search

aboutcode-org / python-inspector

Inspect Python code and PyPI package manifests. Resolve Python dependencies.
22 stars 19 forks source link

.netrc file is queried incorrectly #176

Open oheger-bosch opened 5 months ago

oheger-bosch commented 5 months ago

Python inspector relies on the .netrc file to obtain the credentials for private repositories. This file typically has a format as follows:

machine <host> login <username> password <password>
...

When looking up the credentials for a repository referenced by an --extra-index-url in a requirements.txt file, the full URL is matched against the machine field, not only the host name. This happens in api.py and in the get_netrc_auth helper function.

This means that credentials defined in .netrc files following the standard conventions cannot be found. In verbose mode, the tool logs the involved repositories with their credentials, and here None was printed, even though the host of the repository was defined in the file. To test whether my theory is correct, I changed my local .netrc file to actually contain the full index URL, and then it was indeed picked up, and the correct credentials were logged.

I think, this issue may be related to #127; if no credentials for private repositories are found, the packages cannot be resolved from there.

pombredanne commented 5 months ago

@oheger-bosch Thank you for the report and the detailed investigation.