python auth_error ai_generated partial

ERROR: Cannot install because of a dependency confusion: package 'internal-lib' resolved from public PyPI instead of private index

ID: python/pip-extra-index-url-dependency-confusion

Also available as: JSON · Markdown · 中文
80%Fix Rate
86%Confidence
0Evidence
2024-10-05First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.8 active — — —
3.9 active — — —
3.10 active — — —
3.11 active — — —
3.12 active — — —

Root Cause

When --extra-index-url is used, pip merges candidates from all indexes and picks the highest version. A malicious public package with the same name and higher version can shadow the intended private one.

generic

中文

使用 --extra-index-url 时，pip 会合并所有索引的候选包并选择最高版本。同名的恶意公共包如果版本更高，会遮蔽预期的私有包。

Workarounds

  1. 95% success 
    pip install --index-url https://private/simple 'internal-lib==1.2.3'
  2. 90% success 
    pip install --index-url https://private/simple --no-index internal-lib  # only if index has it
  3. 85% success 
    pip install -c constraints.txt --extra-index-url https://private/simple internal-lib

Dead Ends

Common approaches that don't work:

  1. 95% fail

    Still merges with PyPI; the public version wins if higher.

  2. 90% fail

    Trust does not affect resolution order.