# Advice to avoid \`--extra-index-url\` to install private packages from GitLab CI

**URL:** <https://discuss.python.org/t/advice-to-avoid-extra-index-url-to-install-private-packages-from-gitlab-ci/18242>\
**Category:** Packaging\
**Created:** [August 15, 2022, 10:11pm UTC](https://discuss.python.org/t/advice-to-avoid-extra-index-url-to-install-private-packages-from-gitlab-ci/18242 "2022-08-15T22:11:54Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![brettcannon](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/brettcannon/32/34895_2.png) [@brettcannon](https://discuss.python.org/u/brettcannon)\
**Post date:** [August 15, 2022, 11:24pm UTC](https://discuss.python.org/t/advice-to-avoid-extra-index-url-to-install-private-packages-from-gitlab-ci/18242/2 "2022-08-15T23:24:41Z")

</div>

The ways I have seen this issue solved is with file hashing (typically via a `requirements.txt` file), or a controlled supply chain that is exposed via its own package server.

And as for option 1, see [How should a lockfile PEP (665 successor) look like?](https://discuss.python.org/t/how-should-a-lockfile-pep-665-successor-look-like/17690/) where a potential lock file spec is being discussed.

---

_[View the full topic](https://discuss.python.org/t/advice-to-avoid-extra-index-url-to-install-private-packages-from-gitlab-ci/18242)._