uv publish doesn't respect the --allow-insecure-host flag

[oriori1703]

It seems like uv publish doesn't respect the --allow-insecure-host flag

steps to reproduce

uv command

uv publish --publish-url https://localhost --allow-insecure-host "localhost" --verbose --username="test" --password="test"

output:

DEBUG uv 0.4.25
warning: `uv publish` is experimental and may change without warning
Publishing 2 files https://localhost/
DEBUG Using request timeout of 900s
Uploading sigmatcher-1.3.1-py3-none-any.whl (14.1KiB)
DEBUG Using username/password basic auth
DEBUG Transient request failure for https://localhost/, retrying: error sending request for url (https://localhost/)
  Caused by: client error (Connect)
  Caused by: invalid peer certificate: UnknownIssuer
warning: Transient request failure for https://localhost/, retrying
DEBUG Using username/password basic auth
DEBUG Transient request failure for https://localhost/, retrying: error sending request for url (https://localhost/)
  Caused by: client error (Connect)
  Caused by: invalid peer certificate: UnknownIssuer
warning: Transient request failure for https://localhost/, retrying
DEBUG Using username/password basic auth
error: Failed to publish `dist/sigmatcher-1.3.1-py3-none-any.whl` to https://localhost/
  Caused by: Failed to send POST request
  Caused by: error sending request for url (https://localhost/)
  Caused by: client error (Connect)
  Caused by: invalid peer certificate: UnknownIssuer

mock server

I used the following steps to create a mock https server with self signed certs that can reproduce the issue.

1. generate the cert using:

openssl genrsa  -out server.key 2048
openssl req -new -key server.key -out server.csr -subj "/CN=localhost"
openssl x509 -req -days 1024 -in server.csr -signkey server.key -out server.crt
cat server.crt server.key > server.pem

2. run this python script:

from http.server import HTTPServer, BaseHTTPRequestHandler
import ssl


httpd = HTTPServer(('localhost', 443), BaseHTTPRequestHandler)

context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.load_cert_chain('server.pem', 'server.key')

httpd.socket = context.wrap_socket(httpd.socket, server_side=True)

httpd.serve_forever()

[j178]

Seems related to #6985

[oriori1703]

Seems related to #6985

Are you sure? uv python install doesn't accept --allow-insecure-host at all, while uv publish does accept and uses it (but doesn't work).

[konstin]

Thank you for the great reproducer!

[oriori1703]

Thanks 😊