Skip to content

[repo-assist] Fix trailing slash mismatch in credential/token source lookup (#3592) - #4369

Merged
dsyme merged 1 commit into
masterfrom
repo-assist/fix-issue-3592-trailing-slash-ed472f7dbee570bb
Aug 27, 2026
Merged

dsyme merged 1 commit into
masterfrom
repo-assist/fix-issue-3592-trailing-slash-ed472f7dbee570bb

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

🤖 This PR was created by Repo Assist, an automated AI assistant.

Closes #3592

Root cause

AddCredentials (ConfigFile.fs) strips the trailing slash from a source URL before storing it in paket.config:

let AddCredentials (source, username, password, authType) = 
    ...
    AddCredentials (source.TrimEnd [|'/'|], username, password, authType)

However, getSourceNodes/GetAuthenticationForUrl compared the raw lookup source (as passed at paket push time, which may or may not have a trailing slash) against the stored value with exact string equality:

let getSourceNodes (credentialsNode : XmlNode) source nodeType = 
    ...
    |> Seq.filter (fun n -> n.Attributes.["source"].Value = source)

This meant a credential/token stored for (example.com/redacted) (slash stripped on save) would never match a lookup for (example.com/redacted) (slash present, e.g. because it came from a NuGet v2 feed JSON response), causing paket push to silently skip the stored credentials and fail with 401 Unauthorized, as reported in #3592.

Fix

getSourceNodes now trims trailing / from both the lookup source and each stored source attribute before comparing, so a stored/looked-up source pair matches regardless of trailing-slash presence.

Trade-offs

  • Minimal, surgical change — only affects source matching in the credential/token lookup path, no behavior change for sources that already matched exactly.
  • Did not change AddCredentials's trimming behavior on save, to avoid altering existing paket.config files.

Test Status

  • Build: dotnet build src/Paket.Core/Paket.Core.fsproj -f netstandard2.0 → succeeded, 0 errors.
  • Added unit test get source nodes ignores trailing slash mismatch in tests/Paket.Tests/Versioning/ConfigFileSpecs.fs.
  • Ran dotnet test tests/Paket.Tests/Paket.Tests.fsproj --filter "FullyQualifiedName~ConfigFileSpecs" → 3/3 passed on net9.0 (2 pre-existing tests skipped on this sandbox only because they require Windows ProtectedData.Protect for encryption; net461 host could not run due to missing mono in this sandbox — infrastructure limitation, not related to this change).

Generated by 🌈 Repo Assist, see workflow run. Learn more.
Comment /repo-assist to run again

Add this agentic workflow to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@ae8d551f07c7ed7619f8c58c7bb4c3ac89395d38

…e lookup

Stored credential/token sources have their trailing slash stripped by
AddCredentials, but GetAuthenticationForUrl/getSourceNodes compared the
raw (possibly slash-terminated) push/source URL against the stored
value with exact string equality. This caused paket push to silently
fail to find matching credentials (401 Unauthorized) whenever the URL
used at push time had a trailing slash that didn't match storage.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Trailing slashes in push-url lead to unauthorized

1 participant