Explicit priority for source doesn't work with sub-dependencies that also have explicit priority for the same source

[pszpetkowski]

• Poetry version: 1.5.1
• Python version: 3.11.3
• OS version and name: Fedora 38
• pyproject.toml: https://github.com/pszpetkowski/poetry-bug-example

• I am on the latest stable Poetry version, installed using a recommended method.
• I have searched the issues of this repo and believe that this is not a duplicate.
• I have consulted the FAQ and blog for any relevant entries or release notes.
• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option) and have included the output below.

Issue

Explicit priority for source is a great idea but so far it seems to only be useful when a dependency doesn't have any dependencies that are stored in a private source itself. I've stumbled upon a problem where I have an application, let's call it foo_app and it depends on the foo package which in turn depends on the foo_base package. All of the foo_* dependencies are stored on the private PyPI server and it seemed like a great and clean idea to utilize the explicit priority to tell Poetry where to look. It worked for the foo package, because foo_base doesn't have any dependencies in a private source, however if explicit source is used for foo dependency in foo_app I'm getting the following error when trying to generate a lockfile with poetry lock:

Because foo (0.1.0) depends on foo_base (0.1.0) which doesn't match any versions, foo is forbidden.
So, because foo-app depends on foo (0.1.0), version solving failed.

To make it more visual the relationship basically looks like this:

foo_app ---------> (depends on) foo ---------> (depends on) foo_base

I've saved a debug output and upload as a gist at https://gist.github.com/pszpetkowski/614605f50ba2483e14ef69c49b15ef17

Above, for the pyproject.toml, I've provided a link to the repository that contains a minimal sample that showcases the issue. Hopefully it's enough to understand the issue, but if you need more information I'll be happy to provide it.

[radoering]

That's expected behavior. See Package Source Constraint, especially the second info box starting with "Package source keys are not inherited by their dependencies."

Dependencies of a package that comes from source A, do not have to come from source A, too.

[pszpetkowski]

Thank you for providing the exact link that explains it further, somehow I missed this.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.