Poetry requesting information from a secondary PyPi source, even when it is not necessary, forces the solution to take a lot more time to execute

[vmgustavo]

• Poetry version: 1.1.15
• Python version: 3.10.6
• OS version and name: XUbuntu / Ubuntu 22.04.1 LTS

• I am on the latest stable Poetry version, installed using a recommended method.
  • No because of poetry 1.2.0 can't install packages from private pypi servers supporting only MD5 hashes #6301
• I have searched the issues of this repo and believe that this is not a duplicate.
  • Related issues:
    • Poetry not respecting order of evaluation for repository sources #2339
    • Using private repos in addition to the official PyPI #607
    • Poetry doesn't try public pypi when private pypi included #3855
• I have consulted the FAQ and blog for any relevant entries or release notes.
• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option) and have included the output below.

Issue

If I execute poetry lock for a pyproject file, it executes in:

1: Version solving took 15.224 seconds.
1: Tried 1 solutions.

If I maintain the exact same pyproject file but now I add a secondary PyPi source using this:

[[tool.poetry.source]]
name = "<private-pypi-name>"
url = "<private-pypi-url>"
default = false
secondary = true

The solution for poetry lock takes:

1: Version solving took 177.351 seconds.
1: Tried 1 solutions.

Which is quite a large increase in time for the same file. From what I can see using -vvv the problem seems to be this:

<private-pypi-name>: Response URL https://pypi.org/simple/ipykernel/ differs from request URL <private-pypi-url>/ipykernel/

For some reason, even though the source is configured as a not default secondary source poetry is still trying to read from it for every single dependency and taking a long time to get to the end result.

Since in the pyproject it is possible to add dependencies specifying the source:

<private-package> = {version = "^x.y.z", source = "<private-pypi-name>"}

Poetry should only request anything from the secondary source if the source is specified in the dependency name.

[neersighted]

Not a bug, by design, see/duplicate-ish of #6713. Also 1.1.15 is no longer supported in the upstream project; please update to 1.3 as soon as you are able.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.