unable to override https://pypi.org/simple starting in rules_python 2.0.0

[dws]

🐞 bug report

Affected Rule

The issue is caused by the rule:

pip.parse.experimental_index_url
pip.parse.experimental_extra_index_urls
pip.default.index_url

Is this a regression?

Yes, the previous version in which this bug was not present was: 1.9.1

Description

In rules_python 1.9.1 and earlier, I was able to override the use of https://pypi.org/simple as follows:

pip.parse(
    envsubst = ["EXAMPLE_PIP_INDEX_URL"],
    experimental_extra_index_urls = [
        "${EXAMPLE_PIP_INDEX_URL}",
    ],
    experimental_index_url = "${EXAMPLE_PIP_INDEX_URL}",
    ...
)

where EXAMPLE_PIP_INDEX_URL is an environment variable that we set to our local pypi index.
We also have a --downloader_config set up which blocks access to pypi.org.

Starting with rules_python 2.0.0 and continuing through 2.3.2, the experimental_extra_index_urls and experimental_index_url parameters silently no longer work, and do not generate any diagnostic to say what the new mechanism is.

Per the documentation at https://rules-python.readthedocs.io/en/2.3.2/api/rules_python/python/extensions/pip.html#pip.default.index_url I would expect the following to work starting with rules_python 2.0.0:

pip.default(
    index_url = "${EXAMPLE_PIP_INDEX_URL}",
)
pip.parse(
    envsubst = ["EXAMPLE_PIP_INDEX_URL"],
    ...
)

However, it appears that index_url is not used at all, or at least does not override all uses of https://pypi.org/simple. The docs state that

This value is going to be subject to envsubst substitutions if necessary

I do need it to be subject to envsubst substitutions. It would be clearer if the docs said

This value is subject to envsubst substitutions

🔬 Minimal Reproduction

I can provide a small reproduction if necessary, but the user would need to supply some alternative to pypi.org to configure it with.

🔥 Exception or Error

When I run bazel clean --expunge; bazel mod graph in a repo configured as I described above, I get a diagnostic like

    Error in wait: java.io.IOException: Configured URL rewriter blocked all URLs: [https://pypi.org/simple/]
    ERROR: error evaluating module extension @@rules_python+//python/extensions:pip.bzl%pip
    ERROR: Results may be incomplete as 1 extension failed.

starting with rules_python 2.0.0 due to pypi.org/simple not being overridden any more, either by the old mechanism with experimental_index_url and experimental_extra_index_urls, or by the new mechanism with index_url.

🌍 Your Environment

Operating System:

Ubuntu 24.04

Output of bazel version:

  
$ bazelisk version
Bazelisk version: v1.19.0
Build label: 9.2.0
Build target: @@//src/main/java/com/google/devtools/build/lib/bazel:BazelServer
Build time: Mon Jul 13 18:15:04 2026 (1783966504)
Build timestamp: 1783966504
Build timestamp as int: 1783966504
  

Rules_python version:

  
2.3.2
  

Anything else relevant?

I'd be happy to attempt a fix, given some guidance as to what needed to be done where.
I'm also happy to test prospective fixes if my particular computing environment can be of some help.

It would be nice if experimental_extra_index_urls and experimental_index_url continued to work. But if they are not going to work, their use should at a minimum trigger some sort of clear diagnostic about what to use instead.

Posted on the bazel slack at https://bazelbuild.slack.com/archives/CA306CEV6/p1787963436682509

[aignas]

Ah, I think I understand the root cause, happy to guide things needed to modify to get it fixed.

• pip.default.index_url setting works as a fallback if --index-url is not passed in the lock files.
• The logic is take the values from extra_pip_args or the lock file or experimental_index_url or pip.default.

If you would like to override the values mentioned in other requirements files, you can do this by using the downloader_config to do the URL rewrites.

However, if rules_python option is suggested, we should do the following:

• pip.default.index_url should be a default if rules_python module is setting it.
• pip.default.index_url should be an override if module other than rules_python is setting it.

I think that way the semantics would become as documented in the docs.

[aignas]

Added a PR to reproduce the issue - feel free hack on that.