{"record":{"id":"eb5f315c8b7271ed","repo":"astral-sh/uv","slug":"pip-sync-s-client-cert-is-unsupported-uv-does","errorCode":null,"errorMessage":"pip-sync's `--client-cert` is unsupported (uv doesn't support dedicated client certificates)","messagePattern":"pip-sync's `--client-cert` is unsupported \\(uv doesn't support dedicated client certificates\\)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/uv-cli/src/compat.rs","lineNumber":231,"sourceCode":"            return Err(anyhow!(\n                \"pip-sync's `--ask` is unsupported (uv never asks for confirmation)\"\n            ));\n        }\n\n        if self.python_executable.is_some() {\n            return Err(anyhow!(\n                \"pip-sync's `--python-executable` is unsupported (to install into a separate Python environment, try setting `VIRTUAL_ENV` instead)\"\n            ));\n        }\n\n        if self.user {\n            return Err(anyhow!(\n                \"pip-sync's `--user` is unsupported (use a virtual environment instead)\"\n            ));\n        }\n\n        if self.client_cert.is_some() {\n            return Err(anyhow!(\n                \"pip-sync's `--client-cert` is unsupported (uv doesn't support dedicated client certificates)\"\n            ));\n        }\n\n        if self.config.is_some() {\n            return Err(anyhow!(\n                \"pip-sync's `--config` is unsupported (uv does not use a configuration file)\"\n            ));\n        }\n\n        if self.pip_args.is_some() {\n            return Err(anyhow!(\n                \"pip-sync's `--pip-args` is unsupported (try passing arguments to uv directly)\"\n            ));\n        }\n\n        Ok(())\n    }","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/astral-sh/uv/blob/f1a42680ff5272232d65748acf338b19778dde24/crates/uv-cli/src/compat.rs#L213-L249","documentation":"The pip-sync compatibility validator applies the same rules as `uv pip compile`: `--client-cert` (mTLS client certificate) has no uv equivalent — uv's TLS options cover CA bundles (`--cert`, `SSL_CERT_FILE`) but not dedicated client certificates — so any `Some(client_cert)` returns an error instead of dropping your credential setup silently.","triggerScenarios":"`uv pip sync --client-cert client.pem requirements.txt` against a registry that requires mutual TLS; often the sync half of a pip-tools pipeline whose compile half also passed `--client-cert` (which fails separately at compat.rs:111).","commonSituations":"Enterprise environments with mTLS-protected Artifactory; bots whose only certificate handling was `PIP_CLIENT_CERT`; migration projects that moved both compile and sync steps to uv at once.","solutions":["Remove `--client-cert` from the uv command line.","Terminate mTLS at a local proxy and point `--index-url` at it, so uv speaks plain HTTPS.","Track uv's TLS roadmap for client-certificate support instead of leaving the flag in scripts to fail later."],"exampleFix":"# before\nuv pip sync --client-cert client.pem requirements.txt\n\n# after\n# mTLS terminated at proxy.internal; uv uses plain HTTPS\nuv pip sync --index-url https://proxy.internal/simple requirements.txt","handlingStrategy":"validation","validationCode":"def check_mtls_flags(argv: list[str]) -> None:\n    if any(a == \"--client-cert\" or a.startswith(\"--client-cert=\") for a in argv):\n        raise ValueError(\"uv has no client-certificate support; terminate mTLS upstream or use another tool\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Design registries so plain HTTPS + internal CA is enough for automation tools.","Keep an mTLS-capable proxy in front of internal indexes.","Check uv's TLS docs each upgrade; client-cert support may land and change the workaround."],"tags":["cli","pip-tools","compatibility","sync","mtls","network"],"backgroundTag":null,"analyzedSha":"f1a42680ff5272232d65748acf338b19778dde24","analyzedAt":"2026-08-16T04:51:47.599Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}