Support for .netrc with libcurl (PR#18892).

git-svn-id: https://svn.r-project.org/R/trunk@88391 00db46b3-68df-0310-9c12-caf00c1e9a41

Author: kalibera

src/library/base/man/connections.Rd

@@ -172,8 +172,8 @@ socketTimeout(socket, timeout = -1)
   \code{"libcurl"} for all others.  Which methods support which schemes
   has varied by \R version -- currently \code{"internal"} supports only
   \samp{file://}; \code{"wininet"} supports \samp{file://},
-  \samp{http://} and \samp{https://}.  Proxies can be specified: see
-  \code{\link{download.file}}.
+  \samp{http://} and \samp{https://}.  Proxies and user credentials can
+  be specified: see \code{\link{download.file}}.
 
   For \code{gzfile} the description is the path to a file compressed by
   \command{gzip}: it can also open for reading uncompressed files and
@@ -681,8 +681,9 @@ socketTimeout(socket, timeout = -1)
   \code{\link{gzcon}} to wrap \command{gzip} (de)compression around a
   connection.
 
-  \code{\link{options}} \code{HTTPUserAgent}, \code{internet.info} and
-  \code{timeout} are used by some of the methods for URL connections.
+  \code{\link{options}} \code{HTTPUserAgent}, \code{internet.info},
+  \code{netrc} and \code{timeout} are used by some of the methods for URL
+  connections.
 
   \code{\link{memCompress}} for more ways to (de)compress and references
   on data compression.

src/library/base/man/options.Rd

@@ -1,6 +1,6 @@
 % File src/library/base/man/options.Rd
 % Part of the R package, https://www.R-project.org
-% Copyright 1995-2025 R Core Team
+% Copyright 1995-2026 R Core Team
 % Distributed under GPL 2 or later
 
 \name{options}
@@ -264,6 +264,12 @@ getOption(x, default = NULL)
       to something in the order of (and typically slightly less than)
       \code{max.print} \emph{entries}.}
 
+    \item{\code{netrc}:}{character string. Path to netrc file with
+      user credentials for URLs requiring authentication.  The file, if it
+      exists, will be used by \samp{libcurl} in \code{\link{download.file}},
+      \code{\link{url}} and \code{\link{curlGetHeaders}}.  By default unset,
+      but can be set from environment variable \env{R_DEFAULT_NETRC}.}
+
     \item{\code{OutDec}:}{character string containing a single
       character.  The preferred character to be used as the decimal
       point in output conversions, that is in printing, plotting,

src/library/profile/Common.R

@@ -2,7 +2,7 @@
 ### Additional commands can be placed in site or user Rprofile files
 ### (see ?Rprofile).
 
-### Copyright (C) 1995-2023 The R Core Team
+### Copyright (C) 1995-2025 The R Core Team
 
 ### Notice that it is a bad idea to use this file as a template for
 ### personal startup files, since things will be executed twice and in
@@ -33,6 +33,10 @@ local({to <- as.integer(Sys.getenv("R_DEFAULT_INTERNET_TIMEOUT", 60))
     if (is.na(to) || to <= 0) to <- 60L
     options(timeout = to)
 })
+local({
+    if(nzchar(nr <- Sys.getenv("R_DEFAULT_NETRC")))
+        options(netrc = nr)
+})
 options(encoding = "native.enc")
 options(show.error.messages = TRUE)
 ## keep in sync with PrintDefaults() in  ../../main/print.c :

src/library/utils/man/download.file.Rd

@@ -1,6 +1,6 @@
 % File src/library/utils/man/download.file.Rd
 % Part of the R package, https://www.R-project.org
-% Copyright 1995-2024 R Core Team
+% Copyright 1995-2025 R Core Team
 % Distributed under GPL 2 or later
 
 \name{download.file}
@@ -133,6 +133,21 @@ download.file(url, destfile, method, quiet = FALSE, mode = "w",
   }
   (It is unrealistic to require download times of less than 1s/MB.)
 
+  A HTTP[S] URL may require authentication.  One may specify a username and
+  password as part of the URL, i.e. 
+  \code{"https://username:password@machine/..."}.  This is not recommended
+  with HTTP as the credentials will be sent in plaintext.  With HTTPS, they
+  will be encrypted, but still may appear in plaintext e.g.  in server logs. 
+  Alternatively, the credentials may be specified via \code{Authorization}
+  in argument \code{headers}, but that is more involved for the user and
+  wouldn't allow simultaneous download from different URLs requiring
+  authentication.  With \code{"libcurl"}, it is possible to have the
+  credentials in a netrc file which can be specified by the option
+  \code{netrc} and the default may be set by the environment variable
+  \env{R_DEFAULT_NETRC}.  The file should not be readable by other users. 
+  See \url{https://everything.curl.dev/usingcurl/netrc.html} for further
+  details.
+
   The level of detail provided during transfer can be set by the
   \code{quiet} argument and the \code{internet.info} option: the details
   depend on the platform and scheme.  For the \code{"libcurl"} method

src/modules/internet/libcurl.c

@@ -316,6 +316,16 @@ void curlCommon(CURL *hnd, int redirect, int verify)
 
     // enable the cookie engine, keep cookies in memory
     curl_easy_setopt(hnd, CURLOPT_COOKIEFILE, "");
+
+    SEXP snetrc = GetOption1(install("netrc"));
+    if (TYPEOF(snetrc) == STRSXP && LENGTH(snetrc) == 1) {
+	const void *vmax = vmaxget();
+	const char *p;
+	p = R_ExpandFileName(translateCharFP(STRING_ELT(snetrc, 0)));
+	curl_easy_setopt(hnd, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
+	curl_easy_setopt(hnd, CURLOPT_NETRC_FILE, p);
+	vmaxset(vmax);
+    }
 }
 
 static char headers[500][2049]; // allow for terminator