Repository navigation
Conversation
cellar reads only coursier's credential sources; document where they live, the formats, and how to carry over an sbt .credentials file, instead of reading other tools' credentials. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ETVFFSQUFsAxXzjVsFwthR
Coursier holds file/env credentials back until a server rejects an
anonymous request with a 4xx. Azure Artifacts answers with 203 and a
sign-in page instead, which coursier cached as the POM: credentials were
never sent and the cache stayed broken with a checksum error.
- Route every coursier call through one FileCache with
rejectNonAuthoritativeResponses, so a 203 fails cleanly.
- Parse -r / maven.repositories URLs with coursier's RepositoryParser:
user:password in the URL becomes repository authentication, sent up
front (HTTPS-only unless the URL is http). Error messages mask it.
- README: correct the retry rule (any 4xx, not just 401), document URL
credentials with ${ENV} substitution, and a troubleshooting table.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ETVFFSQUFsAxXzjVsFwthR
- Drop the global 203 rejection: coursier documents most 203s as a
proxy's transformed body, and a sign-in page already fails on its
checksum (and is cached per user, so authenticated runs never see it).
- Proxy credentials: install coursier's proxy Authenticator from
http(s).proxyUser/proxyPassword, default proxyProtocol to http so an
https.proxy*-only setup is answered, and allow Basic for HTTPS tunnels
in the native image, where that setting is fixed at build time.
- :latest and "did you mean" suggestions go through the same mirrors as
the fetch (scala-cli and Maven settings mirrors included).
- Mask everything between scheme and last @ in repository URL errors;
explain that credentials with / ? # @ cannot go in a URL.
- A duplicate repository carrying credentials wins over one without.
- README: credential sources incl. Maven settings mirrors, ${?ENV},
per-project credentials, proxies, troubleshooting.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ETVFFSQUFsAxXzjVsFwthR
rochala
force-pushed
the
private-repo-credentials
branch
from
October 21, 2026 15:43
17a47b9 to
4371410
Compare
rochala
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #191: credential and proxy handling for external commands, plus a README section that documents exactly what coursier reads.
Changes
-r/maven.repositoriesURLs go through coursier'sRepositoryParser:https://user:token@host/...becomes repository authentication, sent with the first request (HTTPS-only unless the URL ishttp). Previously the userinfo was silently ignored. This is what Azure Artifacts needs: it answers anonymous requests with203+ a sign-in page, so challenge-based credentials never reach it.@(tokens may contain/,@,#), and explain that such credentials cannot go in a URL.-rwins over the same URL configured without them.http(s).proxyUser/proxyPasswordnow work: coursier's proxyAuthenticatoris installed at startup,proxyProtocoldefaults tohttp(otherwise anhttps.proxy*-only setup is never answered), and the native image allows Basic for HTTPS tunnels — that JDK setting is fixed at image build time.:latestand "did you mean" suggestions now go through the same mirrors as the fetch (coursier'sVersions/Completeskip the scala-cli and Mavensettings.xmlmirrorsResolveapplies), so they work behind a company mirror.203rejection. Considered and dropped: coursier documents most203s as a proxy's transformed body. A sign-in page already fails on its checksum, and coursier caches per user, so authenticated runs never see it.settings.xmlmirrors +<server>credentials, coursier's default;COURSIER_MAVEN_SETTINGS=falseopts out), formats, sbt.credentialsmapping, URL credentials with${?ENV}, per-project setup, proxies (forward, auth, TLS, mirrors), troubleshooting table,COURSIER_HTTP_DEBUG.Verification
lib.test,cli.test,profilingRuntime.testpass;./mill _.fix --checkclean.PrivateRepositoryTestagainst in-process servers: URL credentials reach a203-for-anonymous feed with no anonymous request made; an authenticating forward proxy is passed the proxy credentials; anhttps.proxy*-only setup is answered. Mutation-checked: removing the authenticator or theproxyProtocoldefault fails the respective test.RepositoryUrlTest: masking with/,@and token-only credentials;ExtraRepositoriesTest: credentialed duplicate wins.https.*only), wrong proxy password,settings.xmlmirror with<server>credentials incl.:latestand suggestions,${?UNSET}in project config, credentials-file/inline/realm/URL against401/404/203servers,--debugnever prints the password.🤖 Generated with Claude Code
https://claude.ai/code/session_01ETVFFSQUFsAxXzjVsFwthR