Bzlmod is not fetching 'patches' using netrc credentials

[daniel-eiland]

Description of the bug:

Patches from a bzlmod registry are not being fetched with netrc credentials.

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Add netrc entry for the bazel registry and verify GETs for patch files do not include Authorization header.

Which operating system are you running Bazel on?

Linux

What is the output of bazel info release?

release 6.2.1

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse master; git rev-parse HEAD ?

N/A

Is this a regression? If yes, please try to identify the Bazel commit where the bug was introduced.

No

Have you found anything relevant by searching the web?

https://github.com/bazelbuild/bazel/blob/master/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/IndexRegistry.java#L251

Credentials / netrc info don't seem to be passed along with the patches.

Any other information, logs, or outputs that you want to share?

Some packets from internal server set as a registry (via --registry):
Patch file GET (no Authorization header):

04:16:23.533902 IP CLIENT.54130 > SERVER.80: Flags [P.], seq 15669:15945, ack 76109, win 841, length 276: HTTP: GET /bazel-central-registry-mirror/protobuf-patch-180/modules/platforms/0.0.6/patches/module_dot_bazel.patch HTTP/1.1
E..<.0@[email protected](
        m..r.P.....w&<P..Iux..GET /bazel-central-registry-mirror/protobuf-patch-180/modules/platforms/0.0.6/patches/module_dot_bazel.patch HTTP/1.1
Accept: text/html, image/gif, image/jpeg, */*
User-Agent: Bazel/release 6.2.1
Accept-Encoding: gzip
Host: bazel.corp.lucid.lcl
Connection: keep-alive

Non-patch file GET (Authorization header):

04:16:16.090425 IP 172.18.81.40.54130 > 10.9.109.6.80: Flags [P.], seq 6385:6677, ack 32215, win 501, length 292: HTTP: GET /bazel-central-registry-mirror/protobuf-patch-180/modules/platforms/0.0.6/source.json HTTP/1.1
E..L..@.@..^..Q(
        m..r.P.....vz.P...u...GET /bazel-central-registry-mirror/protobuf-patch-180/modules/platforms/0.0.6/source.json HTTP/1.1
Accept: text/html, image/gif, image/jpeg, */*
User-Agent: Bazel/release 6.2.1
Authorization: Basic anVuazpqdW5r
Accept-Encoding: gzip
Host: bazel.corp.lucid.lcl
Connection: keep-alive

[Wyverald]

dupe of #13709 (once that's fixed, this will automatically get fixed)

[daniel-eiland]

bzlmod is not usable with private repos until this is fixed.

[Wyverald]

As a stop-gap, you could try the NETRC environment variable, or using the --credential_helper flag. See the integration test at

bazel/src/test/py/bazel/bzlmod/bzlmod_credentials_test.py

Line 135 in 62799ed

def testCredentialsFromNetrc(self):