Skip to content

Support basic auth in package-indices #5509

Closed
commercialhaskell/pantry
#32
@brandon-leapyear

Description

@brandon-leapyear

Please follow the steps below for reporting a bug:

Make sure that you are using the latest release (currently stack-2.5.1).
See the upgrade instructions to upgrade.

Please use the following schema for your bug report:

General summary/comments (optional)

We're trying to set up a company internal proxy for Hackage, so we're trying to set download-prefix in package-indices to https://username:[email protected].

TL;DR pantry's get function in Hackage.Security.Client.Repository.HttpLib.HttpClient

Steps to reproduce

Specify a URL in download-prefix with username/password. rm -rf stack.yaml.lock. When running stack build, check network traces and notice that username/password isn't being propagated.

Expected

It should download files from our proxy with user credentials

Actual

First problem: we get an error about root.json:

Could not deserialize <repo>/root.json: Schema error: Expected field "signed"

which is weird because if we curl the URL, we load root.json fine. With some debug statements, we found out that our proxy is actually returning a JSON object saying Authentication is required. This ticket is filed here: haskell/hackage-security#251

So after debugging the first issue, we find out that stack is somehow not propagating the basic auth credentials. Then I printed out uri in Hackage.Security.Client.Repository.Remote.getFile.download and it shows the URI with the basic auth credentials, so up to that point it keeps the basic auth around. But then it calls httpGet which pantry implements in its own implementation of Hackage.Security.Client.Repository.HttpLib.HttpClient, and there it calls setRequestHeaders, which seems to override the Authorization header set in setUri.

Stack version

Built from master

Method of installation

  • Official binary, downloaded from stackage.org or fpcomplete's package repository
  • Via cabal-install
  • An unofficial package repository (please specify which)
  • Other (please specify)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions