Add ability to specify package sources that are not scanned/used by default

• I have searched the issues of this repo and believe that this is not a duplicate.
• I have searched the documentation and believe that my question is not covered.

Feature Request

When specifying additional sources in pyproject.toml as “secondary”, the current behavior of Poetry is to include this source in all of it’s scans for dependency resolution for adding or installing packages. This is almost entirely unnecessary in many cases, as a secondary source is normally only needed to install very specific packages and would not normally host any other packages from pypi (and if they do, it’s likely not “secondary” then but “default”.)

Since this behavior is already defined, I’d like to propose a third option, targeted which specifies that a source should be used only if a dependency definition explicitly specifies it in it’s source parameter. That package’s dependencies would be scanned from that repository, but it would be otherwise ignored.

One specific reason that this is desperately needed is that in several of my corporate projects, we use Azure DevOps artifacts system private PyPI. This system is notoriously slow and a small project’s dependency resolution scan take upwards of 10 minutes with Poetry scanning it for every single project dependency. To mitigate this, we currently force source="pypi" in all dependency specifications to target it specifically.

[zevisert]

I’d really love to move this feature forward! Every time I need to update packages at work I have to sit there watching poetry 1.1.11 take 300+ seconds in most of our projects to resolve dependencies is annoying when I think I have a PR I have can do it in less than 15…

I just heard about @python-poetry/triage Hi! 👋

[IWillPull]

I’m also experiencing it and having builds take 30+ minutes longer when using one secondary dependency sounds more like a bug, not a feature request.