Add uv publish: Basic upload with username/password or keyring

.github/workflows/ci.yml

@@ -968,6 +968,61 @@ jobs:
         env:
           UV_PROJECT_ENVIRONMENT: "/home/runner/example"
 
+  integration-test-publish:
+    timeout-minutes: 10
+    needs: build-binary-linux
+    name: "integration test | uv publish"
+    runs-on: ubuntu-latest
+    # Only the main repository is a trusted publisher
+    if: github.repository == 'astral-sh/uv'
+    environment: uv-test-publish
+    env:
+      # No dbus in GitHub Actions
+      PYTHON_KEYRING_BACKEND: keyrings.alt.file.PlaintextKeyring
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Only publish a new release if the
+      - uses: tj-actions/changed-files@v45
+        id: changed
+        with:
+          files_yaml: |
+            code:
+              - "crates/uv-publish/**/*"
+              - "scripts/publish/**/*"
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: "Download binary"
+        uses: actions/download-artifact@v4
+        with:
+          name: uv-linux-${{ github.sha }}
+
+      - name: "Prepare binary"
+        run: chmod +x ./uv
+
+      - name: "Add password to keyring"
+        run: |
+          # `keyrings.alt` contains the plaintext keyring
+          ./uv tool install --with keyrings.alt "keyring<25.4.0" # TODO(konsti): Remove upper bound once fix is released
+          echo $UV_TEST_PUBLISH_KEYRING | keyring set https://test.pypi.org/legacy/?astral-test-keyring __token__
+        env:
+          UV_TEST_PUBLISH_KEYRING: ${{ secrets.UV_TEST_PUBLISH_KEYRING }}
+
+      - name: "Publish test packages"
+        if: ${{ steps.changed.outputs.code_any_changed }}
+        # `-p 3.12` prefers the python we just installed over the one locked in `.python_version`.
+        run: ./uv run -p 3.12 scripts/publish/test_publish.py --uv ./uv all
+        env:
+          RUST_LOG: uv=debug,uv_publish=trace
+          UV_TEST_PUBLISH_TOKEN: ${{ secrets.UV_TEST_PUBLISH_TOKEN }}
+          UV_TEST_PUBLISH_PASSWORD: ${{ secrets.UV_TEST_PUBLISH_PASSWORD }}
+          UV_TEST_PUBLISH_GITLAB_PAT: ${{ secrets.UV_TEST_PUBLISH_GITLAB_PAT }}
+
   cache-test-ubuntu:
     timeout-minutes: 10
     needs: build-binary-linux

Cargo.toml

@@ -45,6 +45,7 @@ uv-metadata = { path = "crates/uv-metadata" }
 uv-normalize = { path = "crates/uv-normalize" }
 uv-options-metadata = { path = "crates/uv-options-metadata" }
 uv-pubgrub = { path = "crates/uv-pubgrub" }
+uv-publish = { path = "crates/uv-publish" }
 uv-python = { path = "crates/uv-python" }
 uv-requirements = { path = "crates/uv-requirements" }
 uv-resolver = { path = "crates/uv-resolver" }
@@ -123,8 +124,8 @@ quote = { version = "1.0.37" }
 rayon = { version = "1.10.0" }
 reflink-copy = { version = "0.1.19" }
 regex = { version = "1.10.6" }
-reqwest = { version = "0.12.7", default-features = false, features = ["json", "gzip", "stream", "rustls-tls", "rustls-tls-native-roots", "socks"] }
-reqwest-middleware = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "5e3eaf254b5bd481c75d2710eed055f95b756913" }
+reqwest = { version = "0.12.7", default-features = false, features = ["json", "gzip", "stream", "rustls-tls", "rustls-tls-native-roots", "socks", "multipart"] }
+reqwest-middleware = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "5e3eaf254b5bd481c75d2710eed055f95b756913", features = ["multipart"] }
 reqwest-retry = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "5e3eaf254b5bd481c75d2710eed055f95b756913" }
 rkyv = { version = "0.8.8", features = ["bytecheck"] }
 rmp-serde = { version = "1.3.0" }

crates/distribution-filename/src/lib.rs

@@ -67,6 +67,14 @@ impl DistFilename {
             Self::WheelFilename(filename) => &filename.version,
         }
     }
+
+    /// Whether the file is a `bdist_wheel` or an `sdist`.
+    pub fn filetype(&self) -> &'static str {
+        match self {
+            Self::SourceDistFilename(_) => "sdist",
+            Self::WheelFilename(_) => "bdist_wheel",
+        }
+    }
 }
 
