pip ignores netrc on Windows

[zaufi]

Description

I've added my private index which requires a user/password and %HOME%\_netrc file. However, despite found credentials pip ignores it and asks for the user name.

Expected behavior

pip gonna use found credentials

pip version

22.1.2

Python version

3.10.5

OS

Windows 11

How to Reproduce

1. add extra index with basic auth
2. add _netrc file to %HOME%
3. try to install smth from the added index

Output

Using pip 22.1.2 from c:\Python310\lib\site-packages\pip (python 3.10)
Non-user install because site-packages writeable
Created temporary directory: C:\Users\builder\AppData\Local\Temp\pip-ephem-wheel-cache-2urhk924
Created temporary directory: C:\Users\builder\AppData\Local\Temp\pip-build-tracker-q2ao2p26
Initialized build tracking at C:\Users\builder\AppData\Local\Temp\pip-build-tracker-q2ao2p26
Created build tracker: C:\Users\builder\AppData\Local\Temp\pip-build-tracker-q2ao2p26
Entered build tracker: C:\Users\builder\AppData\Local\Temp\pip-build-tracker-q2ao2p26
Created temporary directory: C:\Users\builder\AppData\Local\Temp\pip-install-_kvhoedn
Looking in indexes: https://pypi.org/simple, https://private.artifactory.host/vendor/api/pypi/pypi-release/simple
2 location(s) to search for versions of my-package:
* https://pypi.org/simple/my-package/
* https://private.artifactory.host/vendor/api/pypi/pypi-release/simple/my-package/
Fetching project page and analyzing links: https://pypi.org/simple/my-package/
Getting page https://pypi.org/simple/my-package/
Found index url https://pypi.org/simple
Looking up "https://pypi.org/simple/my-package/" in the cache
Request header has "max_age" as 0, cache bypassed
Starting new HTTPS connection (1): pypi.org:443
https://pypi.org:443 "GET /simple/my-package/ HTTP/1.1" 404 13
Status code 404 not in (200, 203, 300, 301, 308)
Could not fetch URL https://pypi.org/simple/my-package/: 404 Client Error: Not Found for url: https://pypi.org/simple/my-package/ - skipping
Fetching project page and analyzing links: https://private.artifactory.host/vendor/api/pypi/pypi-release/simple/my-package/
Getting page https://private.artifactory.host/vendor/api/pypi/pypi-release/simple/my-package/
Found index url https://private.artifactory.host/vendor/api/pypi/pypi-release/simple
Found credentials in netrc for private.artifactory.host
Looking up "https://private.artifactory.host/vendor/api/pypi/pypi-release/simple/my-package/" in the cache
Request header has "max_age" as 0, cache bypassed
Starting new HTTPS connection (1): private.artifactory.host:443
https://private.artifactory.host:443 "GET /vendor/api/pypi/pypi-release/simple/my-package/ HTTP/1.1" 401 80
Found index url https://private.artifactory.host/vendor/api/pypi/pypi-release/simple
User for private.artifactory.host: ERROR: Operation cancelled by user

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[pradyunsg]

The file is named .netrc -- see https://pip.pypa.io/en/stable/topics/authentication/#netrc-support for more details.

[zaufi]

The file is named .netrc -- see https://pip.pypa.io/en/stable/topics/authentication/#netrc-support for more details.

As one may see in the output:

Found credentials in netrc for private.artifactory.host

BTW, it's not the only pattern:

• https://github.com/pypa/pip/blob/main/src/pip/_vendor/requests/utils.py#L40=
• https://github.com/pypa/pip/blob/dc7abcada7e263e80af6c8d4ea2147c067c78d01/src/pip/_vendor/requests/utils.py#L186=

Also, I tried to set NETRC environment variable -- same effect.

[q0w]

so you don't have credentials in private repository url? Just plain url and netrc?

[zaufi]

so you don't have credentials in private repository url? Just plain url and netrc?

Exactly

[q0w]

maybe because of this #11113 (comment)?