Index URL options do not parse "space separated" URLs as multiple options

[zanieb]

e.g. via UV_EXTRA_INDEX_URL or --extra-index-url if you pass https://foo/ https://bar we will treat this as a single URL but it should be split into two.

It's unclear if space separated URLs are the best option. It seems brittle to split the input.

Originally posted in https://github.com/astral-sh/uv/issues/1688#issue-2142265255

[notatallshaw]

I will again remind users that specifying multiple non-mirror indexes with no guarantee of which index is being sourced for any given package is a real security issue.

E.g. https://pytorch.org/blog/compromised-nightly-dependency/

[MarcSkovMadsen]

I'm the original reporter in #1688 . I don't know if UV_EXTRA_INDEX_URL is correct? I hope it will work with PIP_EXTRA_INDEX_URL for drop in replacement of uv with pip.

Very much looking forward to this fix. This seems to be the last bit holding me back from using uv in our pipelines. Thanks.

[charliermarsh]

I think they do just split on a space: https://github.com/pypa/pip/blob/f4a543917eac822a3b06ab0fcc4df7c4e37e387a/src/pip/_internal/cli/parser.py#L249 and https://github.com/pypa/pip/issues/10374.