 impl Display for DistFilename {

crates/pypi-types/src/metadata/metadata23.rs

@@ -0,0 +1,199 @@
+//! Vendored from <https://github.com/PyO3/python-pkginfo-rs>
+
+use crate::metadata::Headers;
+use crate::MetadataError;
+use std::str;
+use std::str::FromStr;
+
+/// Code Metadata 2.3 as specified in
+/// <https://packaging.python.org/specifications/core-metadata/>.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Metadata23 {
+    /// Version of the file format; legal values are `1.0`, `1.1`, `1.2`, `2.1`, `2.2` and `2.3`.
+    pub metadata_version: String,
+    /// The name of the distribution.
+    pub name: String,
+    /// A string containing the distribution’s version number.
+    pub version: String,
+    /// A Platform specification describing an operating system supported by the distribution
+    /// which is not listed in the “Operating System” Trove classifiers.
+    pub platforms: Vec<String>,
+    /// Binary distributions containing a PKG-INFO file will use the Supported-Platform field
+    /// in their metadata to specify the OS and CPU for which the binary distribution was compiled.
+    pub supported_platforms: Vec<String>,
+    /// A one-line summary of what the distribution does.
+    pub summary: Option<String>,
+    /// A longer description of the distribution that can run to several paragraphs.
+    pub description: Option<String>,
+    /// A list of additional keywords, separated by commas, to be used to
+    /// assist searching for the distribution in a larger catalog.
+    pub keywords: Option<String>,
+    /// A string containing the URL for the distribution’s home page.
+    pub home_page: Option<String>,
+    /// A string containing the URL from which this version of the distribution can be downloaded.
+    pub download_url: Option<String>,
+    /// A string containing the author’s name at a minimum; additional contact information may be provided.
+    pub author: Option<String>,
+    /// A string containing the author’s e-mail address. It can contain a name and e-mail address in the legal forms for a RFC-822 `From:` header.
+    pub author_email: Option<String>,
+    /// Text indicating the license covering the distribution where the license is not a selection from the `License` Trove classifiers or an SPDX license expression.
+    pub license: Option<String>,
+    /// An SPDX expression indicating the license covering the distribution.
+    pub license_expression: Option<String>,
+    /// Paths to files containing the text of the licenses covering the distribution.
+    pub license_files: Vec<String>,
+    /// Each entry is a string giving a single classification value for the distribution.
+    pub classifiers: Vec<String>,
+    /// Each entry contains a string naming some other distutils project required by this distribution.
+    pub requires_dist: Vec<String>,
+    /// Each entry contains a string naming a Distutils project which is contained within this distribution.
+    pub provides_dist: Vec<String>,
+    /// Each entry contains a string describing a distutils project’s distribution which this distribution renders obsolete,
+    /// meaning that the two projects should not be installed at the same time.
+    pub obsoletes_dist: Vec<String>,
+    /// A string containing the maintainer’s name at a minimum; additional contact information may be provided.
+    ///
+    /// Note that this field is intended for use when a project is being maintained by someone other than the original author:
+    /// it should be omitted if it is identical to `author`.
+    pub maintainer: Option<String>,
+    /// A string containing the maintainer’s e-mail address.
+    /// It can contain a name and e-mail address in the legal forms for a RFC-822 `From:` header.
+    ///
+    /// Note that this field is intended for use when a project is being maintained by someone other than the original author:
+    /// it should be omitted if it is identical to `author_email`.
+    pub maintainer_email: Option<String>,
+    /// This field specifies the Python version(s) that the distribution is guaranteed to be compatible with.
+    pub requires_python: Option<String>,
+    /// Each entry contains a string describing some dependency in the system that the distribution is to be used.
+    pub requires_external: Vec<String>,
+    /// A string containing a browsable URL for the project and a label for it, separated by a comma.
+    pub project_urls: Vec<String>,
+    /// A string containing the name of an optional feature. Must be a valid Python identifier.
+    /// May be used to make a dependency conditional on whether the optional feature has been requested.
+    pub provides_extras: Vec<String>,
+    /// A string stating the markup syntax (if any) used in the distribution’s description,
+    /// so that tools can intelligently render the description.
+    pub description_content_type: Option<String>,
+    /// A string containing the name of another core metadata field.
+    pub dynamic: Vec<String>,
+}
+
+impl Metadata23 {
