Dependency resolution problem with non-pypi repository

Version: Poetry 0.12.10

I have a private PyPI server for company internal packages. Something in poetry seems to get confused when that private package has public dependencies. Specifically this case:

private-package depends on public-package which itself has further (public) dependencies.

1. poetry add private-package
2. poetry add public-package fails with [PackageNotFound]: Package [<private-package>] not found.

However poetry add works for public packages not depended on by private-package and also works for public packages which have no dependencies on their own, even if depended on by private-package.

[ojii]

Any news on this? Is there a good argument not to use --extra-index-url rather than --index-url?

I’ve actually thought about a good reason not to use --extra-index-url. Say you have a private package privpkg on your private repo. If someone now uploads privpkg to the public repo, using --extra-index-url would pull that in.

Maybe a better solution would be something like:

[tool.poetry.dependencies]
privpkg = { version = "^2.13.0", repo = "privaterepo" }

Though this raises the question how private and public dependencies of privpkg are handled, I guess the lockfile could take care of that?

[ojii]

Is there a way to make private repositories behave like --extra-index-url rather than --index-url (in pip)? Ideally I’d like poetry to try pypi.org first, then fall back to the company pypi.