pytorch - 💡(How to fix) Fix [Infra] Missing PEP 700 upload-time metadata breaks supply-chain security tools (uv, pip) [1 comments, 2 participants]

Description

The official PyTorch package index (download.pytorch.org) currently does not expose the upload-time metadata in its package JSON API. While PEP 700 defines this field as technically optional (to support legacy servers), omitting it breaks compatibility with modern package management.

Impact

Because this metadata is missing, modern Python package managers like uv, pip, and pdm cannot verify the age of the PyTorch packages. Features like uv's --exclude-newer are critical for mitigating supply chain attacks (e.g., dependency confusion) by enforcing a "cooldown" period on newly published packages.

Currently, running a secure dependency resolution with a date cutoff fails entirely for PyTorch. I am forced to allow-list torch to bypass these security checks (e.g., using --exclude-newer-package torch). We currently live in the age of supply chain attacks, and many recent attacks across the industry could have been mitigated simply by avoiding running code published at HEAD.

Steps to Reproduce

1. Create a minimal pyproject.toml depending on torch.
2. Map the package to the custom index: https://download.pytorch.org/whl/cpu
3. Run uv lock --exclude-newer "2 weeks"
4. The resolution fails, outputting warnings for every wheel: warning: torch-<version>.whl is missing an upload date

Expected Behavior

The download.pytorch.org registry infrastructure should be updated to populate the upload-time field for all published wheels as defined in the PEP 700 JSON API. Providing this timestamp will ensure compatibility with modern Python security tooling.