Auth-protected repositories #125

New issue

Open

opened 2022-04-11 15:44:10 +02:00 by Jef Roosens · 0 comments

Jef Roosens commented

2022-04-11 15:44:10 +02:00

Owner

Using the XferCommand option in pacman.conf, it's possible to change what command Pacman uses to download files from the server. This combined with the fact that GNU wget can read credentials from a netrc file could allow the user to add a HTTP basic auth-protected repository to Pacman.

This does raise a couple questions:

How would a user configure this authentication for their Vieter instance?
Would this mean having to disable public repos by default?
Is it worth having separate passwords for each repository or would we e.g. use the repository name as the username & the API key as password?

Using the `XferCommand` option in `pacman.conf`, it's possible to change what command Pacman uses to download files from the server. This combined with the fact that GNU wget can read credentials from a netrc file could allow the user to add a HTTP basic auth-protected repository to Pacman. This does raise a couple questions: * How would a user configure this authentication for their Vieter instance? * Would this mean having to disable public repos by default? * Is it worth having separate passwords for each repository or would we e.g. use the repository name as the username & the API key as password?