Private repos don't actually take precedence

[marcelmindemann]

• I have searched the issues of this repo and believe that this is not a duplicate.

Issue

I am using poetry 1.0.0b8. According to the latest documentation (https://github.com/sdispater/poetry/blob/master/docs/docs/repositories.md), if I have a project with a custom source in my pyproject.toml, it will always take precedence when installing packages.

This is not the case: We have a custom python package in our company JFrog that we named pyvault. By chance, there is a package in PyPI with the same name. In any project where we have our internal JFrog as a source, poetry add pyvault still adds the pyvault from PyPI. We can change that by specifying pyvault = { version = "^1.0", source = "jfrog" } in the pyroject.toml, so there is a work around, but the documentation is wrong.

[pappasam]

I'm also curious to see whether, and how, this treatment of private package indexes has been intentionally changed. Maybe there's a more-elegant treatment of alternative sources that just needs better documentation 🤞

[adawalli]

I also noticed this behavior when using artifactory. My work around is to use artifactory virtual repository, and then add
default=true
to the TOML entry for the repo, but its not ideal

[Imaclean74]

I was also surprised by this new behavior. Previously raised this issue : #1658
setting default=true does the trick but it's not obvious this is required

[levrik]

A comment here states that the PyPi repo is always added as last so private repos are preferred.
https://github.com/python-poetry/poetry/blob/master/poetry/factory.py#L185-L188
But it's added as the default repo which seems to always be put in the first place here:
https://github.com/python-poetry/poetry/blob/master/poetry/repositories/pool.py#L53

Looks like a bug to me.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.