Assuming you already have a private pip repository and you want to serve some patched version of a package from your private pip repo and the rest from the public pip repo.
There is no priority among the --extra-index-url and --index-url, but we can handle this at private pip repo level.
If we look at the pip repo structure it is something like this:
├── bar
│ └── bar-0.1.tar.gz
│ └── bar-0.2.tar.gz
│ └── index.html ## 1
└── foo
│ ├── foo-1.0.tar.gz
│ └── foo-2.0.tar.gz
│ └── index.html
└── index.html ## 2
Each index.html file is responsible for listing the all the file in the dir and simply contains the links of each files.
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
<title>Bar Python Packages</title>
</head>
<body>
<pre>
45.63 KiB 2024-06-20T11:22:29Z <a href="./bar-2.0.2-py3-none-any.whl">bar-2.0.2-py3-none-any.whl</a>
45.63 KiB 2024-06-20T11:22:29Z <a href="./bar-2.0.2-py3-none-any.whl">bar-3.0.0-py3-none-any.whl</a>
45.63 KiB 2024-06-20T11:22:29Z <a href="./bar-2.0.2-py3-none-any.whl">bar-4.0.0-py3-none-any.whl</a>
..
</pre>
</body>
</html>
But the link need not to be local, we can specify the link to point to pip, like this:
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
<title>Bar Python Packages</title>
</head>
<body>
<pre>
45.63 KiB 2024-06-20T11:22:29Z <a href="./bar-2.0.2-py3-none-any.whl">bar-2.0.2-py3-none-any.whl</a>
45.63 KiB 2024-06-20T11:22:29Z <a href="./bar-2.0.2-py3-none-any.whl">bar-3.0.0-py3-none-any.whl</a>
45.63 KiB 2024-06-20T11:22:29Z <a href="https://files.pythonhosted.org/packages/02/2b/982217eab772d5e969c04614f6b77c158aee9699201a616cc00c1645326e//bar-2.0.2-py3-none-any.whl">bar-4.0.0-py3-none-any.whl</a>
..
</pre>
</body>
</html>
Now we can replace the last index.html file and place it in /bar/index.html in the private pip index.
If we now run pip install "bar==2.0.2" --index-url="<path-to-private-repo>" it will be using .whl files from private pip and if we run
pip install "bar==4.0.0" --index-url="<path-to-private-repo>" it will be point to public pip, and will use the wheels from there.
To get the URL for .whl files from public pip we can use - https://pypi.org/pypi/<bar>json and get it from the field releases.<version>.url.
One downside of this approach is that we have to keep up to date with new releases of the package and keep updating the index.html in a private repo.
pip installcommand will download a package from the public PyPI, if someone happens to create such a package at PyPI. This is obviously a security issue. – Outlying