Credentials management confuses package source URL conventions

[haraldsteinlechner]

Description

It seems, that on one of our setups paket requires credentials registered for both, normalized package urls (without /v3/index.json) and full urls with suffix /v3/index.json
I just debugged all the way until i got to the place where the package sources have no proper authentication.
I hope people more involved in the code can reason about this description, otherwise i need to prepare a setup which is a little time consuming.

maybe this is also intended behaviour, still is wasted some hours ;)

Repro steps

• use package sources requiring authentication and only register the long url version (add-credentials) ending with /v3/index.json
• install

Expected behavior

works

Actual behavior

fails with unauthorized exception

Known workarounds

register package sources in different variants

@WalchAndreas @kkroesl @luithefirst

[matthid]

So you are using the v3 source in the dependencies file, but it only works when the v2 url is added as well?
Can you post your dependencies file?

[haraldsteinlechner]

no. i needed to add credentials for two versions of the same source. example:
.paket\paket.exe config add-credentials https://some-myget-Url/F/somefeed/api/v3/index.json
AND
.paket\paket.exe config add-credentials https://some-myget-Url/F/somefeed

where the dependencies file only lists the full url as such:
source https://some-myget-Url/F/somefeed/api/v3/index.json

somewhere in the code, when checking sources the connection to the source was established by using the full /v3/index.json version. than later in the resolution process some parts of the code try to use the shortened version which turns out to have no authentication stored and then all dies.