+    /// Parse distribution metadata from metadata `MetadataError`
+    pub fn parse(content: &[u8]) -> Result<Self, MetadataError> {
+        let headers = Headers::parse(content)?;
+
+        let metadata_version = headers
+            .get_first_value("Metadata-Version")
+            .ok_or(MetadataError::FieldNotFound("Metadata-Version"))?;
+        let name = headers
+            .get_first_value("Name")
+            .ok_or(MetadataError::FieldNotFound("Name"))?;
+        let version = headers
+            .get_first_value("Version")
+            .ok_or(MetadataError::FieldNotFound("Version"))?;
+        let platforms = headers.get_all_values("Platform").collect();
+        let supported_platforms = headers.get_all_values("Supported-Platform").collect();
+        let summary = headers.get_first_value("Summary");
+        let body = str::from_utf8(&content[headers.body_start..])
+            .map_err(MetadataError::DescriptionEncoding)?;
+        let description = if body.trim().is_empty() {
+            headers.get_first_value("Description")
+        } else {
+            Some(body.to_string())
+        };
+        let keywords = headers.get_first_value("Keywords");
+        let home_page = headers.get_first_value("Home-Page");
+        let download_url = headers.get_first_value("Download-URL");
+        let author = headers.get_first_value("Author");
+        let author_email = headers.get_first_value("Author-email");
+        let license = headers.get_first_value("License");
+        let license_expression = headers.get_first_value("License-Expression");
+        let license_files = headers.get_all_values("License-File").collect();
+        let classifiers = headers.get_all_values("Classifier").collect();
+        let requires_dist = headers.get_all_values("Requires-Dist").collect();
+        let provides_dist = headers.get_all_values("Provides-Dist").collect();
+        let obsoletes_dist = headers.get_all_values("Obsoletes-Dist").collect();
+        let maintainer = headers.get_first_value("Maintainer");
+        let maintainer_email = headers.get_first_value("Maintainer-email");
+        let requires_python = headers.get_first_value("Requires-Python");
+        let requires_external = headers.get_all_values("Requires-External").collect();
+        let project_urls = headers.get_all_values("Project-URL").collect();
+        let provides_extras = headers.get_all_values("Provides-Extra").collect();
+        let description_content_type = headers.get_first_value("Description-Content-Type");
+        let dynamic = headers.get_all_values("Dynamic").collect();
+        Ok(Metadata23 {
+            metadata_version,
+            name,
+            version,
+            platforms,
+            supported_platforms,
+            summary,
+            description,
+            keywords,
+            home_page,
+            download_url,
+            author,
+            author_email,
+            license,
+            license_expression,
+            license_files,
+            classifiers,
+            requires_dist,
+            provides_dist,
+            obsoletes_dist,
+            maintainer,
+            maintainer_email,
+            requires_python,
+            requires_external,
+            project_urls,
+            provides_extras,
+            description_content_type,
+            dynamic,
+        })
+    }
+}
+
+impl FromStr for Metadata23 {
+    type Err = MetadataError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Metadata23::parse(s.as_bytes())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::MetadataError;
+
+    #[test]
+    fn test_parse_from_str() {
+        let s = "Metadata-Version: 1.0";
+        let meta: Result<Metadata23, MetadataError> = s.parse();
+        assert!(matches!(meta, Err(MetadataError::FieldNotFound("Name"))));
+
+        let s = "Metadata-Version: 1.0\nName: asdf";
+        let meta = Metadata23::parse(s.as_bytes());
+        assert!(matches!(meta, Err(MetadataError::FieldNotFound("Version"))));
+
+        let s = "Metadata-Version: 1.0\nName: asdf\nVersion: 1.0";
+        let meta = Metadata23::parse(s.as_bytes()).unwrap();
+        assert_eq!(meta.metadata_version, "1.0");
+        assert_eq!(meta.name, "asdf");
+        assert_eq!(meta.version, "1.0");
+
+        let s = "Metadata-Version: 1.0\nName: asdf\nVersion: 1.0\nDescription: a Python package";
+        let meta: Metadata23 = s.parse().unwrap();
+        assert_eq!(meta.description.as_deref(), Some("a Python package"));
+
+        let s = "Metadata-Version: 1.0\nName: asdf\nVersion: 1.0\n\na Python package";
+        let meta: Metadata23 = s.parse().unwrap();
+        assert_eq!(meta.description.as_deref(), Some("a Python package"));
+
+        let s = "Metadata-Version: 1.0\nName: asdf\nVersion: 1.0\nAuthor: 中文\n\n一个 Python 包";
+        let meta: Metadata23 = s.parse().unwrap();
+        assert_eq!(meta.author.as_deref(), Some("中文"));
+        assert_eq!(meta.description.as_deref(), Some("一个 Python 包"));
+    }
+}