maintainer-feedback requested: [Bug 272674] ports-mgmt/pkg 1.20.4 fails to read from a web server using digest authentication with http

Bugzilla Automation <bugzilla@FreeBSD.org> has asked freebsd-pkg (Nobody)
<pkg@FreeBSD.org> for maintainer-feedback:
Bug 272674: ports-mgmt/pkg 1.20.4 fails to read from a web server using digest
authentication with http
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=272674



--- Description ---
I am running FreeBSD 12.4-RELEASE-p3 and use ports-mgmt/poudriere to create a
package repository. This repository is hosted on a web server accessed by other
machines and jails.  The web server uses digest authentication to provide basic
privacy for the contents of that repository (aiming to hide precise software
version numbers).

ports-mgmt/pkg version 1.19.2 works without issue. Version 1.20.4 fails.
Running pkg -d update I can see that version 1.20.4 attempts to fetch from my
web server using basic HTTP authentication but does not use digest
authentication in response to the server's 401 reply.

My pkg repository configuration:
my_poudriere_repo: {
  url:		 
"http://redactedusername:redactedpassword@pkg/${VERSION_MAJOR}${VERSION_MINOR}$
{ARCH}-default"
  enabled:	   true,
  signature_type: "pubkey"
  pubkey:	  "/etc/ssl/keys/my_pkg_repo.pub"
  mirror_type:	  "none"
}

I have attached a redacted version of the output from pkg -d update.

I note that pkg began to use libcurl in place of fetch from version 1.20.0.

Workarounds:
- Lock ports-mgmt/pkg to version 1.19.2 before updating packages by running:
# pkg lock ports-mgmt/pkg
- Remove digest authentication from webserver, switching to basic or none.