Skip to content

Fix deadlock on token refresh in uv publish when using pyx #17832

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zanieb merged 1 commit into from
Feb 4, 2026
Merged

Fix deadlock on token refresh in uv publish when using pyx #17832

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 13 additions & 24 deletions crates/uv/src/commands/publish.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ use console::Term;
use owo_colors::{AnsiColors, OwoColorize};
use tokio::sync::Semaphore;
use tracing::{debug, info, trace};
use uv_auth::{Credentials, DEFAULT_TOLERANCE_SECS, PyxTokenStore};
use uv_auth::{Credentials, PyxTokenStore};
use uv_cache::Cache;
use uv_client::{
AuthIntegration, BaseClient, BaseClientBuilder, RedirectPolicy, RegistryClientBuilder,
Expand Down Expand Up @@ -171,7 +171,6 @@ pub(crate) async fn publish(
keyring_provider,
&token_store,
&oidc_client,
&upload_client,
check_url.as_ref(),
Prompt::Enabled,
printer,
Expand Down Expand Up @@ -374,7 +373,6 @@ async fn gather_credentials(
keyring_provider: KeyringProviderType,
token_store: &PyxTokenStore,
oidc_client: &BaseClient,
base_client: &BaseClient,
check_url: Option<&IndexUrl>,
prompt: Prompt,
printer: Printer,
Expand All @@ -400,22 +398,6 @@ async fn gather_credentials(
.expect("Failed to clear publish URL username");
}

// If the user is publishing to pyx, load the credentials from the store.
if username.is_none() && password.is_none() {
if token_store.is_known_url(&publish_url) {
if let Some(token) = token_store
.access_token(
base_client.for_host(token_store.api()).raw_client(),
Copy link
Member Author

@zanieb zanieb Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an always-authenticate client, which means that when we attempt to retrieve the token here we deadlock because we're holding a lock on the token store here and the middleware attempts to take the lock to authenticate its request.

Instead of dealing with that complexity... which I might need to fix separately... we just skip prefetching credentials for pyx (and the subsequent prompt / warnings) and let them be retrieved as normal.

DEFAULT_TOLERANCE_SECS,
)
.await?
{
debug!("Using authentication token from the store");
return Ok((publish_url, Credentials::from(token)));
}
}
}

// If applicable, attempt obtaining a token for trusted publishing.
let trusted_publishing_token = check_trusted_publishing(
username.as_deref(),
Expand All @@ -433,9 +415,14 @@ async fn gather_credentials(
(Some("__token__".to_string()), Some(password.to_string()))
} else {
if username.is_none() && password.is_none() {
match prompt {
Prompt::Enabled => prompt_username_and_password()?,
Prompt::Disabled => (None, None),
// Skip prompting for pyx URLs; the auth middleware will handle authentication.
if token_store.is_known_url(&publish_url) {
(None, None)
} else {
match prompt {
Prompt::Enabled => prompt_username_and_password()?,
Prompt::Disabled => (None, None),
}
}
} else {
(username, password)
Expand All @@ -450,7 +437,10 @@ async fn gather_credentials(
);
}

if username.is_none() && password.is_none() && keyring_provider == KeyringProviderType::Disabled
if username.is_none()
&& password.is_none()
&& keyring_provider == KeyringProviderType::Disabled
&& !token_store.is_known_url(&publish_url)
{
if let TrustedPublishResult::Ignored(err) = trusted_publishing_token {
// The user has configured something incorrectly:
Expand Down Expand Up @@ -547,7 +537,6 @@ mod tests {
KeyringProviderType::Disabled,
&token_store,
&client,
&client,
None,
Prompt::Disabled,
Printer::Quiet,
Expand Down
Loading