pip-compile with --index-url option delivers pinned package versions that are not on passed package index

Question

We are using pip-tools in combination with a private package index.

Now, if I run

pip-compile --index-url https://user:[email protected]/api/../packages/pypi/simple

This creates a requirements.txt with pinned versions that are not existing in the passed private package index.

My expected behaviour would be that all pinned versions in requirements.txt should be available on package index or an error is returned. Otherwise, I do not see how I can use pip-tools in a private package environment.

Can anyone help and clarify the behaviour?

PS: I have also asked this questions in the github Repository (https://github.com/jazzband/pip-tools/issues/1546)

Answer 1

GitLab pypi registry proxies requests to upstream pypi when package doesn't exist in GitLab registry.

Originally posted by @richafrank in #1924 (comment).