Description of the bug:

I encountered this issue while trying to use the mapbox SDK which requires .netrc authentication to download:
https://docs.mapbox.com/ios/maps/guides/install/

I use the rules_swift_package_manager rule set as a bazel module dependency to produce a repository rule from the Package.swift manifest in their repository.

It was able to generate the targets, but when those targets attempted to download the prebuilt mapbox framework with repository_ctx.download(), I got a 401 unauthorized error.

I initially inquired about adding support for .netrc credentials to their repository rule but I was instructed to use a credential helper instead.

However, it appears these do not work with bazel modules as I have not been able to get either the repository rule or just the http_file to use the credential helper to authenticate my request.

I was able to download the file with my netrc file in my home directory, without the credential helper, but this approach did not work for the repository rule.

Which category does this issue belong to?

No response

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

I created an example repository to reproduce the issue with fewer dependencies:
https://github.com/AttilaTheFun/credential_helper_bug

Just run:

bazel query "@mapbox//file"

And you will get the error:

logan@Logans-MBP credential_helper_bug % bazel query "@mapbox//file"
Starting local Bazel server and connecting to it...
INFO: Repository _main~mapbox_extension~mapbox instantiated at:
  callstack not available
Repository rule http_file defined at:
  /private/var/tmp/_bazel_logan/4f3056103a4a134a5a3e4ec875ef6723/external/bazel_tools/tools/build_defs/repo/http.bzl:466:28: in <toplevel>
WARNING: Download from https://api.mapbox.com/downloads/v2/mobile-maps-core/releases/ios/packages/10.16.1/MapboxCoreMaps.xcframework-dynamic.zip failed: class com.google.devtools.build.lib.bazel.repository.downloader.UnrecoverableHttpException GET returned 401 Unauthorized
ERROR: An error occurred during the fetch of repository '_main~mapbox_extension~mapbox':
   Traceback (most recent call last):
        File "/private/var/tmp/_bazel_logan/4f3056103a4a134a5a3e4ec875ef6723/external/bazel_tools/tools/build_defs/repo/http.bzl", line 173, column 33, in _http_file_impl
                download_info = ctx.download(
Error in download: java.io.IOException: Error downloading [https://api.mapbox.com/downloads/v2/mobile-maps-core/releases/ios/packages/10.16.1/MapboxCoreMaps.xcframework-dynamic.zip] to /private/var/tmp/_bazel_logan/4f3056103a4a134a5a3e4ec875ef6723/external/_main~mapbox_extension~mapbox/file/downloaded: GET returned 401 Unauthorized

Which operating system are you running Bazel on?

macOS Sonoma 14.1 (23B74)

What is the output of bazel info release?

release 6.4.0

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

N/A

What's the output of git remote get-url origin; git rev-parse master; git rev-parse HEAD ?

N/A

Is this a regression? If yes, please try to identify the Bazel commit where the bug was introduced.

I don't know if credential helpers ever worked with Bazel modules.

Have you found anything relevant by searching the web?

No

Any other information, logs, or outputs that you want to share?

No response