News for hackers. Stuff that matters.
Re:Compromised PyTorch-nightly dependency chain December 30t... by codethief on Sunday January 01, 2023 @08:23AM (#34206084)
> The recommended approach of distributing wheels in private repositories is by using a repository server that allows proxying/redirecting the public pypi packages to pypi, and users should be using a single --index-url pointed to that private repository (assuming the maintainer of that private repository is to be trusted).

Alternatively, keep a separate requirements_private.txt around for private dependencies and add a line --index-url <my private repository>.

There are no comments on this comment yet.