From b230378320336331de1c50d6fdec60da576751e6 Mon Sep 17 00:00:00 2001
From: Ryan Doyle <ryan@rdoyle.net>
Date: Fri, 9 Feb 2024 16:29:08 -0700
Subject: [PATCH] fix: Properly handle pip index urls in pip-compile (#3192)

- URLs that contain simple auth seem to have that stripped before being
  passed to underlying pip if it needs to be called by pip-compile.
- This forces explicit passing of the complete, authenticated url
  string to pip, through pip-compile, via pip-compile's "--pip-args"
  argument.
---
 backend/windmill-worker/src/python_executor.rs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index fc85a72d75..42bb3dc5d8 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -151,6 +151,7 @@ pub async fn pip_compile(
     write_file(job_dir, file, &requirements).await?;
 
     let mut args = vec!["-q", "--no-header", file, "--resolver=backtracking"];
+    let mut pip_args = vec![];
     let pip_extra_index_url = PIP_EXTRA_INDEX_URL
         .read()
         .await
@@ -158,10 +159,12 @@ pub async fn pip_compile(
         .map(handle_ephemeral_token);
     if let Some(url) = pip_extra_index_url.as_ref() {
         args.extend(["--extra-index-url", url, "--no-emit-index-url"]);
+        pip_args.push(format!("--extra-index-url {}", url));
     }
     let pip_index_url = PIP_INDEX_URL.clone().map(handle_ephemeral_token);
     if let Some(url) = pip_index_url.as_ref() {
         args.extend(["--index-url", url, "--no-emit-index-url"]);
+        pip_args.push(format!("--index-url {}", url));
     }
     if let Some(host) = PIP_TRUSTED_HOST.as_ref() {
         args.extend(["--trusted-host", host]);
@@ -169,6 +172,9 @@ pub async fn pip_compile(
     if let Some(cert_path) = PIP_INDEX_CERT.as_ref() {
         args.extend(["--cert", cert_path]);
     }
+    if pip_args.len() > 0 {
+        args.extend(["--pip-args", pip_args.join(" ")]);
+    }
     tracing::debug!("pip-compile args: {:?}", args);
 
     let mut child_cmd = Command::new("pip-compile");