python-poetry / python-poetry/poetry

`.netrc` credentials take precedence over `poetry config http-basic`

Open
#8,443 2 comments 12 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/auth area/config kind/bug status/triage
Dominant language
Python
Stars
34.3k
Forks
2.5k
Avg merge
2d 19h
Merged PRs (30d)
30

Description

  • Poetry version: 1.6.1
  • Python version: 3.10.12
  • OS version and name: Ubuntu 22.04
  • pyproject.toml: Irrelevant
  • I am on the latest stable Poetry version, installed using a recommended method.
  • I have searched the issues of this repo and believe that this is not a duplicate.
  • I have consulted the FAQ and blog for any relevant entries or release notes.
  • If an exception occurs when executing a command, I executed it again in debug mode (-vvv option) and have included the output below.

Issue

Credentials configured in ~/.netrc are taking precedence over credentials configured with poetry config http-basic.repo-name. I've traced it down to the poetry.utils.Authenticator.request having the proper Authentication header for the credentials configured with poetry config, but the returned resp.request.headers contains the credentials configured in ~/.netrc.

I think this is a bug because the credentials configured explicitly with Poetry should take precedence over catch-all credentials configured in ~/.netrc. There is also no log line with -vvv indicating that credentials from ~./netrc are being used.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the poetry.utils.Authenticator.request entry point and reproduce the behavior with Poetry 1.6.1, comparing poetry config http-basic.repo-name credentials with ~/.netrc. Trace how the request is prepared and how resp.request.headers are populated; done means explicit Poetry credentials take precedence and -vvv logs the credential source.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.