Using a local hackage mirror with HTTP Auth stopped working in 2.0

[zeha]

In previous versions (verified with cabal-install 1.22.6.0 library 1.22.5.0, but pretty sure also with some 1.24.x), this worked:

% grep hackage ~/.cabal/config 
repository hackage.haskell.org
  url: http://build:xxxxxxxxxxxxxxxx@nexus.namespace.at/nexus/repository/hackage-all/

With cabal-install 2.0.0.0 library 2.0.0.2, on OS X, the various cabal commands now fail with:

Warning: No mirrors found for
http://build:...@nexus.namespace.at/nexus/repository/hackage-all/
Unexpected response 401for http://build:...@nexus.namespace.at/nexus/repository/hackage-all/root.json

A quick tcpdump reveals that build:... is not just for display purposes, but actually gets sent in the HTTP request!

	GET /nexus/repository/hackage-all/root.json HTTP/1.1
	Host: nexus.namespace.at
	Authorization: Basic YnVpbGQ6Li4u
	User-Agent: cabal-install/2.0.0.0 (osx; x86_64)
	Accept: */*
	Cache-Control: no-transform

Note that YnVpbGQ6Li4u decodes to build:....

[phadej]

To clarify, build:... is the actual contents of YnVpbGQ6Li4u, but we should encode the password, i.e. xxxxxxxxxxxxxxxx. Shouldn't be hard to fix.

[zeha]

Yes. Sorry that wasn't clear enough :-)

[hvr]

• temporary workaround for this one: secure: False in custom repository section
• related: Support HTTP authentication for updating package lists and downloading packages #2761

[gbaz]

resolved by above.