How can I specify with pip that a given package should ONLY be installed if found in a private index, or should at least prefer that index over pypi?
I have a private registry on our internal Gitlab that is setup with the standard simple pypi layout. I don’t want to use –extra-index-url because this would make it susceptible to dependency confusion attacks. (for example if I am trying to install a package from my private index but there is a package of the same name and higher version on pypi it would use that instead). https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
I tried using –index-url instead. I would have expected this to fail, but it installed the package from pypi so I am not clear if this is still susceptible to dependency confusion attacks:
pip install -i https://git.mycompany.com/api/v4/projects/1337/packages/pypi/simple requests
Eric Wohnlich is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
3
https://docs.gitlab.com/ee/user/packages/pypi_repository/#install-a-pypi-package
When a PyPI package is not found in the package registry, the request is forwarded to pypi.org.
When you have a private package repository that proxies an upstream like GitLab does, --index-url solves the problem correctly like you’ve already done, assuming the proxying is in a manner that isn’t susceptible to the attack. (No properly implemented private package repository should be, and the documentation wording implies it isn’t, but feel free to test GitLab’s and go collect a bug bounty if it happens to be unsafe.)