# Privately hosting BinaryBuilder products with authentication

**URL:** <https://discourse.julialang.org/t/privately-hosting-binarybuilder-products-with-authentication/88409>\
**Category:** Package Management\
**Tags:** pkg, binarybuilder, artifacts\
**Created:** [October 7, 2022, 3:43pm UTC](https://discourse.julialang.org/t/privately-hosting-binarybuilder-products-with-authentication/88409 "2022-10-07T15:43:02Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![danielmatz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/danielmatz/32/2285_2.png) [@danielmatz](https://discourse.julialang.org/u/danielmatz)\
**Post date:** [June 26, 2026, 6:52pm UTC](https://discourse.julialang.org/t/privately-hosting-binarybuilder-products-with-authentication/88409/22 "2026-06-26T18:52:25Z")

</div>

Revisiting my question, I now realize that Stefan’s original answer was all I needed. I just didn’t understand it at the time.

If you are using an SSH agent, libcurl knows how to get your credentials. But it can only do that if it knows your username for the remote system. I didn’t realize I could use the `.netrc` file to provide only a username, and not a password! Libcurl will get your username from the `.netrc` file and then look up your key with the SSH agent. It all works nicely when I have URLs with an `scp://` protocol in my `Artifacts.toml` file.

---

<div class="post-metadata">

**Author:** ![cserteGT3](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/csertegt3/32/8283_2.png) [@cserteGT3](https://discourse.julialang.org/u/cserteGT3)\
**Post date:** [July 2, 2026, 12:35pm UTC](https://discourse.julialang.org/t/privately-hosting-binarybuilder-products-with-authentication/88409/23 "2026-07-02T12:35:05Z")

</div>

Hi @danielmatz!  
I just stumbled into this thread and I see, that your deep into a similar problem to what I have. May I have some questions to clarify my understanding?  
My usecase is similar: building tarballs of a company-private library and wrapping it into a julia package. Our current setup: we authenticate to our Gitlab server via SSH and I already setup a git repo as private registry to work with SSH (on our machines and in Gitlab runners too). This works great for the last couple of months.

Now I am at the point where I need to wrap a binary library into a julia package. I can manage building the binaries and managing the access between Gitlab runners if needed, but not sure about the rest. Do I understand correctly, that delivering the tarballs won’t work with SSH? And I could either push the tarballs to gitlab package registry and setup `.netrc` files on every machine where I need the package (using gitlab access tokens); OR serve the files via an unauthenticated server (behind company firewall) and I can skip the authentication regarding the tarballs, and for everything else, the SSH authentication is sufficient.

---

<div class="post-metadata">

**Author:** ![danielmatz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/danielmatz/32/2285_2.png) [@danielmatz](https://discourse.julialang.org/u/danielmatz)\
**Post date:** [July 3, 2026, 1:29am UTC](https://discourse.julialang.org/t/privately-hosting-binarybuilder-products-with-authentication/88409/24 "2026-07-03T01:29:04Z")

</div>

Hi @cserteGT3.

SSH auth does work! I was just missing that I needed both my username in the `.netrc` file and an SSH agent running with my key loaded.

I’m not actually using a GitLab package registry, though. We have an HPC server, and I’m just uploading the files there. And then in the `Artifacts.toml` file, I use the `scp://` protocol in the URLs.

I’ll have to investigate using the GitLab package registry some more. That could be a nice alternative.

It seems like you could create a deploy token, put that in your `.netrc` file, and then use `https://` URLs to the artifacts in your package registry. But I haven’t tested that, yet.

Please let us know what ends up working for you!

---

<div class="post-metadata">

**Author:** ![cserteGT3](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/csertegt3/32/8283_2.png) [@cserteGT3](https://discourse.julialang.org/u/cserteGT3)\
**Post date:** [July 3, 2026, 1:19pm UTC](https://discourse.julialang.org/t/privately-hosting-binarybuilder-products-with-authentication/88409/25 "2026-07-03T13:19:31Z")

</div>

Thanks for confirming! I’ll try it (probably later than sooner) and report back.

I am also thinking on writing a blog post because I feel that the information pieces are bit scattered around about managing private registries.

[Previous page](https://discourse.julialang.org/t/privately-hosting-binarybuilder-products-with-authentication/88409.md?page=1)