Description
Summary
Hello, we are witnessing an issue with uv pip install -r requirements.txt. We are using an instance of pypicloud backed by S3 (we are aware it's unmaintained, but it still works with pip, so it should work with uv pip too.)
To reproduce, we can have a very simple requirements.txt file that looks like this:
--index-url https://pypi.example.com
package-from-private-registry
Set up uv:
% uv --version
uv 0.7.2 (Homebrew 2025-04-30)
% uv venv
Using CPython 3.13.2
Creating virtual environment at: .venv
Activate with: source .venv/bin/activate(Outputs edited)
- Now invoke
uv pip install -r requirements.txt:
% uv pip install -r requirements.txt
Using Python 3.11.9 environment at: /Users/creston/.local/share/virtualenvs/creston-VATBnwns
⠴ package-from-private-registry==1.61.0
error: Failed to fetch: `https://pypi.example.com/api/package/package-from-private-registry/package-from-private-registry-1.61.0-py3-none-any.whl`
Caused by: HTTP status client error (403 Forbidden) for url (https://pypi-example.s3.amazonaws.com/pypi/a7ea/package-from-private-registry/package-from-private-registry-1.61.0-py3-none-any.whl?AWSAccessKeyId=scrubbed&Signature=scrubbed&x-amz-security-token=scrubbed&Expires=1746729457)
- Now invoke it again (identical command, don't do anything else)
% uv pip install -r requirements.txt
Using Python 3.11.9 environment at: /Users/creston/.local/share/virtualenvs/creston-VATBnwns
⠴ package-from-private-registry==1.61.0
error: Failed to fetch: `https://pypi.example.com/api/package/package-from-private-registry/package-from-private-registry-1.61.0-py3-none-any.whl`
Caused by: HTTP status client error (403 Forbidden) for url (https://pypi-example.s3.amazonaws.com/pypi/a7ea/package-from-private-registry/package-from-private-registry-1.61.0-py3-none-any.whl?AWSAccessKeyId=scrubbed&Signature=scrubbed&x-amz-security-token=scrubbed&Expires=1746729457)
Exact same result.
- But do it again a third time (again, identical command) and it suddenly works!
% uv pip install -r requirements.txt
Using Python 3.11.9 environment at: /Users/creston/.local/share/virtualenvs/creston-VATBnwns
Resolved 38 packages in 2.79s
Prepared 29 packages in 575ms
Uninstalled 2 packages in 6ms
Installed 29 packages in 99ms
+ attrs==25.3.0
+ boto3==1.38.10
+ botocore==1.38.10
+ cffi==1.17.1
+ deprecated==1.2.18
+ deprecation==2.1.0
+ importlib-metadata==8.6.1
+ jmespath==1.0.1
+ minject==1.5.0
+ opentelemetry-api==1.32.1
+ prometheus-client==0.21.1
+ pycparser==2.22
+ pyjwt==2.10.1
+ pymemcache==4.0.0
+ pynacl==1.5.0
+ redis==6.0.0
- requests==2.31.0
+ requests==2.32.3
+ s3transfer==0.12.0
+ sentry-sdk==2.27.0
+ types-protobuf==6.30.2.20250506
+ types-pyyaml==6.0.12.20250402
+ types-requests==2.32.0.20250328
- typing-extensions==4.12.2
+ typing-extensions==4.13.2
+ wrapt==1.17.2
+ zipp==3.21.0
This issue started recently (perhaps in the last 1-2 days). Before we never had trouble with this setup. But it's not clear that anything has changed with uv. Regardless, it's reproducible on multiple versions of uv including the latest 0.7.2.
Sometimes the failure happens 0 or 1 times, but never more than twice. Not sure if that's a clue or just coincidence.
Platform
macOS arm64 15.3.2 (24D81)
Version
0.7.2 (and others)
Python version
3.11.9 (and others)