Resolve versions appearing in multiple extra indexes

[sapir]

Summary

This is intended to fix an issue similar to #1451 and #2083 for a case where there are multiple private extra-index-urls. afaik they're all equally trusted, so there shouldn't be any security issue.

Test Plan

I really don't know how to test this properly.

[notatallshaw]

afaik they're all equally trusted, so there shouldn't be any security issue.

Why would you make that assumption? It's very possible the user does not know the trust level of an index, that they could be using multiple public indexes. This assumption is the problem that pip is now stuck with, and leads to dependency confusion attacks.

I appreciate that isn't a review of this PR but the approach, but I don't see an open issue linked that this is supposed to solve.

[charliermarsh]

I appreciate the PR (nice job figuring this out) but I think we're unlikely to merge this, especially without some kind of user opt-in, since it does create additional safety issues that don't exist today.

[sapir]

afaik they're all equally trusted, so there shouldn't be any security issue.

Why would you make that assumption? It's very possible the user does not know the trust level of an index, that they could be using multiple public indexes. This assumption is the problem that pip is now stuck with, and leads to dependency confusion attacks.

I appreciate that isn't a review of this PR but the approach, but I don't see an open issue linked that this is supposed to solve.

Apologies, I meant that this is my actual use case, where I trust the extra indexes equally. For now I've solved it by instead setting up a kind of reverse proxy that combines the various indexes.