Not compatible with multi-line netrc file

[VictorEngmarkHexagon]

Some machines where I work connect directly to Cachix, and others connect via a proxy, so we have a two-line /etc/nix/netrc file:

machine [omitted].cachix.org password [omitted]
machine [proxy address] password [omitted; same as above]

When I try to connect to Cachix using this file, I get a HTTP 401-type response:

$ curl -s --netrc-file /etc/nix/netrc https://[omitted].cachix.org/nix-cache-info
Binary cache [omitted] doesn't exist or you're not authorized to access. Please check the name for typos and/or provide an auth token. Contact support on https://cachix.org if you're stuck!

But if I delete the proxy address line from the file, the request is successful:

$ curl -s --netrc-file /etc/nix/netrc https://[omitted].cachix.org/nix-cache-info
StoreDir: /nix/store
WantMassQuery: 1
Priority: 41

[sandydoo]

Are you sure this is how curl should be used with proxies? https://everything.curl.dev/usingcurl/proxies/index.html

Not compatible with multi-line netrc file

I'm somewhat confused by this title and what this has to do with cachix. Is this a general support question?

[VictorEngmarkHexagon]

It looks like cURL on Ubuntu 22.04 and 24.04 has buggy parsing of netrc files (tested in Docker containers). This has been fixed in Ubuntu 25.10, but I can't upgrade. Fortunately a colleague found a workaround, which you might want to add to the documentation: specifying login anonymous before the password.

[VictorEngmarkHexagon]

To reproduce:

cat > netrc-test.bash <<'EOF'
#!/usr/bin/env bash

set -o errexit

apt-get update
apt-get install -y curl

cat > netrc <<'EOnetrc'
machine private.cachix.org password secret
machine 10.11.12.13 password secret
EOnetrc

curl -v -s --netrc-file netrc https://private.cachix.org/nix-cache-info
EOF
chmod u+x netrc-test.bash
docker run --volume="${PWD}:/src" ubuntu:22.04@sha256:4cb780d50443fc4463f1f9360c03ca46512e4fdd8fd97c5ce7e69c8758924575 /src/netrc-test.bash

The relevant output line is

> authorization: Basic Og==

❯ base64 --decode <<< 'Og=='
:

So it just sent a single colon character.

In case of Ubuntu 24.04, docker run --volume="${PWD}:/src" ubuntu:24.04@sha256:66460d557b25769b102175144d538d88219c077c678a49af4afca6fbfc1b5252 /src/netrc-test.bash prints no "authorization" line, so it doesn't even send the password.

The issue is fixed in Ubuntu 25.05; docker run --volume="${PWD}:/src" ubuntu:25.04@sha256:27771fb7b40a58237c98e8d3e6b9ecdd9289cec69a857fccfb85ff36294dac20 /src/netrc-test.bash prints "Authorization: Basic OnNlY3JldA==", and

❯ base64 --decode <<< 'OnNlY3JldA=='
:secret

indicates that it actually sent the password.

[sandydoo]

This looks like: NixOS/nixpkgs#376106

All I can suggest in this situation is that you upgrade curl.

We worked on deploying patches for this throughout the Nix ecosystem 10 months ago. Nix, the main consumer of the netrc file as far as cachix is concerned, was promptly patched.

[VictorEngmarkHexagon]

I'm changing the netrc files to include the login field, which is a much faster and safer option for anyone running Ubuntu 22.04 (curl 7.81.0) or 24.04 (curl 8.5.0).