uv: Fetching Error with Custom Index

Hi, I’m looking forward to try uv. At work we use custom index server for security built on pypicloud. When I try to install an internal library with --index-url I receive an error message of,

Caused by: Unexpected fragment (expected `#sha256=...`) on URL: 11eb659cf9b2e36455d3f41f0...

I clipped the fragment but it’s exactly 64 character ascii string. My exact command was,

uv --verbose pip install internal-lib --index-url internal-index

The same command using pip works. The verbose logs are (clipping out some company specific names),

uv_resolver::resolver::choose_version package=internal-lib
     uv_resolver::resolver::package_wait package_name=internal-lib
 uv_resolver::resolver::process_request request=Versions internal-lib
   uv_client::registry_client::simple_api package=internal-lib
     uv_client::cached_client::get_cacheable
       uv_client::cached_client::read_and_parse_cache file=/Users/mdrissi/Library/Caches/uv/simple-v3/a3d7793f86811a03/internal-lib.rkyv
 uv_resolver::resolver::process_request request=Prefetch internal-lib *
 uv_client::cached_client::from_path_sync path="/Users/mdrissi/Library/Caches/uv/simple-v3/a3d7793f86811a03/internal-lib.rkyv"
          0.154248s   0ms DEBUG uv_client::cached_client No cache entry for: intenal-index/internal-lib/
       uv_client::cached_client::fresh_request url="url"
       uv_client::cached_client::new_cache file=/Users/mdrissi/Library/Caches/uv/simple-v3/a3d7793f86811a03/internal-lib.rkyv
       uv_client::registry_client::parse_simple_api package=internal-lib
         uv_client::html::parse url=url
         error: Received some unexpected HTML from url/
  Caused by: Unexpected fragment (expected `#sha256=...`) on URL: 11eb659cf9b2e36455d3f41f03...

I’ll try to ask the security team that maintains custom index if there’s any more information I can provide. Hopefully this reproduces with any pypicloud index. Unsure if relevant, but I also know files are hosted in GCS. The error does seem to imply it’s able to fetch some html response.

I installed uv today, uv --version shows uv 0.1.13 (9ce5170e6 2024-02-29).

About this issue

Original URL
State: closed
Created 4 months ago
Comments: 35 (19 by maintainers)

Commits related to this issue

Fallback to non-range requests when HEAD returns 404 (#2186) ## Summary We have at least one reported case of this happening. It's preferable IMO to move on rather than fail hard despite sub-pbar... — committed to astral-sh/uv by charliermarsh 4 months ago

Most upvoted comments

Yeah it’s easy for me to get any pip/response info, but our internal index server unsure I have access (nor awareness) to debug. Hopefully I can get one of security engineers that works on our index server to see if they are aware why the prefix is missing.

edit: My personal guess is our setup has proxy internal server and I have a feeling we only ever use one hash type (say sha256) so it’s unnecessary to include which type it is. The proxy might also already be doing validation. That’s gut guess though as I don’t have full knowledge on index setup.

hmc-cs-mdrissi on Mar 1, 2024