[Bug]: username:password from before @ in https URL not used

[jangernert]

Checklist

• [X] I agree to follow the Code of Conduct that this project adheres to.
• [X] I have searched the issue tracker for a bug that matches the one I want to file, without success.

flatpak-builder version

1.2.0

Flatpak version

1.12.3

How to reproduce

1. Add a source of type file with an url that contains basic auth information to a sources.json
2. add the sources.json to the sources of the flatpak manifest
3. run flatpak-builder CLI

Expected Behavior

downloading all the sources

Actual Behavior

Failed to download sources: module: The requested URL returned error: 401

Additional Information

The URL points to a gitlab nuget repository and contains basic auth information:

https://user:[email protected]/api/v4/projects/project_id/packages/nuget/download/package_name/package_version/file_name.nupkg

Downloading the file via curl and firefox works fine.

[smcv]

I suspect this means that flatpak-builder's downloading code doesn't support putting a username/password into the URL like this, so it is effectively using https://gitlab.com/api/v4/projects/project_id/packages/nuget/download/package_name/package_version/file_name.nupkg, which fails with error 401, meaning authentication is required.

[jangernert]

That's what I suspected at first. But libsoup seems to support it. There are at least tests for it: https://github.com/GNOME/libsoup/blob/master/tests/auth-test.c#L1726