily deployed to uv-test-publish January 8, 2026 20:34 — with GitHub Actions Inactive

Review feedback

fa48051

charliermarsh force-pushed the charlie/direct-s3 branch from 7ea0b02 to fa48051 Compare January 9, 2026 01:58

charliermarsh temporarily deployed to uv-test-registries January 9, 2026 02:01 — with GitHub Actions Inactive

charliermarsh had a problem deploying to uv-test-publish January 9, 2026 02:01 — with GitHub Actions Failure

charliermarsh enabled auto-merge (squash) January 9, 2026 02:02

charliermarsh disabled auto-merge January 9, 2026 02:26

charliermarsh merged commit 85dedc8 into main Jan 9, 2026
100 of 102 checks passed

charliermarsh deleted the charlie/direct-s3 branch January 9, 2026 02:26

konstin reviewed Jan 9, 2026

View reviewed changes

BrewTestBot mentioned this pull request Jan 9, 2026

uv 0.9.23 Homebrew/homebrew-core#262077

Merged

Enable uploads via pre-signed URLs #17349

Enable uploads via pre-signed URLs #17349

Uh oh!

Conversation

charliermarsh commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zanieb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

woodruffw left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codspeed-hq bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Summary

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

charliermarsh commented Jan 7, 2026 •

edited

Loading

codspeed-hq bot commented Jan 8, 2026 •

edited

Loading