Route proxy artifacts through physical endpoints - #20214
Open
zsol wants to merge 3 commits into
Open
Conversation
zsol
force-pushed
the
zsol/proxy-index-07-artifact-routing
branch
3 times, most recently
from
July 8, 2026 00:03
b099044 to
8118113
Compare
This was referenced Jul 14, 2026
zsol
marked this pull request as ready for review
July 17, 2026 14:45
zsol
force-pushed
the
zsol/proxy-index-07-artifact-routing
branch
from
July 23, 2026 13:22
8118113 to
de6872f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Existing locks retain canonical registry artifact identities. When that canonical index is routed through a proxy, uv needs to rediscover the exact locked file through the current physical endpoint; otherwise metadata requests and downloads can bypass the proxy or use the wrong cache shard.
This PR adds locked artifact rediscovery by exact filename and digest. When the proxy advertises one of the locked hashes, uv uses the normal metadata path. If it does not advertise a comparable hash, uv streams the full wheel to a temporary file and validates it against the lock before parsing its metadata. The canonical index owns the resolution and lock identity, while the physical endpoint takes care of request URLs, authentication, status and cache-control policy, capability attribution, redirects, and errors.
Artifact reads and writes use only the current physical endpoint’s cache shard (for now; this might be a future optimization opportunity, or rendered moot by #19693). Direct indexes retain their existing behavior because their physical and canonical endpoints are identical. Since proxies are not configurable as of this PR, all indexes are direct.
URL-form proxy indexes can satisfy existing locks but remain excluded from fresh resolution. Lock canonicalization, artifact URL mapping, and proxy configuration remain separate follow-ups.