Support unnamed requirements in uv add
#4237
Conversation
ibraheemdev
force-pushed
the
uv-add-unnamed
branch
from
8e7b8ee to
6c08dd4
Compare
|
I'm not 100% sure about all the CLI arguments here, would appreciate a more thorough audit of those. For example, I didn't add |
ibraheemdev
force-pushed
the
uv-add-unnamed
branch
from
6c08dd4 to
b151bb1
Compare
| origin: requirement.origin, | ||
| version_or_url: match requirement.source { | ||
| RequirementSource::Registry { specifier, .. } => { | ||
| Some(VersionOrUrl::VersionSpecifier(specifier)) |
There was a problem hiding this comment.
This is a little weird because we lose the distinction between empty version specifiers and None, but that doesn't seem relevant for formatting at least.
| let requirements = requirements | ||
| .into_iter() | ||
| .map(RequirementsSource::Package) | ||
| .collect_vec(); |
There was a problem hiding this comment.
I think it would be more conventional for this piece to be in main.rs (or, at least, we do that for the other commands).
| let flat_index = { | ||
| let client = FlatIndexClient::new(&client, cache); | ||
| let entries = client.fetch(index_locations.flat_index()).await?; | ||
| FlatIndex::from_entries(entries, Some(&tags), &hasher, &no_build, &NoBinary::None) |
There was a problem hiding this comment.
Can we define this NoBinary as let no_binary = NoBinary::default(), and put it with all the other defaults below? Like, move that block up to line 75 or so?
There was a problem hiding this comment.
I'd like to have something that looks like the // TODO(charlie): Respect project configuration. block in do_lock, just so we have consistency and it's easier to fix them all later.
crates/uv/src/cli.rs
Outdated
| /// "dependency confusion" attacks, whereby an attack can upload a malicious package under the | ||
| /// same name to a secondary | ||
| #[arg(long, value_enum, env = "UV_INDEX_STRATEGY")] | ||
| pub(crate) index_strategy: Option<IndexStrategy>, |
There was a problem hiding this comment.
I think you could feasibly omit this, keyring_provider, python_version, python_platform, link_mode, build_isolation, ... We don't support them in lock or sync or run yet and need to tackle the problem holistically. Honestly, it might be best to omit them for now so we don't tie ourselves to them.
## Summary Stealing this from @ibraheemdev's #4237 because it's a nice, isolated change and I'm about to build atop it.
ibraheemdev
force-pushed
the
uv-add-unnamed
branch
from
b151bb1 to
221f364
Compare
|
Moved to #4326 (switched to a local branch). |
Summary
Support unnamed URL requirements in
uv add. For example,uv add git+https://github.com/pallets/flask.Part of #3959.