In deterministic derivation schemes such as BIP-32, the essence of a wallet is reduced to two pieces of information: a private key and a derivation rule. We call these two in combination an
xPriv or extended private key.
Similarly, an extended public key (
xPub) consists of the corresponding public key and another derivation rule. We can easily find the public key from the private key. What about the derivation rule, though?
In the standard¹ case, the derivation rules are simple arithmetic with large numbers. Let's look at an example. Let
k be the main private key, the derivation rule
k' = k + 1,
g the generator, and the public key
K = k•g. So, when we derive the second key in the chain
k' we observe
k'•g = (k+1)•g = k•g + g = K + g = K'
which means that when the private keys are a scalar series created per additions of 1, the corresponding public keys would be a series of elliptic curve points derived by additions of the generator
g. So, we have both the main public key and a derivation rule by which we can find any subkey from it!
What does that have to do with your question? In the example you link to, Gabriel uses the described relationship between his
xPub and his
xPriv to keep the private key offline, and to only deploy the
xPub on his online system. This allows Gabriel to generate addresses as needed for the webshop, but keeps the private keys from being exposed to a potentially breachable online system. When Gabriel wants to spend some funds he received, he generates the transaction with the watch-only wallet and signs it offline by deriving the corresponding private keys with his hardware wallet as needed.
¹ There are also derivation rules that do not allow public keys to be derived from the main public key, e.g. by using a step of hashing in the derivation. Such "hardened" schemes require access to the main private key to derive additional addresses.