No keyring support for authentication

[AngellusMortis]

It appears uv does not have support for keyring like pip does.

https://pip.pypa.io/en/stable/topics/authentication/#keyring-support

[zanieb]

This seems reasonable. We'll need to find a Rust equivalent to https://pypi.org/project/keyring/

Perhaps https://github.com/hwchen/keyring-rs

[AngellusMortis]

keyring is a cli app already. Probably want to add support for existing Python one first to maximize compatibility. Different auth methods need different plugins. AWS, Azure and Google Cloud each have their own plugins to use the more secure auth methods (no username/password).

Then you could migrate to a native only solution.

[chris-hartfield]

Agreed that calling the cli is probably easiest. The cli equivalent of what pip is calling in python is really simple: keyring get <url> <username_which_is_often_empty>

[judahrand]

Agreed that calling the cli is probably easiest. The cli equivalent of what pip is calling in python is really simple: keyring get <url> <username_which_is_often_empty>

pip does already actually directly call the CLI tool if keyring isn't installed in the Python environment but is available on PATH or --keyring-provider subprocess is passed - so this behaviour would be consistent.

https://pip.pypa.io/en/stable/topics/authentication/#using-keyring-as-a-command-line-application

[zanieb]

Thanks for the details! Much appreciated.

[judahrand]

This seems reasonable. We'll need to find a Rust equivalent to https://pypi.org/project/keyring/

Perhaps https://github.com/hwchen/keyring-rs

I'd also discourage this approach. There are many Python plugins to keyring for various cloud hosted private Pypi registries (eg. Google Artifact Registry, Azure DevOps, etc). I imagine these would be incompatible with keyring-rs and so you'd lose a lot of the benefit of the keyring integration unless all of these plugins were also reimplemented.

https://github.com/Microsoft/artifacts-keyring
https://github.com/GoogleCloudPlatform/artifact-registry-python-tools

[BakerNet]

As of #2254 --keyring-provider subprocess is available. It has been tested on at least two Google artifact registry projects (using keyrings.google-artifactregistry-auth plugin) as working.

[jonataseduardo]

Sorry for continuing on this topic, but I'm trying to create a uv project that uses an --extra-index-url with Google Cloud Artifact Registry. However, it returns an error indicating that my package can't be found. I am using uv 0.4.18

Here's what I've tried so far:

  gcloud auth application-default login --project ${PROJECT_ID}                      
  uv venv
  source .venv/bin/activate
  uv pip install keyring keyrings.google-artifactregistry-auth
  uv pip install --keyring-provider subprocess ${MY_PACKAGE} --extra-index-url https://${REGION}-python.pkg.dev/${PROJECT_ID}/${REPOSITORY_ID}/simple                            

Interestingly, when I use standard pip, I can install my private package without any issues. Here's the code that works:

  gcloud auth application-default login --project ${PROJECT_ID}                      
  python -m venv .venv
  source .venv/bin/activate
  pip install keyring keyrings.google-artifactregistry-auth
  pip install ${MY_PACKAGE} --extra-index-url https://${REGION}-python.pkg.dev/${PROJECT_ID}/${REPOSITORY_ID}/simple                            

Am I missing something? Any help would be appreciated!

[ffissore]

Try --extra-index-url=https://oauth2accesstoken@${REGION}...

[jonataseduardo]

Try --extra-index-url=https://oauth2accesstoken@${REGION}...

Thanks, it worked when I used this command:

uv pip install ${MY_PACKAGE} --extra-index-url https://oauth2accesstoken:$(gcloud auth print-access-token)@${REGION}-python.pkg.dev/${PROJECT_ID}/${REPOSITORY_ID}/simple

Does this not defeat the purpose of using a keyring?

[zanieb]

@jonataseduardo keyring requires a username to retrieve a password via the CLI — you can just provide the username in the index URL you don't need to include the token too.

[jonataseduardo]

Sure!

The command

uv pip install ${MY_PACKAGE} --keyring-provider subprocess --extra-index-url https://oauth2accesstoken@${REGION}-python.pkg.dev/${PROJECT_ID}/${REPOSITORY_ID}/simple

worked. I had forgotten to include the --keyring-provider subprocess in my last attempt.

It would be helpful to include something like the following in the documentation:

  gcloud auth application-default login --project ${PROJECT_ID}                      
  uv venv
  source .venv/bin/activate
  uv pip install keyring keyrings.google-artifactregistry-auth
  uv pip install --keyring-provider subprocess ${MY_PACKAGE} --extra-index-url https://oauth2accesstoken@${REGION}-python.pkg.dev/${PROJECT_ID}/${REPOSITORY_ID}/simple                              

Thanks a lot!