if you add basic auth to the SSTATE_MIRRORS url (and I would imagine others that use fethc) bitbake ignores the mirror: Example: file://.* https://foo.com/sstate/PATH;user=foo:bar;downloadfilename=PATH fetch fails with a bunch of 401 HEAD methods in apache logs. But: file://.* https://foo.com/sstate/PATH;downloadfilename=PATH passes and uses the mirror. My guess is that this is happening in checkstatus in wget.py as it looks like it's not even attempting to use authentication there. 217.103.177.37 - - [23/Jun/2016:08:25:00 +0000] "HEAD /sstate-cache/46/sstate%3Atime%3Acortexa15t2hf-vfp-neon-rdk-linux-gnueabi%3A1.7%3Ar2%3Acortexa15t2hf-vfp-neon%3A3%3A46775fdb5d6752dd3710377408ab3552_package.tgz HTTP/1.1" 401 247 "-" "Python-urllib/2.7"