Adding a package and pinning to a specific index by name only with `uv add`

[menzenski]

This issue is something of a followup to #6582, which was a duplicate of #171. That issue has comments #171 (comment) and #171 (comment) which seems to be the same thing I am interested in here (but I can't find anything in search that suggests those have been opened as independent issues yet).

Desired Behavior

Given an index definition named my_artifactory in pyproject.toml:

[[tool.uv.index]]
name = "my_artifactory"
url = "https://myorg.jfrog.io/artifactory/api/pypi/pypi/simple"
explicit = true

I would like to be able to run uv add my-private-package --index my_artifactory (or similar command - the important part here is that the CLI command references an index by name only, not by name and URL), with the resulting behavior that the package has been added and pinned to that specific index. Desired output in pyproject.toml:

dependencies = [
    "my-private-package>=0.18.0",
]

[tool.uv.sources]
my-private-package = { index = "my_artifactory" }

Current Workaround

My current workaround is to add the tool.uv.sources entry first, manually in the pyproject.toml file:

[tool.uv.sources]
my-private-package = { index = "my_artifactory" }

Then I can run uv add my-private-package. But I would prefer not to be manually updating pyproject.toml for this - it would be nice to be able to do all "add/update dependency" tasks via the uv CLI.

Comparison to Poetry

I am trying to migrate from Poetry to uv. With Poetry, I can specify an explicit source in pyproject.toml:

[[tool.poetry.source]]
name = "my_artifactory"
url = "https://myorg.jfrog.io/artifactory/api/pypi/pypi/simple"
priority = "explicit"

and add a dependency using poetry add with a --source my_artifactory option, e.g.:

$ poetry add my-private-package --source my_artifactory

The result of this command is a package that is pinned to that specific source:

[tool.poetry.dependencies]
my-private-package = {version = "^0.18.0", source = "my_artifactory"}

I am hoping that the same behavior is possible with uv.

[charliermarsh]

I agree that this should work.

[vmgustavo]

Yes please. It is a great feature for whoever uses private repositories a lot.

[charliermarsh]

If it's easier to do this with a separate argument (like --index-name), I'm fine with that.

[charliermarsh]

(As in, using uv add foo --index-name bar instead of uv add foo --index https://..., when bar already exists.)

[zanieb]

Don't we accept --index <name> elsewhere? or am I misremembering?

[Gankra]

The complexity/issue here is that uv add already takes --index, by inheriting (flattening) in ResolverInstallerArgs, which inherits IndexArgs which actually defines the flag. That version of the index flag is used by tons of different commands, and since it's currently always a URL it's eagerly parsed/resolved at CLI parsing time and everything expects to be able to pass it directly to stuff that wants indexes.

So adding support for this special "lazily resolved by name" index mode forces tons of other commands to suddenly contend with having to also implement this lazy resolving or at least adding a "not supported" check/error.

uv publish does take an index by name but it doesn't used IndexArgs so it doesn't have this extra splash-work to do.

I started implementing this, but backed off once the combinatoric explosion of things that needed to be updated started to reveal itself to me.

[jamesowers-cohere]

Just to add to this. There's currently something that's quite confusing when using uv pip install or uv tool install (this relates more to the linked other issue: #12796).

I have a /etc/uv/uv.toml containing some index definitions, e.g.:

keyring-provider = "subprocess"

[[index]]
name = "my-index-py"
url = "https://oauth2accesstoken@.../my-index-py/simple"
publish-url = "https://oauth2accesstoken@.../my-index-py"
explicit = true

[[index]]
name = "my-index-py-test"
url = "https://oauth2accesstoken@.../my-index-py-test/simple"
publish-url = "https://oauth2accesstoken@.../my-index-py-test"
explicit = true

When I execute

uv tool install --index my-index-py ...

or

uv pip install --index my-index-py ...

no error is returned. Even when I use -vv to get more verbose output, it is very unclear to see that the --index my-index-py is just being ignored. This is particularly confusing in the context when there is a package in both my-index-py and pypi with the same name. I will get the one from pypi and no error will be thrown. This is a bit of a security concern for me!

In the interim whilst this feature is considered/developed, please may we raise an error if a user specifies --index ... and that index is not able to be used?