Associate dependency with source

I have two entries in my pyproject.toml of the following form.

dependencies = [
    ...
    "internal-package~=1.0",
]

[[tool.pdm.source]]
url = "https://gitlab.company.com/api/v4/projects/309/packages/pypi/simple"
verify_ssl = true
name = "custom-packages-1"

This possibly causes a name collision issue if somebody uploads a package called internal-package to pypi: (will pdm use the package from pypi or from my custom source? It also appears to slow down pdm, as I presume pdm is searching for requests, pandas etc. in my custom source instead of only on pypi.

Both of these issues could be solved if there were a way to associate a particular dependency with a particular source.

[frostming]

@ElijahSink Unfortunately the former, pip fetches candidates from all indexes and sorts them together to get the best match. We already have a plan to implement our own package finder to replace pip’s. So let’s leave it for this release and do improvements in the future.

[pawamoy]

Another mitigation for this dependency confusion issue is to follow some pattern for naming your internal packages, such as reducing the chances a public package uses the same name. Something like org-team-project-name. You’d have to keep this pattern and name private/hidden/secret of course (not public).