APT Proxy Credentials in auth.conf

Use APT's authentication files for proxy credentials and scope entries to the proxy endpoint rather than placing secrets in general acquisition configuration.

APT can keep proxy credentials in an authentication file while the acquisition configuration contains only the endpoint:

Acquire::http::Proxy "http://proxy.example:3128/";

An appropriately protected auth.conf or supported auth.conf.d file contains the matching account:

machine http://proxy.example:3128
login example-user
password example-password

The endpoint and account are placeholders. Use the installed APT version's supported file location and restrict unauthorized reading while preserving the existing acquisition policy.

The machine token matches the proxy

Scheme, host, and port matter. Without a protocol, a documented machine entry matches HTTPS and tor+https. An ordinary HTTP proxy therefore needs an explicit matching http:// token, even when the package repository itself uses HTTPS.

Check APT's effective endpoint and authentication-file location, plus the downloading account's read access. A hostname, IP alias, or different port can select another entry. Missing credentials caused by a mismatch are not proof of a rejected password.

The separate file limits where the secret is stored. It does not encrypt a cleartext Basic exchange or replace repository signature and destination TLS verification.

Allakkat attuumassuteqartut