`uv sync/add` does not use (private) extra-index-url/index-url specified in pyproject.toml (but works from command line)

[caseytomlin]

I feel like this is a duplicate, but I didn't see precisely this - apologies in advance!

I am trying to install a package from a private index that requires authentication. The following works:

$ uv add super-secret-package --index-url https://<user>:<password>@secretinos.com/artifactory/api/pypi/cheese/simple --extra-index-url https://pypi.org/simple

Instead adding the indexes by hand to the pyproject.toml as

[tool.uv]
extra-index-url = "https://pypi.org/simple"
index-url = "https://<user>:<password>@secretinos.com/artifactory/api/pypi/cheese/simple"

and then $ uv sync -vvv or $ uv add -vvv super-secret-package fails like

    0.000947s DEBUG uv uv 0.4.12
    0.001059s DEBUG uv_workspace::workspace Found project root: `/home/yourboy/projects/test`
    0.001146s DEBUG uv_workspace::workspace No workspace root found, using project root
    0.001223s DEBUG uv_python::version_files Reading requests from `/home/yourboy/projects/test/.python-version`
    0.001376s DEBUG uv::commands::project The virtual environment's Python version satisfies `Python 3.12`
 uv_client::linehaul::linehaul 
    0.001604s DEBUG uv_client::base_client Using request timeout of 30s
 uv_resolver::flat_index::from_entries 
    0.001722s DEBUG uv::commands::project::lock Starting clean resolution
 uv_distribution::distribution_database::get_or_build_wheel_metadata dist=test @ file:///home/yourboy/projects/test
    0.001994s   0ms DEBUG uv_distribution::source Found static `pyproject.toml` for: test @ file:///home/yourboy/projects/test
    0.002077s   0ms DEBUG uv_workspace::workspace No workspace root found, using project root
 uv_resolver::resolver::solve 
    0.002488s   0ms DEBUG uv_resolver::resolver Solving with installed Python version: 3.12.6
    0.002500s   0ms DEBUG uv_resolver::resolver Solving with target Python version: >=3.12
   uv_resolver::resolver::choose_version package=root
   uv_resolver::resolver::get_dependencies_forking package=root, version=0a0.dev0
     uv_resolver::resolver::get_dependencies package=root, version=0a0.dev0
    0.002652s   0ms DEBUG uv_resolver::resolver Adding direct dependency: test*
   uv_resolver::resolver::choose_version package=test
      0.002703s   0ms DEBUG uv_resolver::resolver Searching for a compatible version of test @ file:///home/yourboy/projects/test (*)
   uv_resolver::resolver::get_dependencies_forking package=test, version=0.1.0
     uv_resolver::resolver::get_dependencies package=test, version=0.1.0
    0.002751s   0ms DEBUG uv_resolver::resolver Adding transitive dependency for test==0.1.0: super-secret-package==69.420
   uv_resolver::resolver::choose_version package=super-secret-package
 uv_resolver::resolver::process_request request=Versions super-secret-package
   uv_client::registry_client::simple_api package=super-secret-package
     uv_client::cached_client::get_cacheable 
       uv_client::cached_client::read_and_parse_cache file=/home/yourboy/.cache/uv/simple-v12/pypi/super-secret-package.rkyv
 uv_resolver::resolver::process_request request=Prefetch super-secret-package ==69.420
 uv_client::cached_client::from_path_sync path="/home/yourboy/.cache/uv/simple-v12/pypi/super-secret-package.rkyv"
        0.002971s   0ms DEBUG uv_client::cached_client No cache entry for: https://pypi.org/simple/super-secret-package/
       uv_client::cached_client::fresh_request url="https://pypi.org/simple/super-secret-package/"
      0.159403s 156ms DEBUG uv_resolver::resolver Searching for a compatible version of super-secret-package (==69.420)
    0.159432s 156ms DEBUG uv_resolver::resolver No compatible version found for: super-secret-package
   uv_resolver::resolver::choose_version package=test
      0.159494s   0ms DEBUG uv_resolver::resolver Searching for a compatible version of test @ file:///home/yourboy/projects/test (<0.1.0 | >0.1.0)
    0.159503s 157ms DEBUG uv_resolver::resolver No compatible version found for: test
  × No solution found when resolving dependencies:
  ╰─▶ Because super-secret-package was not found in the package registry and your project depends on super-secret-package==69.420, we can conclude that your project's requirements are unsatisfiable.

I also tried swapping index-url and extra-index-url with the same result.

[charliermarsh]

I think extra index URL needs to be a list in the TOML. Does that fix it?

[caseytomlin]

Unfortunately not. I tried

[tool.uv]
extra-index-url = ["https://pypi.org/simple"]
index-url = ["https://<user>:<password>@secretinos.com/artifactory/api/pypi/cheese/simple"]

(also swapping which is extra). Same -vvv output.

[charliermarsh]

index-url should be a string; extra-index-url should be a list.

[caseytomlin]

Ha, that did it. Apologies for the noise. Did i miss this in the docs somewhere?

[charliermarsh]

Are there any warnings in the --verbose output? I would've expected this to at least warn with --verbose.

[charliermarsh]

There's just the reference schema here: https://docs.astral.sh/uv/reference/settings/#extra-index-url