From cafb473494d9cff3a8b2aeaf9f18b015f966e7b3 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Fri, 19 Jun 2026 14:59:08 +0200 Subject: [PATCH] fix(python): split PIP_TRUSTED_HOST by whitespace to support multiple hosts (#9675) * fix(python): split PIP_TRUSTED_HOST by whitespace for multiple hosts When PIP_TRUSTED_HOST contains multiple space-separated hostnames, the whole string was passed as a single --trusted-host argument (--trusted-host "host1 host2") rather than one flag per host. This matches pip's documented PIP_TRUSTED_HOST convention by emitting a separate --trusted-host for each host, mirroring the existing pip_extra_index_url handling. Fixes WIN-2077 Co-Authored-By: Claude Opus 4.8 (1M context) * fix(python): use shell word-splitting for nsjail trusted-host args Address review feedback: the previous tr/sed pipeline only split on single spaces, diverging from the Rust split_whitespace() paths. Repeated or leading/trailing spaces produced empty --trusted-host flags and tab-separated hosts were not split. Use an unquoted for-loop over $TRUSTED_HOST so the shell's own IFS word-splitting handles arbitrary whitespace and skips empty fields, matching the non-nsjail paths. Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Claude Opus 4.8 (1M context) --- backend/windmill-worker/nsjail/download_deps.py.sh | 3 ++- backend/windmill-worker/src/python_executor.rs | 8 ++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/backend/windmill-worker/nsjail/download_deps.py.sh b/backend/windmill-worker/nsjail/download_deps.py.sh index 13fc00ddf9..6b4cd8cfd8 100755 --- a/backend/windmill-worker/nsjail/download_deps.py.sh +++ b/backend/windmill-worker/nsjail/download_deps.py.sh @@ -2,7 +2,8 @@ INDEX_URL_ARG=$([ -z "$INDEX_URL" ] && echo ""|| echo "--index-url $INDEX_URL" ) EXTRA_INDEX_URL_ARG=$([ -z "$EXTRA_INDEX_URL" ] && echo ""|| echo "--extra-index-url $EXTRA_INDEX_URL" ) -TRUSTED_HOST_ARG=$([ -z "$TRUSTED_HOST" ] && echo "" || echo "--trusted-host $TRUSTED_HOST") +TRUSTED_HOST_ARG="" +for h in $TRUSTED_HOST; do TRUSTED_HOST_ARG="$TRUSTED_HOST_ARG --trusted-host $h"; done if [ ! -z "$INDEX_URL" ] then diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs index f74a523072..c121266e34 100644 --- a/backend/windmill-worker/src/python_executor.rs +++ b/backend/windmill-worker/src/python_executor.rs @@ -361,7 +361,9 @@ pub async fn uv_pip_compile( args.extend(["--index-url", url]); } if let Some(host) = TRUSTED_HOST.as_ref() { - args.extend(["--trusted-host", host]); + host.split_whitespace().for_each(|h| { + args.extend(["--trusted-host", h]); + }); } if let Some(cert_path) = INDEX_CERT.as_ref() { args.extend(["--cert", cert_path]); @@ -2192,7 +2194,9 @@ async fn spawn_uv_install( command_args.extend(["--index-url", url]); } if let Some(host) = TRUSTED_HOST.as_ref() { - command_args.extend(["--trusted-host", &host]); + host.split_whitespace().for_each(|h| { + command_args.extend(["--trusted-host", h]); + }); } if *NATIVE_CERT { command_args.extend(["--native-tls"]);