astral-sh/uv · error · anyhow::Error

pip-compile's `--emit-trusted-host` is unsupported

Error message

pip-compile's `--emit-trusted-host` is unsupported

What it means

pip-compile's `--emit-trusted-host` writes `--trusted-host` options into the generated requirements file so pip skips TLS verification for those hosts on install. uv never emits trust options into its output (and its own flag is `--allow-insecure-host`), so the compatibility validator rejects the emit flag. The negated `--no-emit-trusted-host` only warns, because that already matches uv's behavior.

Source

Thrown at crates/uv-cli/src/compat.rs:117

                    ));
                }
            }
        }

        if self.max_rounds.is_some() {
            return Err(anyhow!(
                "pip-compile's `--max-rounds` is unsupported (uv always resolves until convergence)"
            ));
        }

        if self.client_cert.is_some() {
            return Err(anyhow!(
                "pip-compile's `--client-cert` is unsupported (uv doesn't support dedicated client certificates)"
            ));
        }

        if self.emit_trusted_host {
            return Err(anyhow!(
                "pip-compile's `--emit-trusted-host` is unsupported"
            ));
        }

        if self.no_emit_trusted_host {
            warn_user!(
                "pip-compile's `--no-emit-trusted-host` has no effect (uv never emits trusted hosts)"
            );
        }

        if self.config.is_some() {
            return Err(anyhow!(
                "pip-compile's `--config` is unsupported (uv does not use a configuration file)"
            ));
        }

        if self.emit_options {
            return Err(anyhow!(

View on GitHub (pinned to f1a42680ff)

Solutions

Remove `--emit-trusted-host`; uv's output never contains trusted-host directives.
Declare the trust at consumption time instead: `uv pip sync --allow-insecure-host internal.example.com requirements.txt` (or `UV_INSECURE_HOST`).
Prefer fixing the registry's TLS (internal CA via `--cert`/`SSL_CERT_FILE`) over insecure-host exemptions.

Example fix

# before
uv pip compile --emit-trusted-host requirements.in

# after
uv pip compile requirements.in
uv pip sync --allow-insecure-host internal.example.com requirements.txt

Defensive patterns

Strategy: validation

Validate before calling

def replace_emit_trusted_host(argv: list[str]) -> list[str]:
    if "--emit-trusted-host" in argv:
        raise ValueError(
            "uv never emits trusted hosts; pass --allow-insecure-host at install time instead"
        )
    return argv

Prevention

Model trust decisions as install-time flags (`--allow-insecure-host`), never as content of generated requirement files.
Prefer fixing registry TLS with an internal CA bundled via `--cert` over insecure-host allowances.
Review generated requirements files in CI: reject any pip options uv did not produce.

When it happens

Trigger: `uv pip compile --emit-trusted-host requirements.in`, typically as one of several inherited pip-compile flags in a shared script; the error fires during argument validation before compilation starts.

Common situations: Private registries with self-signed certs where teams relied on emitted trusted-host lines; migration of pip-tools-based workflows that pinned both emit flags to make output deterministic.

Related errors

AI-assisted analysis of astral-sh/uv@f1a42680ff (2026-08-16). Data as JSON: /api/errors/d4e66dec75ab4ae9. Report an issue: GitHub.