Environment variable password does not authenticate private feed during convert-from-nuget

Description

I am converting a project from NuGet to Paket using the convert-from-nuget command. As per this page I should be able to authenticate a private feed through the %PRIVATE_FEED_USER% and %PRIVATE_FEED_PASS% variables, but I cannot. Supplying the credentials as plaintext in the file works and I have verified that the variables do exist in the executing environment as echo %PRIVATE_FEED_USER% and echo %PRIVATE_FEED_PASS% return the correct values.

The --creds-migrations options are not satisfactory as I would not like to have plaintext passwords in source control, but for a multi-user environment, it does not make sense to encrypt one user's credentials and put it under source control. Users should be able to supply their own credentials for the private (TeamCity) NuGet feed.

Repro steps

1. Have a non-Paket project that consumes a private NuGet feed (this one is TeamCity) for a dependency.
2. Create a .paket directory with paket.exe, paket.bootstrap.exe, and paket.targets
3. Create a paket.dependencies file to specify the source with source </path/to/feed/uri> username: "%PRIVATE_FEED_USER%" password: "%PRIVATE_FEED_PASS%"
4. Set the PRIVATE_FEED_USER and PRIVATE_FEED_PASS to valid credentials
5. Ensure that these are in effect in the current executing environment with echo
6. Run .paket/paket.exe convert-from-nuget --force or .paket/paket.exe convert-from-nuget in the main project directory.

Expected behavior

Environmental variables should authenticate private feeds with convert-from-nuget.

Actual behavior

Paket fails to retrieve package listing when using convert-from-nuget with environmental variables for a private NuGet feed, but succeeds when using plaintext credentials.

Known workarounds

Put plaintext credentials in the paket.dependencies file.

Related information

• Operating system: Windows 7 Professional SP1
• Branch: Paket master tagged 3.8.0
• .NET Runtime, CoreCLR or Mono Version: .NET Framework 4.5.1
• Performance information, links to performance testing scripts

I can spend some more time on this later, but I want to make sure this is not "expected behavior" and I'm just missing something.

Start with the convert-from-nuget command and the paket.dependencies source declaration described in the reproduction steps. Reproduce the failure with PRIVATE_FEED_USER and PRIVATE_FEED_PASS set, then compare it with plaintext credentials; done means the conversion retrieves the private-feed package listing using the environment variables.