[Bug 2150631] [NEW] apt fails to get source for URI that requires authentication

[Rolf Leggewie]

Public bug reported:

Let's say you have a private repository hosted and configured to require
authentication with user and password.  You put the necessary
information in /etc/apt/sources.list.d/private.sources and also
configured the credentials in /etc/apt/auth.conf.d/private.conf.
Installing binary deb packages from the repo works just as intended.
What does not work is downloading the source.

$ apt-get source mypackage-common
Reading package lists... Done
Picking 'mypackage-meta' as source package instead of 'mypackage-common'
Need to get 24,3 kB of source archives.
Err:1 https://repo.domain.org/private generic/main mypackage-meta 260429.4 (dsc)
  401  Unauthorized [IP: $IP 443]
Err:2 https://repo.domain.org/private generic/main mypackage-meta 260429.4 (tar)
  401  Unauthorized [IP: $IP 443]
E: Failed to fetch https://repo.domain.org/private/pool/main/r/mypackage-meta/mypackage-meta_260429.4.dsc  401  Unauthorized [IP: $IP 443]
E: Failed to fetch https://repo.domain.org/private/pool/main/r/rl-meta/rl-meta_260429.4.tar.gz  401  Unauthorized [IP: $IP 443]

It turns out, this fails for ordinary users but does work for root which
thinking about it is actually not so surprising, the auth.conf file is
only readable for root.  Maybe apt can detect this situation and show a
better warning to the user that they need to sudo so as to read the
credentials file when it exists?  "apt download" and "apt source" work
fine for ordinary users for ordinary repos not protected with an
authentication mechanism.

** Affects: apt (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: noble

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/2150631

Title:
  apt fails to get source for  URI that requires authentication

Status in apt package in Ubuntu:
  New

Bug description:
  Let's say you have a private repository hosted and configured to
  require authentication with user and password.  You put the necessary
  information in /etc/apt/sources.list.d/private.sources and also
  configured the credentials in /etc/apt/auth.conf.d/private.conf.
  Installing binary deb packages from the repo works just as intended.
  What does not work is downloading the source.

  $ apt-get source mypackage-common
  Reading package lists... Done
  Picking 'mypackage-meta' as source package instead of 'mypackage-common'
  Need to get 24,3 kB of source archives.
  Err:1 https://repo.domain.org/private generic/main mypackage-meta 260429.4 (dsc)
    401  Unauthorized [IP: $IP 443]
  Err:2 https://repo.domain.org/private generic/main mypackage-meta 260429.4 (tar)
    401  Unauthorized [IP: $IP 443]
  E: Failed to fetch https://repo.domain.org/private/pool/main/r/mypackage-meta/mypackage-meta_260429.4.dsc  401  Unauthorized [IP: $IP 443]
  E: Failed to fetch https://repo.domain.org/private/pool/main/r/rl-meta/rl-meta_260429.4.tar.gz  401  Unauthorized [IP: $IP 443]

  It turns out, this fails for ordinary users but does work for root
  which thinking about it is actually not so surprising, the auth.conf
  file is only readable for root.  Maybe apt can detect this situation
  and show a better warning to the user that they need to sudo so as to
  read the credentials file when it exists?  "apt download" and "apt
  source" work fine for ordinary users for ordinary repos not protected
  with an authentication mechanism.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/2150631/+subscriptions