HTTP status client error (401 Unauthorized) / (403 Forbidden) for packages hosted on a JFrog PyPI repo

[ealap]

Similar to an issue reported at #2444, the authentication fails when trying to install packages from extra index URL pointing to a JFrog PyPI repo

export UV_EXTRA_INDEX_URL="https://<JFROG_USERNAME>:<JFROG_ACCESS_TOKEN>@<JFROG_ARTIFACTORY_URL>/api/pypi/simple"
uv pip install --verbose --compile --no-cache --requirement="requirements.txt" --override="override.txt"

# Output
# A bunch logs like these
DEBUG No cache entry for: https://<JFROG_ARTIFACTORY_URL>/api/pypi/packages/xxx/xxx/packageAAA-1.0.0.whl#sha256=xxx
DEBUG Adding authentication to already-seen URL: https://<JFROG_ARTIFACTORY_URL>/api/pypi/packages/xxx/xxx/packageAAA-1.0.0.whl#sha256=xxx

# then finally 403 error
error: Failed to download: packageBBB==31.4.0
  Caused by: HTTP status client error (403 Forbidden) for url (https://<JFROG_ARTIFACTORY_URL>/api/pypi/packages/xxx/xxx/packageBBB==31.4.0.whl#sha256=xxx)

# sometimes 401 error
error: Failed to download: packageCCC==2.3.0
  Caused by: HTTP status client error (401 Unauthorized) for url (https://<JFROG_ARTIFACTORY_URL>/api/pypi/packages/xxx/xxx/packageCCC==2.3.0.whl#sha256=xxx)

uv versions where it doesn't work:

uv==0.1.19
uv==0.1.22 # current latest at the time of this issue

The issue was fixed by on v0.1.20 likely because it has the same root cause as #2444 that was fixed by #2446). But it got broken again on v0.1.22 likely due to #2449.

[zanieb]

Can you confirm that the JFROG_ARTIFACTORY_URL part of the URL is consistent?

Are there logs like No credentials found for: ... and Request already has an authorization header: ...? Do you think you can share the full logs?

[ealap]

Yes, JFROG_ARTIFACTORY_URL is the same for all packages.

Here's the install log (with redacted info)

DEBUG Found a virtualenv through VIRTUAL_ENV at: /home/ealap/.cache/pypoetry/virtualenvs/sample-project-L4q7N5gd-py3.10
DEBUG Probing interpreter info for: /home/ealap/.cache/pypoetry/virtualenvs/sample-project-L4q7N5gd-py3.10/bin/python
DEBUG Found Python 3.10.13 for: /home/ealap/.cache/pypoetry/virtualenvs/sample-project-L4q7N5gd-py3.10/bin/python
DEBUG Using Python 3.10.13 environment at �[36m/home/ealap/.cache/pypoetry/virtualenvs/sample-project-L4q7N5gd-py3.10/bin/python�[39m
DEBUG Using registry request timeout of 300s
DEBUG Solving with target Python version 3.10.13
DEBUG Adding direct dependency: sympy==1.11.0
DEBUG No cache entry for: https://<JFROG_ARTIFACTORY_URL>/api/pypi/build/simple/sympy/
DEBUG Request already has an authorization header: https://<JFROG_ARTIFACTORY_URL>/api/pypi/build/simple/sympy/
DEBUG Searching for a compatible version of sympy (==1.11.0)
DEBUG Selecting: sympy==1.11.0 (sympy-1.11.0-py3-none-any.whl)
DEBUG No cache entry for: https://<JFROG_ARTIFACTORY_URL>/api/pypi/build/packages/packages/d0/04/66be21ceb305c66a4b326b0ae44cc4f027a43bc08cac204b48fb45bb3653/sympy-1.11.0-py3-none-any.whl#sha256=df75d738930f6fe9ebe7034e59d56698f29e85f443f743e51e47df0caccc2130
DEBUG Adding authentication to already-seen URL: https://<JFROG_ARTIFACTORY_URL>/api/pypi/build/packages/packages/d0/04/66be21ceb305c66a4b326b0ae44cc4f027a43bc08cac204b48fb45bb3653/sympy-1.11.0-py3-none-any.whl#sha256=df75d738930f6fe9ebe7034e59d56698f29e85f443f743e51e47df0caccc2130
error: Failed to download: sympy==1.11.0
  Caused by: HTTP status client error (403 Forbidden) for url (https://<JFROG_ARTIFACTORY_URL>/api/pypi/build/packages/packages/d0/04/66be21ceb305c66a4b326b0ae44cc4f027a43bc08cac204b48fb45bb3653/sympy-1.11.0-py3-none-any.whl#sha256=df75d738930f6fe9ebe7034e59d56698f29e85f443f743e51e47df0caccc2130)

[zanieb]

Thanks!