Unify packse find links urls

[konstin]

The sync scenarios script is broken, so i did the updates manually

$ ./scripts/sync_scenarios.sh
Setting up a temporary environment...
Using Python 3.12.1 interpreter at: /home/konsti/projects/uv/.venv/bin/python3
Creating virtualenv at: .venv
Activate with: source .venv/bin/activate
  × No solution found when resolving dependencies:
  ╰─▶ Because docutils==0.21.post1 is unusable because the package metadata was inconsistent and you require docutils==0.21.post1, we can conclude that the requirements are unsatisfiable.

      hint: Metadata for docutils==0.21.post1 was inconsistent:
        Package metadata version `0.21` does not match given version `0.21.post1`

[zanieb]

Should we call it like BUILD_VENDOR_LINKS_URL to make it clearer whats in here?

[zanieb]

It'd be nice to document why it's useful too. I added this so we could use --index-url instead of --extra-index-url to prevent dependency confusion attacks against our test suite, but without vendoring build dependencies that will generally fail.

[charliermarsh]

The sync scenarios script is broken

I can't reproduce this, any idea what's going on there?

[konstin]

The docutils source dist is inconsistent about its version number: https://inspector.pypi.io/project/docutils/0.21/ . Haven't checked yet where that breaks uv

[charliermarsh]

Note that I changed / fixed this behavior last night: #2953. But why is your system using the source distribution?

[zanieb]

I tested with the sync script in #2970