I've been looking into configuring pip with two indexes: a private PyPI repo (with higher priority) and the public PyPI. The goal is to avoid security risks like dependency confusion/code injection. Suppose I configure: index-url = http://my_private_pypi_repo extra-index-url = https://pypi.org/simple Questions: If a package (e.g., lib) exists in both indexes, which one will pip install lib use? If I run pip install lib==0.0.2, but only version 0.0.1 exists in the private index, will pip look at PyPI for 0.0.2? What’s the best way to ensure some packages are only fetched from the private index, even if a newer version exists on PyPI? Continue reading...
