[pganssle-google]

In rules_python 2.0.0, the Simple API downloader was enabled by default by falling back to https://pypi.org/simple in build_config. While hub_builder.bzl retains the fallback to pip when default_index_url is empty, pip.default(index_url = "") could not be used to trigger it because _configure ignores falsy attribute values (and attr.string() defaults to "" when omitted).

Set the default of pip.default.index_url to "https://pypi.org/simple" on the tag attribute and record any non-default value (including "") in build_config. Also apply envsubst to self._config.index_url in hub_builder.bzl so an environment variable that expands to "" disables the Simple API downloader in the same way as pip.parse.experimental_index_url.

[pganssle-google]

AI Disclosure: This PR was drafted with an AI coding assistant under human direction (semi-autonomous). Review comments and follow-up changes on this PR will be handled or reviewed by @pganssle-google before posting.

This is an automatically generated agent comment.

[pganssle-google]

Not sure if this is considered a fix or a behavioral change, let me know.

[aignas]

In this particular case, we have spent a lot of effort to ensure that this works in most scenarios. What would be the use case for disabling this? Which version are you observing problems with? What are they?

[pganssle-google]

In this particular case, we have spent a lot of effort to ensure that this works in most scenarios. What would be the use case for disabling this? Which version are you observing problems with? What are they?

Our use case is that we have a somewhat complicated build that has to pull from multiple indices: PyTorch's CPU-only builds, our own nightly build index and the standard PyPI build. What motivated this change originally was that this was failing when we tried to update to the latest rules_python and we thought it was because extra_pip_args wasn't passed through. Turns out that the bug is something else, and we actually can use the Simple API downloader after all.

That said, if we actually had needed to disable the Simple API downloader (and it seems that the pip downloader is not being removed, so some use cases for this are actually acknowledged), this does seem like a bug. My AI's original instinct here was to pass pip.default(index_url="/"), because when deciding whether index_url was passed, the truthiness of "/" is checked and found to be truthy, then when rules_python goes to evaluate the arg, it runs index_url.strip("/"), gets "" and then falls back to the default value.

Needless to say, I was not pleased with this.

Seems to me like it should either be explicitly impossible to disable SimpleAPI in pip.default (and documented as such), or there should be a way to do it that doesn't rely so much on implementation details. Given that your question of "why are you even doing this?" led me to change my approach so that it is not necessary, I'm inclined to imagine that disabling the simple API downloader is an attractive nuisance, and my prescription for something like that is usually to make it possible but a little annoying so that people think twice before doing it. Maybe even a very judgemental-sounding sentinel value like KNOWN_UPSTREAM_BUG(bug_url="...") could be used, or a change to the docs to suggest that users always reconsider disabling simple API unless there is a known upstream bug they are working around to make it clear that anything other than parity with the pip downloader is considered a bug.

[aignas]

So the best way to "disable the Simple API" is to use a "uv.lock" file that has all of the URLs. If the uv.lock parsing is not good enough, I'd rather have that part fixed.

And we should probably fix the part where passing "/" works to disable the Simple API calls :D. You can disable it for certain packages with simpleapi_skip attribute though.