Support .netrc files

[janbernloehr]

pip supports obtaining credentials for authentication from .netrc files. This allows to keep pip.conf, --index-url and --find-links free of credentials and instead store them in a central place in ~/.netrc.

Unfortunately, uv does not support obtaining credentials from there.

This is also required, for e.g. using requirements.txt files that refer to wheels at urls that require auth

torch @ https://foo.org/torch.whl

[zanieb]

Thanks for the report! We definitely need to address registry authentication.

[brandon-piner-aruba]

We would also like the .netrc support. We specify the private repo in a slightly different way

# From Gemfury (https://pypi.fury.io/the-org/)
# =============================================
some-package
another-package

[framillien]

@zanieb Since you are using reqwest crate, using reqwest-netrc middleware could be an option ?

[framillien]

This work for index access, but fail on download since reqwest middleware is not used:
https://github.com/astral-sh/uv/blob/main/crates/uv-client/src/registry_client.rs#L415

[framillien]

In fact this is not download in itself that cause this issue, but only the read_metadata_range_request usage. If I activate reqwest-netrc and skip all metada range errors (here) the download succeed.

In my situation, the error we need to skip is an HTTP 401.