Failure to download packages from Azure Artifacts starting version 0.7.0

[ycheng517]

Summary

Starting with UV 0.7.0 just today, I can no longer download packages from Azure Artifacts. Error:

uv sync
Resolved 382 packages in 0.74ms
  × Failed to download `my-private-pkg==4.0.0`
  ├─▶ Failed to extract archive: my_private_pkg-4.0.0-py3-none-any.whl
  ├─▶ an upstream reader returned an error: unexpected end of file
  ╰─▶ unexpected end of file

In the verbose logs I see the following which might be relevant:

TRACE Cached response https://pkgs.dev.azure.com/XXXXXX/_packaging/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX/pypi/download/my-private-pkg/4/my_private_pkg-4.0.0-py3-none-any.whl is not storable because it does not meet any of the necessary criteria (e.g., it doesn't have an 'Expires' header set or a 'max-age' cache-control directive)
TRACE Considering retry of error: Extract("my_private_pkg-4.0.0-py3-none-any.whl", AsyncZip(UpstreamReadError(Kind(UnexpectedEof))))
TRACE Retrying error: `ConnectionReset` or `UnexpectedEof`
DEBUG Transient failure while handling response from https://pkgs.dev.azure.com/XXXXXX/_packaging/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX/pypi/download/my-private-pkg/4/my_private_pkg-4.0.0-py3-none-any.whl; retrying...

These are the relevant portions of my pyproject.toml file:

dependencies = [
  "my-private-pkg>=4.0",
  ...
]

[tool.uv.sources]
my-private-pkg = { index = "azure" }
...

[[tool.uv.index]]
name = "azure"
url = "https://pkgs.dev.azure.com/XXXXXX/_packaging/XXXXXX/pypi/simple"

Platform

Ubuntu 24.04 amd64

Version

uv 0.7.0

Python version

Python 3.12.3

[zanieb]

Thanks for the report. You can confirm this works on 0.6.17?

[zanieb]

Does this occur every time, or intermittently?

[zanieb]

Can you share full verbose logs? Perhaps in a Gist?

[ycheng517]

I can confirm this works if I revert back to 0.6.16. It happens every time. I will try to send a Gist shortly, just need some time to redact some names.

[zanieb]

Wonderful, thank you!

cc @jtfmumm

[zanieb]

Just to make sure, because it narrows down where we're looking, 0.6.17 works or fails? You referenced 0.6.16.

[ycheng517]

I just tried 0.6.17, it also works. Here's verbose logs of the failure on 0.7.0. Note that for this log, I'm simply adding a private package, as it's a simpler manifestation of the issue.

Note that the package I'm adding was built using uv build --wheel on UV version 0.6.16.

[raiderrobert]

I also have this issue with uv starting on version 0.7.0. I also use Azure Artifacts.

[charliermarsh]

Thanks for the detailed logs -- we'll take a look. Unfortunately I don't see anything in the changelog that's obviously relevant here...

[zanieb]

A log of the success for comparison would be helpful too.

[zanieb]

The key seems to be around

TRACE Attempting unauthenticated request for https://pkgs.dev.azure.com/My-Project-Name/_packaging/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX/pypi/download/rr-config/4/rr_config-4.0.0-py3-none-any.whl
TRACE Request for https://pkgs.dev.azure.com/My-Project-Name/_packaging/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX/pypi/download/rr-config/4/rr_config-4.0.0-py3-none-any.whl failed with 401 Unauthorized, checking for credentials
TRACE Found cached credentials for realm https://pkgs.dev.azure.com
TRACE Retrying request for https://pkgs.dev.azure.com/My-Project-Name/_packaging/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX/pypi/download/rr-config/4/rr_config-4.0.0-py3-none-any.whl with credentials from cache Basic { username: Username(Some("My-Username")), password: Some(****) }
TRACE Cached response https://pkgs.dev.azure.com/My-Project-Name/_packaging/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX/pypi/download/rr-config/4/rr_config-4.0.0-py3-none-any.whl is not storable because it does not meet any of the necessary criteria (e.g., it doesn't have an 'Expires' header set or a 'max-age' cache-control directive)
TRACE Considering retry of error: Metadata("https://pkgs.dev.azure.com/My-Project-Name/_packaging/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX/pypi/download/rr-config/4/rr_config-4.0.0-py3-none-any.whl", AsyncZip(UpstreamReadError(Kind(UnexpectedEof))))
TRACE Retrying error: `ConnectionReset` or `UnexpectedEof`
TRACE Received built distribution metadata for: rr-config==4.0.0
WARN rr-config==4.0.0 has an invalid package format: Failed to read from zip file
WARN rr-config has an invalid package format: Failed to read from zip file

How are you providing credentials?

[paulstaab]

Happens for us as well using Azure Devops Artifacts Feed.

~/.config/uv/uv.toml:

[[index]]
name = "internal"
url = "https://***@pkgs.dev.azure.com/DDC-DAAI/_packaging/***/pypi/simple"
default = true

Here is the log with all sensible values replaced with *** for versions 0.7.0 and 0.6.17:

uv pip install -vvv -U "pip==25.1" 2> uv-0.7.0.log

uv-0.7.0.log
uv-0.6.17.log

Providing the credentials via UV_INDEX_INTERNAL_PASSWORD produces the same problem.

[jenshnielsen]

I am seeing the same issue. I have my feed configured via UV_INDEX_URL env variable as https://VssSessionToken@myorg.pkgs.visualstudio.com/_packaging/myfeed/pypi/simple and artifacts-keyring installed as a uv tool