feat: allow configuring pypi insecure host

crates/pixi_config/Cargo.toml

@@ -26,6 +26,7 @@ serde_json = { workspace = true }
 toml_edit = { workspace = true, features = ["serde"] }
 tracing = { workspace = true }
 url = { workspace = true }
+uv-configuration = { workspace = true }
 
 [dev-dependencies]
 insta = { workspace = true, features = ["yaml"] }

crates/pixi_config/src/lib.rs

@@ -19,6 +19,7 @@ use rattler_repodata_gateway::{Gateway, SourceConfig};
 use reqwest_middleware::ClientWithMiddleware;
 use serde::{de::IntoDeserializer, Deserialize, Serialize};
 use url::Url;
+use uv_configuration::TrustedHost;
 
 pub fn default_channel_config() -> ChannelConfig {
     ChannelConfig::default_with_root_dir(
@@ -241,6 +242,10 @@ pub struct PyPIConfig {
     #[serde(default)]
     #[serde(skip_serializing_if = "Option::is_none")]
     pub keyring_provider: Option<KeyringProvider>,
+    /// Allow insecure connections to a host
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub allow_insecure_host: Vec<TrustedHost>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
@@ -286,6 +291,11 @@ impl PyPIConfig {
             index_url: other.index_url.or(self.index_url),
             extra_index_urls,
             keyring_provider: other.keyring_provider.or(self.keyring_provider),
+            allow_insecure_host: self
+                .allow_insecure_host
+                .into_iter()
+                .chain(other.allow_insecure_host)
+                .collect(),
         }
     }
 
@@ -1113,6 +1123,29 @@ UNUSED = "unused"
         );
     }
 
+    #[test]
+    fn test_pypi_config_allow_insecure_host() {
+        let toml = r#"
+            [pypi-config]
+            index-url = "https://pypi.org/simple"
+            extra-index-urls = ["https://pypi.org/simple2"]
+            keyring-provider = "subprocess"
+            allow-insecure-host = ["https://localhost:1234", "*"]
+        "#;
+        let (config, _) = Config::from_toml(toml).unwrap();
+        assert_eq!(
+            config.pypi_config().allow_insecure_host,
+            vec![
+                TrustedHost::Host {
+                    scheme: Some("https".into()),
+                    host: "localhost".into(),
+                    port: Some(1234),
+                },
+                TrustedHost::Wildcard,
+            ]
+        );
+    }
+
     #[test]
     fn test_config_merge() {
         let mut config = Config::default();

crates/pixi_config/src/snapshots/pixi_config__tests__config_merge.snap

@@ -62,6 +62,7 @@ Config {
         index_url: None,
         extra_index_urls: [],
         keyring_provider: None,
+        allow_insecure_host: [],
     },
     detached_environments: Some(
         Boolean(

docs/reference/pixi_configuration.md

@@ -207,6 +207,7 @@ To setup a certain number of defaults for the usage of PyPI registries. You can
 - `index-url`: The default index URL to use for PyPI packages. This will be added to a manifest file on a `pixi init`.
 - `extra-index-urls`: A list of additional URLs to use for PyPI packages. This will be added to a manifest file on a `pixi init`.
 - `keyring-provider`: Allows the use of the [keyring](https://pypi.org/project/keyring/) python package to store and retrieve credentials.
+- `allow-insecure-host`: Allow insecure connections to host.
 
 ```toml title="config.toml"
 [pypi-config]
@@ -216,6 +217,8 @@ index-url = "https://pypi.org/simple"
 extra-index-urls = ["https://pypi.org/simple2"]
 # can be "subprocess" or "disabled"
 keyring-provider = "subprocess"
+# allow insecure connections to host
+allow-insecure-host = ["localhost:8080"]
 ```
 
 !!! Note "`index-url` and `extra-index-urls` are *not* globals"

src/install_pypi.rs

@@ -643,6 +643,7 @@ pub async fn update_python_distributions(
     let registry_client = Arc::new(
         RegistryClientBuilder::new(uv_context.cache.clone())
             .client(uv_context.client.clone())
+            .allow_insecure_host(uv_context.allow_insecure_host.clone())
             .index_urls(index_locations.index_urls())
             .keyring(uv_context.keyring_provider)
             .connectivity(Connectivity::Online)

src/lock_file/resolve/uv_resolution_context.rs

@@ -2,7 +2,7 @@ use std::sync::Arc;
 
 use miette::{Context, IntoDiagnostic};
 use uv_cache::Cache;
-use uv_configuration::{BuildOptions, Concurrency, SourceStrategy};
+use uv_configuration::{BuildOptions, Concurrency, SourceStrategy, TrustedHost};
 use uv_distribution_types::IndexCapabilities;
 use uv_types::{HashStrategy, InFlight};
 
@@ -22,6 +22,7 @@ pub struct UvResolutionContext {
     pub concurrency: Concurrency,
     pub source_strategy: SourceStrategy,
     pub capabilities: IndexCapabilities,
+    pub allow_insecure_host: Vec<TrustedHost>,
 }
 
 impl UvResolutionContext {
@@ -57,6 +58,7 @@ impl UvResolutionContext {
             concurrency: Concurrency::default(),
             source_strategy: SourceStrategy::Disabled,
             capabilities: IndexCapabilities::default(),
+            allow_insecure_host: project.config().pypi_config.allow_insecure_host.clone(),
         })
     }
 }