Is there a way to include configuration with a python package source so that it is able to properly resolve dependencies from private registries using a standard build/install chain? For example, I have a python package with dependencies on several python packages that are each published to different private indexes on Gitlab. Their index paths looks similar to this: https://gitlab.mycompany.com/api/v4/projects/100/packages/pypi/simple I can do this with a requirements.txt file included in my project: requests black pillow --extra-index-url https://__token__:${GITLAB_TOKEN}@gitlab.mycompany.com/api/v4/projects/100/packages/pypi/simple my-dependency-one==3.4.2 --extra-index-url https://__token__:${GITLAB_TOKEN}@gitlab.mycompany.com/api/v4/projects/101/packages/pypi/simple my-dependency-two==1.0.0 This requires making some assumptions about how private registry tokens are stored, but I'm fine with those types of solutions. Unfortunately, requirements.txt files don't integrate with the standard build/install chain for python packages. Python packaging tools like pip, uv, and hatch work out of the box with the public PyPI index. They support private indexes, but the configuration I've found to support them must all be done manually via user config files or command line flags. I understand why python packaging tools wouldn't want python packages to quietly insert private registries and why that would be a security hole. But when working with a source repository, I would think there would be some way to tell pip, uv, hatch, etc. to "use this configuration, too" when doing a build install. Continue reading...
