Index: lib/libfetch/common.c
===================================================================
--- lib/libfetch/common.c
+++ lib/libfetch/common.c
@@ -1339,16 +1339,11 @@
 	return (word);
 }
 
-/*
- * Get authentication data for a URL from .netrc
- */
-int
-fetch_netrc_auth(struct url *url)
+static int
+fetch_netrc_open(void)
 {
+	const char *p;
 	char fn[PATH_MAX];
-	const char *word;
-	char *p;
-	FILE *f;
 
 	if ((p = getenv("NETRC")) != NULL) {
 		if (snprintf(fn, sizeof(fn), "%s", p) >= (int)sizeof(fn)) {
@@ -1368,8 +1363,25 @@
 			return (-1);
 	}
 
-	if ((f = fopen(fn, "r")) == NULL)
+	return (open(fn, O_RDONLY));
+}
+
+/*
+ * Get authentication data for a URL from .netrc
+ */
+int
+fetch_netrc_auth(struct url *url)
+{
+	const char *word;
+	FILE *f;
+
+	if (url->netrcfd == -2)
+		url->netrcfd = fetch_netrc_open();
+	if (url->netrcfd < 0)
+		return (-1);
+	if ((f = fdopen(url->netrcfd, "r")) == NULL)
 		return (-1);
+	rewind(f);
 	while ((word = fetch_read_word(f)) != NULL) {
 		if (strcmp(word, "default") == 0) {
 			DEBUG(fetch_info("Using default .netrc settings"));
Index: lib/libfetch/fetch.h
===================================================================
--- lib/libfetch/fetch.h
+++ lib/libfetch/fetch.h
@@ -47,6 +47,7 @@
 	off_t		 offset;
 	size_t		 length;
 	time_t		 ims_time;
+	int		 netrcfd;
 };
 
 struct url_stat {
Index: lib/libfetch/fetch.c
===================================================================
--- lib/libfetch/fetch.c
+++ lib/libfetch/fetch.c
@@ -284,6 +284,7 @@
 	seturl(pwd);
 #undef seturl
 	u->port = port;
+	u->netrcfd = -2;
 
 	return (u);
 }