[Bug]: username:password from before @ in https URL not used

[jangernert]

Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a bug that matches the one I want to file, without success.

flatpak-builder version

1.2.0

Flatpak version

1.12.3

How to reproduce

1. Add a source of type file with an url that contains basic auth information to a sources.json
2. add the sources.json to the sources of the flatpak manifest
3. run flatpak-builder CLI

Expected Behavior

downloading all the sources

Actual Behavior

Failed to download sources: module: The requested URL returned error: 401

Additional Information

The URL points to a gitlab nuget repository and contains basic auth information:

https://user:password@gitlab.com/api/v4/projects/project_id/packages/nuget/download/package_name/package_version/file_name.nupkg

Downloading the file via curl and firefox works fine.

[smcv]

I suspect this means that flatpak-builder's downloading code doesn't support putting a username/password into the URL like this, so it is effectively using https://gitlab.com/api/v4/projects/project_id/packages/nuget/download/package_name/package_version/file_name.nupkg, which fails with error 401, meaning authentication is required.

[jangernert]

That's what I suspected at first. But libsoup seems to support it. There are at least tests for it: https://github.com/GNOME/libsoup/blob/master/tests/auth-test.c#L1726

[bbhtt]

That's what I suspected at first. But libsoup seems to support it. There are at least tests for it: https://github.com/GNOME/libsoup/blob/master/tests/auth-test.c#L1726

flatpak-builder uses libcurl now as of ~4 years ago.

This should work with #646 as long as you have the credentials in netrc file (usually ~/.netrc by default).