In case it's relevant, this was during a kiwi build. The password protected rpm repo was present in the kiwi xml in this format: <repository type="rpm-md" repository_gpgcheck="false" package_gpgcheck="false" alias="***" priority="1"> <source path="https://***user***:***password***@xxx.xxx.xxx/artifactory/xxx"/> </repository>