Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for --trusted-host #6591

Merged
merged 5 commits into from
Aug 27, 2024
Merged

Add support for --trusted-host #6591

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c6ef656
Trusted host
charliermarsh Aug 24, 2024
c53f6c6
Add settings
charliermarsh Aug 24, 2024
944b756
Use custom type
charliermarsh Aug 24, 2024
e285658
Rename; add more context to dangers
charliermarsh Aug 25, 2024
7ead6fc
Enforce schema
charliermarsh Aug 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 1 addition & 19 deletions crates/uv-cli/src/compat.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,9 +39,6 @@ pub struct PipCompileCompatArgs {
#[clap(long, hide = true)]
client_cert: Option<String>,

#[clap(long, hide = true)]
trusted_host: Option<String>,

#[clap(long, hide = true)]
emit_trusted_host: bool,

Expand Down Expand Up @@ -118,15 +115,9 @@ impl CompatArgs for PipCompileCompatArgs {
));
}

if self.trusted_host.is_some() {
return Err(anyhow!(
"pip-compile's `--trusted-host` is unsupported (uv always requires HTTPS)"
));
}

if self.emit_trusted_host {
return Err(anyhow!(
"pip-compile's `--emit-trusted-host` is unsupported (uv always requires HTTPS)"
"pip-compile's `--emit-trusted-host` is unsupported"
));
}

Expand Down Expand Up @@ -209,9 +200,6 @@ pub struct PipSyncCompatArgs {
#[clap(short, long, hide = true)]
ask: bool,

#[clap(long, hide = true)]
trusted_host: Option<String>,

#[clap(long, hide = true)]
python_executable: Option<String>,

Expand Down Expand Up @@ -265,12 +253,6 @@ impl CompatArgs for PipSyncCompatArgs {
));
}

if self.trusted_host.is_some() {
return Err(anyhow!(
"pip-sync's `--trusted-host` is unsupported (uv always requires HTTPS)"
));
}

if self.config.is_some() {
return Err(anyhow!(
"pip-sync's `--config` is unsupported (uv does not use a configuration file)"
Expand Down
112 changes: 111 additions & 1 deletion crates/uv-cli/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@ use std::str::FromStr;
use anyhow::{anyhow, Result};
use clap::builder::styling::Style;
use clap::{Args, Parser, Subcommand};

use distribution_types::{FlatIndexLocation, IndexUrl};
use pep508_rs::Requirement;
use pypi_types::VerbatimParsedUrl;
use uv_cache::CacheArgs;
use uv_configuration::{
ConfigSettingEntry, IndexStrategy, KeyringProviderType, PackageNameSpecifier, TargetTriple,
TrustedHost,
};
use uv_normalize::{ExtraName, PackageName};
use uv_python::{PythonDownloads, PythonPreference, PythonVersion};
Expand Down Expand Up @@ -678,6 +678,18 @@ fn parse_index_url(input: &str) -> Result<Maybe<IndexUrl>, String> {
}
}

/// Parse a string into an [`Url`], mapping the empty string to `None`.
fn parse_insecure_host(input: &str) -> Result<Maybe<TrustedHost>, String> {
if input.is_empty() {
Ok(Maybe::None)
} else {
match TrustedHost::from_str(input) {
Ok(host) => Ok(Maybe::Some(host)),
Err(err) => Err(err.to_string()),
}
}
}

/// Parse a string into a [`PathBuf`]. The string can represent a file, either as a path or a
/// `file://` URL.
fn parse_file_path(input: &str) -> Result<PathBuf, String> {
Expand Down Expand Up @@ -1559,6 +1571,25 @@ pub struct PipUninstallArgs {
#[arg(long, value_enum, env = "UV_KEYRING_PROVIDER")]
pub keyring_provider: Option<KeyringProviderType>,

