Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Replace the `secondary` source type with more granular types

See original GitHub issue

Poetry currently will look up packages in every source, even when unnecessary due to a source = constraint on a dependency, or if the dependency was already found. This behavior often surprises users (though it was originally modeled on pip). Ostensibly, secondary is the solution to this – however, it merely pushes the repository further back in the search order and does little to address the user complaints/confusion. As such, we should deprecate it and replace it with new options that better match user expectations.

I think, to preserve backwards compatibility, the long-term path forward is probably two different options (in my example, supplemental and private). I would propose something like the following, as an overview of behaviors:

No options means that the repository overlays PyPI, but we will still fall back to PyPI if necessary (e.g. suitable for internal mirrors), pip --extra-index-url-style. This is known internally as primary, and is the current behavior.
default = true means that the repository replaces PyPI, pip --index-url-style. This is the current behavior.
supplemental = true means that this source is only consulted after a lookup in the default (implicitly PyPI unless configured otherwise) and primary sources fail.
private = true means that the repo will only be considered for packages that are explicitly configured with source =, and should be preferred by users for private packages to avoid dependency confusion attacks.

secondary = true would be kept around as a deprecated option (likely with a warning), and would maintain the legacy behavior of being searched exhaustively for backwards compatibility.

Originally https://github.com/python-poetry/poetry/pull/5984#issuecomment-1237245571

Issue Analytics

State:
Created a year ago
Reactions:24
Comments:13 (9 by maintainers)

Top GitHub Comments

7reactions

kkozmiccommented, Oct 10, 2022

The cases that come to mind for me are

One more that is crucial to my team:

use pypi for most, and a private repository only for our internal packages. Internal packages always as a rule define source = "our-internal-repo". We would expect internal packages to only be looked up in our internal repo, and all other packages to only be looked up in pypi

0reactions

vmgustavocommented, Dec 14, 2022

Is there any palliative solution?

Top Results From Across the Web

Secondary Sources - Sources of American Law

This chapter will describe the most common types of secondary sources the researcher is likely to encounter, when they should (and should not)...

Primary vs. Secondary - Primary Sources: A Research Guide

Secondary Sources are one step removed from primary sources, though they often quote or otherwise use primary sources. They can cover the same ......

Types of Sources and Where to Find Them: Secondary Sources

Typically, secondary sources offer an interpretation of the past based on analysis and synthesis of primary sources. Examples of secondary sources include:.

Data Sources for Registries - NCBI Bookshelf - NCBI - NIH

This chapter will review the various sources of both primary and secondary data, comment on their strengths and weaknesses, and provide some examples...

Primary vs. Secondary Sources - Evidence Based Practice

Secondary sources list, summarize, compare, and evaluate primary information and studies so as to draw conclusions on or present current state ...