{"record":{"id":"d4e66dec75ab4ae9","repo":"astral-sh/uv","slug":"pip-compile-s-emit-trusted-host-is-unsupported","errorCode":null,"errorMessage":"pip-compile's `--emit-trusted-host` is unsupported","messagePattern":"pip-compile's `--emit-trusted-host` is unsupported","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/uv-cli/src/compat.rs","lineNumber":117,"sourceCode":"                    ));\n                }\n            }\n        }\n\n        if self.max_rounds.is_some() {\n            return Err(anyhow!(\n                \"pip-compile's `--max-rounds` is unsupported (uv always resolves until convergence)\"\n            ));\n        }\n\n        if self.client_cert.is_some() {\n            return Err(anyhow!(\n                \"pip-compile's `--client-cert` is unsupported (uv doesn't support dedicated client certificates)\"\n            ));\n        }\n\n        if self.emit_trusted_host {\n            return Err(anyhow!(\n                \"pip-compile's `--emit-trusted-host` is unsupported\"\n            ));\n        }\n\n        if self.no_emit_trusted_host {\n            warn_user!(\n                \"pip-compile's `--no-emit-trusted-host` has no effect (uv never emits trusted hosts)\"\n            );\n        }\n\n        if self.config.is_some() {\n            return Err(anyhow!(\n                \"pip-compile's `--config` is unsupported (uv does not use a configuration file)\"\n            ));\n        }\n\n        if self.emit_options {\n            return Err(anyhow!(","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/astral-sh/uv/blob/f1a42680ff5272232d65748acf338b19778dde24/crates/uv-cli/src/compat.rs#L99-L135","documentation":"pip-compile's `--emit-trusted-host` writes `--trusted-host` options into the generated requirements file so pip skips TLS verification for those hosts on install. uv never emits trust options into its output (and its own flag is `--allow-insecure-host`), so the compatibility validator rejects the emit flag. The negated `--no-emit-trusted-host` only warns, because that already matches uv's behavior.","triggerScenarios":"`uv pip compile --emit-trusted-host requirements.in`, typically as one of several inherited pip-compile flags in a shared script; the error fires during argument validation before compilation starts.","commonSituations":"Private registries with self-signed certs where teams relied on emitted trusted-host lines; migration of pip-tools-based workflows that pinned both emit flags to make output deterministic.","solutions":["Remove `--emit-trusted-host`; uv's output never contains trusted-host directives.","Declare the trust at consumption time instead: `uv pip sync --allow-insecure-host internal.example.com requirements.txt` (or `UV_INSECURE_HOST`).","Prefer fixing the registry's TLS (internal CA via `--cert`/`SSL_CERT_FILE`) over insecure-host exemptions."],"exampleFix":"# before\nuv pip compile --emit-trusted-host requirements.in\n\n# after\nuv pip compile requirements.in\nuv pip sync --allow-insecure-host internal.example.com requirements.txt","handlingStrategy":"validation","validationCode":"def replace_emit_trusted_host(argv: list[str]) -> list[str]:\n    if \"--emit-trusted-host\" in argv:\n        raise ValueError(\n            \"uv never emits trusted hosts; pass --allow-insecure-host at install time instead\"\n        )\n    return argv","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Model trust decisions as install-time flags (`--allow-insecure-host`), never as content of generated requirement files.","Prefer fixing registry TLS with an internal CA bundled via `--cert` over insecure-host allowances.","Review generated requirements files in CI: reject any pip options uv did not produce."],"tags":["cli","pip-tools","compatibility","tls","compile"],"backgroundTag":null,"analyzedSha":"f1a42680ff5272232d65748acf338b19778dde24","analyzedAt":"2026-08-16T04:51:47.599Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}