/// Allow insecure connections to a host.
///
/// Can be provided multiple times.
///
/// Expects to receive either a hostname (e.g., `localhost`), a host-port pair (e.g.,
/// `localhost:8080`), or a URL (e.g., `https://localhost`).
///
/// WARNING: Hosts included in this list will not be verified against the system's certificate
charliermarsh marked this conversation as resolved.
Show resolved Hide resolved
/// store. Only use `--allow-insecure-host` in a secure network with verified sources, as it
/// bypasses SSL verification and could expose you to MITM attacks.
#[arg(
long,
alias = "trusted-host",
env = "UV_INSECURE_HOST",
value_delimiter = ' ',
charliermarsh marked this conversation as resolved.
Show resolved Hide resolved
value_parser = parse_insecure_host,
)]
pub allow_insecure_host: Option<Vec<Maybe<TrustedHost>>>,

/// Use the system Python to uninstall packages.
///
/// By default, uv uninstalls from the virtual environment in the current working directory or
Expand Down Expand Up @@ -1985,6 +2016,25 @@ pub struct VenvArgs {
#[arg(long, value_enum, env = "UV_KEYRING_PROVIDER")]
pub keyring_provider: Option<KeyringProviderType>,

/// Allow insecure connections to a host.
///
/// Can be provided multiple times.
///
/// Expects to receive either a hostname (e.g., `localhost`), a host-port pair (e.g.,
/// `localhost:8080`), or a URL (e.g., `https://localhost`).
///
/// WARNING: Hosts included in this list will not be verified against the system's certificate
/// store. Only use `--allow-insecure-host` in a secure network with verified sources, as it
/// bypasses SSL verification and could expose you to MITM attacks.
#[arg(
long,
alias = "trusted-host",
env = "UV_INSECURE_HOST",
value_delimiter = ' ',
value_parser = parse_insecure_host,
)]
pub allow_insecure_host: Option<Vec<Maybe<TrustedHost>>>,

/// Limit candidate packages to those that were uploaded prior to the given date.
///
/// Accepts both RFC 3339 timestamps (e.g., `2006-12-02T02:07:43Z`) and local dates in the same
Expand Down Expand Up @@ -3321,6 +3371,26 @@ pub struct InstallerArgs {
)]
pub keyring_provider: Option<KeyringProviderType>,

/// Allow insecure connections to a host.
///
/// Can be provided multiple times.
///
/// Expects to receive either a hostname (e.g., `localhost`), a host-port pair (e.g.,
/// `localhost:8080`), or a URL (e.g., `https://localhost`).
///
/// WARNING: Hosts included in this list will not be verified against the system's certificate
/// store. Only use `--allow-insecure-host` in a secure network with verified sources, as it
/// bypasses SSL verification and could expose you to MITM attacks.
#[arg(
long,
alias = "trusted-host",
env = "UV_INSECURE_HOST",
value_delimiter = ' ',
value_parser = parse_insecure_host,
help_heading = "Index options"
)]
pub allow_insecure_host: Option<Vec<Maybe<TrustedHost>>>,

/// Settings to pass to the PEP 517 build backend, specified as `KEY=VALUE` pairs.
#[arg(
long,
Expand Down Expand Up @@ -3463,6 +3533,26 @@ pub struct ResolverArgs {
)]
pub keyring_provider: Option<KeyringProviderType>,

/// Allow insecure connections to a host.
///
/// Can be provided multiple times.
///
/// Expects to receive either a hostname (e.g., `localhost`), a host-port pair (e.g.,
/// `localhost:8080`), or a URL (e.g., `https://localhost`).
///
/// WARNING: Hosts included in this list will not be verified against the system's certificate
/// store. Only use `--allow-insecure-host` in a secure network with verified sources, as it
/// bypasses SSL verification and could expose you to MITM attacks.
#[arg(
long,
alias = "trusted-host",
env = "UV_INSECURE_HOST",
value_delimiter = ' ',
value_parser = parse_insecure_host,
help_heading = "Index options"
)]
pub allow_insecure_host: Option<Vec<Maybe<TrustedHost>>>,

/// The strategy to use when selecting between the different compatible versions for a given
/// package requirement.
///
Expand Down Expand Up @@ -3635,6 +3725,26 @@ pub struct ResolverInstallerArgs {
)]
pub keyring_provider: Option<KeyringProviderType>,

