rye add from private index using keyring

[acuitymd-filip]

I'm using GCP's Artifact Registry's private Python registry/index. It works fine with regular python tooling (i.e. pip) but I'm having trouble setting it up with Rye. I got it working, sort of, and I'm happy to make a PR with some documentation about this, but I'm not sure this is how this is supposed to work long-term.

To use a private index hosted on GCP one is supposed to install keyring and keyrings.google-artifactregistry-auth packages, in which case pip will use the keyring backend automatically when authenticating to the index - and this works reliably.

The way I got it to work with Rye is this:

• install keyring and keyrings.google-artifactregistry-auth as rye tools using rye install. For some reason you can't just add these two packages using rye install, and instead you have to use this:

  rye install keyrings.google-artifactregistry-auth --include-dep keyring`
  

• the second step is to add the source to pyproject.toml:

  [[tool.rye.sources]]
  name = "private-index"
  url = "https://us-central1-python.pkg.dev/[GCP Project]/private-index/simple/"

• when you try rye add with the above configured it still fails:
  • using uv backend:

    error: Failed to run uv compile error: HTTP status client error (401 Unauthorized) for url (https://us-central1-python.pkg.dev/[GCP Project]/private-index/simple/somepackage/)
    . uv exited with status: exit status: 2
    

  • using pip backend:

    error: failed to resolve package flightserver
    Traceback (most recent call last):
    (...)
      File "/Users/filip/.rye/self/lib/python3.12/site-packages/unearth/auth.py", line 302, in _prompt_for_password
        username = input(f"User for {netloc}: ")
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    EOFError: EOF when reading a line
    

• I couldn't figure out how to get it working with pip. With uv this seems to work:

  UV_KEYRING_PROVIDER=subprocess rye add --pre somepackage
  

Has anyone been able to figure out how to get this working with pip backend? What's the long-term intended API for using keyring as an auth backend for private indexes? Would it help to open a PR to document the solution described above?

[thejosephstevens]

Can you clarify what you're doing in the last step here?

UV_KEYRING_PROVIDER=subprocess rye add --pre somepackage

What is somepackage supposed to be? I'm trying to publish packages to GCP artifact registry so it's slightly different, but I expect the auth question is more or less the same.

edit:
I think I figured this out, you're just saying here that you set UV_KEYRING_PROVIDER=subprocess before running rye add, right? And this causes uv to use subprocesses to find the keyring provider?