search

astral-sh / uv

An extremely fast Python package and project manager, written in Rust.
https://docs.astral.sh/uv
Apache License 2.0
27.23k stars 785 forks source link

Allow `--token` to be empty if `--keyring-provider` is set with `uv publish` #9227

Open KalleDK opened 3 days ago

KalleDK commented 3 days ago

uv 0.4.30

Right now it kinda works with token and keyring when publishing

I would love for uv publish --keyring-provider=subprocess to work by first asking for token and then username / password. Alternative uv publish --keyring-provider=subprocess --token should work. Hope I make sense

Fails with interactive

$ uv publish --keyring-provider=subprocess
warning: `uv publish` is experimental and may change without warning
Publishing 2 files https://upload.pypi.org/legacy/
Enter username ('__token__' if using a token): 
Enter password: 
Uploading example-0.1.11-py3-none-any.whl (1.9KiB)
error: Failed to publish `dist/example-0.1.11-py3-none-any.whl` to https://upload.pypi.org/legacy/
  Caused by: Upload failed with status code 403 Forbidden. Server says: 403 Username/Password authentication is no longer supported. Migrate to API Tokens or Trusted Publishers instead. See https://pypi.org/help/#apitoken and https://pypi.org/help/#trusted-publishers

Fails with token

uv publish --keyring-provider=subprocess --token
error: a value is required for '--token <TOKEN>' but none was supplied

For more information, try '--help'.

Strangely works if you kinda combine

uv publish --keyring-provider=subprocess --username=__token__
warning: `uv publish` is experimental and may change without warning
Publishing 2 files https://upload.pypi.org/legacy/
Uploading example-0.1.11-py3-none-any.whl (1.9KiB)
Uploading example-0.1.11.tar.gz (15.4KiB)
konstin commented 3 days ago

Would https://github.com/astral-sh/uv/pull/8806/files explain that?

KalleDK commented 3 days ago

Would https://github.com/astral-sh/uv/pull/8806/files explain that?

I don't think it explains it - It explains how to use it which solves 99%. I'm just curious why there is some magic by giving the username by switch it then tries the keyring and auth by token, but not when you give it by interactive means. And again I would love for it to first try to get a token from keyring, and then username password, if that fails, from keyring before going interactive (when you have enabled keyring)