/// Allow insecure connections to a host.
///
/// Can be provided multiple times.
///
/// Expects to receive either a hostname (e.g., `localhost`), a host-port pair (e.g.,
/// `localhost:8080`), or a URL (e.g., `https://localhost`).
///
/// WARNING: Hosts included in this list will not be verified against the system's certificate
/// store. Only use `--allow-insecure-host` in a secure network with verified sources, as it
/// bypasses SSL verification and could expose you to MITM attacks.
#[arg(
long,
alias = "trusted-host",
env = "UV_INSECURE_HOST",
value_delimiter = ' ',
value_parser = parse_insecure_host,
help_heading = "Index options"
)]
pub allow_insecure_host: Option<Vec<Maybe<TrustedHost>>>,

/// The strategy to use when selecting between the different compatible versions for a given
/// package requirement.
///
Expand Down
35 changes: 35 additions & 0 deletions crates/uv-cli/src/options.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ impl From<ResolverArgs> for PipOptions {
upgrade_package,
index_strategy,
keyring_provider,
allow_insecure_host,
resolution,
prerelease,
pre,
Expand All @@ -55,6 +56,12 @@ impl From<ResolverArgs> for PipOptions {
upgrade_package: Some(upgrade_package),
index_strategy,
keyring_provider,
allow_insecure_host: allow_insecure_host.map(|allow_insecure_host| {
allow_insecure_host
.into_iter()
.filter_map(Maybe::into_option)
.collect()
}),
resolution,
prerelease: if pre {
Some(PrereleaseMode::Allow)
Expand Down Expand Up @@ -82,6 +89,7 @@ impl From<InstallerArgs> for PipOptions {
reinstall_package,
index_strategy,
keyring_provider,
allow_insecure_host,
config_setting,
no_build_isolation,
build_isolation,
Expand All @@ -97,6 +105,12 @@ impl From<InstallerArgs> for PipOptions {
reinstall_package: Some(reinstall_package),
index_strategy,
keyring_provider,
allow_insecure_host: allow_insecure_host.map(|allow_insecure_host| {
allow_insecure_host
.into_iter()
.filter_map(Maybe::into_option)
.collect()
}),
config_settings: config_setting
.map(|config_settings| config_settings.into_iter().collect::<ConfigSettings>()),
no_build_isolation: flag(no_build_isolation, build_isolation),
Expand All @@ -121,6 +135,7 @@ impl From<ResolverInstallerArgs> for PipOptions {
reinstall_package,
index_strategy,
keyring_provider,
allow_insecure_host,
resolution,
prerelease,
pre,
Expand All @@ -142,6 +157,12 @@ impl From<ResolverInstallerArgs> for PipOptions {
reinstall_package: Some(reinstall_package),
index_strategy,
keyring_provider,
allow_insecure_host: allow_insecure_host.map(|allow_insecure_host| {
allow_insecure_host
.into_iter()
.filter_map(Maybe::into_option)
.collect()
}),
resolution,
prerelease: if pre {
Some(PrereleaseMode::Allow)
Expand Down Expand Up @@ -194,6 +215,7 @@ pub fn resolver_options(resolver_args: ResolverArgs, build_args: BuildArgs) -> R
upgrade_package,
index_strategy,
keyring_provider,
allow_insecure_host,
resolution,
prerelease,
pre,
Expand Down Expand Up @@ -233,6 +255,12 @@ pub fn resolver_options(resolver_args: ResolverArgs, build_args: BuildArgs) -> R
upgrade_package: Some(upgrade_package),
index_strategy,
keyring_provider,
allow_insecure_host: allow_insecure_host.map(|allow_insecure_host| {
allow_insecure_host
.into_iter()
.filter_map(Maybe::into_option)
.collect()
}),
resolution,
prerelease: if pre {
Some(PrereleaseMode::Allow)
Expand Down Expand Up @@ -268,6 +296,7 @@ pub fn resolver_installer_options(
reinstall_package,
index_strategy,
keyring_provider,
allow_insecure_host,
resolution,
prerelease,
pre,
Expand Down Expand Up @@ -319,6 +348,12 @@ pub fn resolver_installer_options(
},
index_strategy,
keyring_provider,
allow_insecure_host: allow_insecure_host.map(|allow_insecure_host| {
allow_insecure_host
.into_iter()
.filter_map(Maybe::into_option)
.collect()
}),
resolution,
prerelease: if pre {
Some(PrereleaseMode::Allow)
Expand Down
Loading
Loading