I am trying to add a repository (datastax) to my sources. This repository ask you to add your username and password, and also warn that you will have to urlencode special characters.

So I added:

deb https://user@mail.com:p@ssword@debian.datastax.com/enterprise stable main

But apt-get update say:

W: Failed to fetch https://ssword@debian.datastax.com/enterprise/dists/stable/main/binary-amd64/Packages  Could not resolve host: ssword@debian.datastax.com

At this point, I just changed @ for %40:

deb https://user%40mail.com:p%40ssword@debian.datastax.com/enterprise stable main

But no dice, the error stay the exact same.

Before changing my password to remove any special character and hoping the error will not move to not finding mail.com:password@debian.datastax.com, could someone explain what I failed to understand in how apt-get work with special character and password protected repo?


The @ character is a reserved character in URLs.

Per [RFC 3986, Uniform Resource Identifier (URI): Generic Syntax, section 2.2, Reserved Characters][1]:

2.2. Reserved Characters

URIs include components and subcomponents that are delimited by characters in the "reserved" set. These characters are called "reserved" because they may (or may not) be defined as delimiters by the generic syntax, by each scheme-specific syntax, or by the implementation-specific syntax of a URI's dereferencing algorithm. If data for a URI component would conflict with a reserved character's purpose as a delimiter, then the conflicting data must be percent-encoded before the URI is formed.

reserved    = gen-delims / sub-delims

gen-delims  = ":" / "/" / "?" / "#" / "[" / "]" / "@"

sub-delims  = "!" / "$" / "&" / "'" / "(" / ")"
              / "*" / "+" / "," / ";" / "="

The purpose of reserved characters is to provide a set of delimiting characters that are distinguishable from other data within a URI. URIs that differ in the replacement of a reserved character with its corresponding percent-encoded octet are not equivalent. Percent- encoding a reserved character, or decoding a percent-encoded octet that corresponds to a reserved character, will change how the URI is interpreted by most applications. Thus, characters in the reserved set are protected from normalization and are therefore safe to be used by scheme-specific and producer-specific algorithms for delimiting data subcomponents within a URI.

Note that @ is listed as one of the "gen-delims". [1]: https://www.rfc-editor.org/rfc/rfc3986#section-2.2

  • Any hint on how to include it in a password in an URL?
    – Kusalananda
    May 5 '17 at 11:32
  • @Kusalananda I don't see how you can do that - "reserved" means you can't use it in any part of a URL as anything other than a separator character. May 5 '17 at 11:46
  • But... that rules out many character commonly used in passwords. That's really odd.
    – Kusalananda
    May 5 '17 at 11:49
  • 1
    @Kusalananda And that's just another reason putting passwords into URLs is a really bad idea. Read 3.2.1. User Information of the RFC: Use of the format "user:password" in the userinfo field is deprecated. ... The passing of authentication information in clear text has proven to be a security risk in almost every case where it has been used. May 5 '17 at 12:18
  • 1
    Not my question, but I must say I'm intrigued by it.
    – Kusalananda
    May 5 '17 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.