One pip index URL for your packages and PyPI's

pip's own documentation calls --extra-index-url unsafe for private packages. A PyPI group puts your hosted repository and PyPI behind one index URL, so pip needs only that one. PyPI groups are in early access.

Start your free trial Set it up in two steps

What pip says about a second index

Using the --extra-index-url option to search for packages which are not in the main repository (for example, private packages) is unsafe. This is a class of security issue known as dependency confusion: an attacker can publish a package with the same name to a public index, which may then be chosen instead of your private package.

pip install, the pip documentation, as of .

With a PyPI group, pip reads one index URL, the group's, and gets your packages and PyPI's from it.

A PyPI group, in three lines

  • One index URL

    pip reads the group at its address with /simple/ added, and gets your packages and PyPI's from it.

    Group repository in the glossary

  • Hosted and proxy repositories

    A group takes your hosted Python repositories and PyPI proxy repositories, up to 10 in all.

  • Included on every plan

    PyPI groups are in early access, on every plan. npm groups are in early access too, for your hosted npm repositories. Adding the public npm registry to a group is coming soon.

Point pip at the group

Two steps. Replace your-org and python-group with your own.

  1. 1. Create the group

    In the admin portal, open Create Repository, choose Python and set Kind to Group. Add your hosted Python repository and a PyPI proxy repository to it. See Creating a Repository for the details.

  2. 2. Give pip the group's URL

    pip reads your repository token from ~/.netrc, so no command or URL carries it. The Python guide shows the entry.

    Terminal 
    # Your token stays in ~/.netrc, never in the URL.
export PIP_INDEX_URL="https://your-org.mycloudrepo.io/repositories/python-group/simple/"
pip install my-package requests

Configure it, or buy it

What JFrog and Sonatype document for the same problem, in their own words, with the page and the day we read it.

CloudRepo

Create a PyPI group. There is no pattern to write: the group checks your hosted repository for each name.

Included on every plan.

JFrog Artifactory

JFrog documents an Excludes Pattern you write on a virtual repository, listing your own package names.

specify an Excludes Pattern with your organization's groupID. In this way, any attempt to access your internal artifact from a remote repository would be rejected. Virtual Repositories, JFrog documentation, as of .

JFrog lists Curation among its optional add-ons.

JFrog pricing, archived, as of .

Sonatype Nexus Repository

Sonatype documents routing rules you set on a proxy repository.

Routing Rules are used to limit access to remote proxies to the namespaces for the components needed from that repository. Routing Rules, Sonatype documentation, as of .

Sonatype also sells Repository Firewall.

Repository Firewall offers protection from dependency confusion Namespace Confusion Protection, Sonatype documentation, as of .

Firewall Pro starts at $4,800 a year, for repositories other than Nexus Repository. For Nexus Repository, Sonatype quotes a price.

Sonatype pricing, archived, as of .

Give pip one index URL

Start a trial, create a PyPI group, and install your packages and PyPI's from one URL.

Start your free trial

No credit card required. Cancel anytime.