Namespacing packages plus private (or public) pip patch that hardcodes the link of certain namespaces to certain repos would be the most obvious one (I spent 5

Namespacing packages plus private (or public) pip patch that hardcodes the link of certain namespaces to certain repos would be the most obvious one (I spent 5 seconds thinking about it so far not I'm not saying it's the best ever). Internal package registry that knows all internal package names and makes pip reject colliding names from other sources would be another possibility. Explicitly verifying the hash of the internal package based on the registry (again) and refusing to install packages that don't match the hash would be another option. I'm sure if a person smarter than me (Google probably has thousands) spends a day thinking about it, they could think of a dozen better ways.