diff --git a/lib/src/command/global_activate.dart b/lib/src/command/global_activate.dart
index 5b44fab..2959e6e 100644
--- a/lib/src/command/global_activate.dart
+++ b/lib/src/command/global_activate.dart
@@ -10,6 +10,7 @@
 
 import '../command.dart';
 import '../package_name.dart';
+import '../source/hosted.dart';
 import '../utils.dart';
 
 /// Handles the `global activate` pub command.
@@ -78,7 +79,15 @@
     }
 
     var overwrite = argResults['overwrite'];
-    var hostedUrl = argResults['hosted-url'];
+    Uri hostedUrl;
+    if (argResults.wasParsed('hosted-url')) {
+      try {
+        hostedUrl = validateAndNormalizeHostedUrl(argResults['hosted-url']);
+      } on FormatException catch (e) {
+        usageException('Invalid hosted-url: $e');
+      }
+    }
+
     Iterable<String> args = argResults.rest;
 
     dynamic readArg([String error]) {
diff --git a/lib/src/command/lish.dart b/lib/src/command/lish.dart
index eb57e0f..58d87d2 100644
--- a/lib/src/command/lish.dart
+++ b/lib/src/command/lish.dart
@@ -10,11 +10,13 @@
 
 import '../ascii_tree.dart' as tree;
 import '../command.dart';
+import '../exceptions.dart' show DataException;
 import '../exit_codes.dart' as exit_codes;
 import '../http.dart';
 import '../io.dart';
 import '../log.dart' as log;
 import '../oauth2.dart' as oauth2;
+import '../source/hosted.dart' show validateAndNormalizeHostedUrl;
 import '../utils.dart';
 import '../validator.dart';
 
@@ -33,20 +35,36 @@
 
   /// The URL of the server to which to upload the package.
   Uri get server {
+    if (_server != null) {
+      return _server;
+    }
+
     // An explicit argument takes precedence.
     if (argResults.wasParsed('server')) {
-      return Uri.parse(argResults['server']);
+      try {
+        return _server = validateAndNormalizeHostedUrl(argResults['server']);
+      } on FormatException catch (e) {
+        usageException('Invalid server: $e');
+      }
     }
 
     // Otherwise, use the one specified in the pubspec.
-    if (entrypoint.root.pubspec.publishTo != null) {
-      return Uri.parse(entrypoint.root.pubspec.publishTo);
+    final publishTo = entrypoint.root.pubspec.publishTo;
+    if (publishTo != null) {
+      try {
+        return _server = validateAndNormalizeHostedUrl(publishTo);
+      } on FormatException catch (e) {
+        throw DataException('Invalid publish_to: $e');
+      }
     }
 
-    // Otherwise, use the default.
-    return Uri.parse(cache.sources.hosted.defaultUrl);
+    // Use the default server if nothing else is specified
+    return _server = cache.sources.hosted.defaultUrl;
   }
 
+  /// Cache value for [server].
+  Uri _server;
+
   /// Whether the publish is just a preview.
   bool get dryRun => argResults['dry-run'];
 
@@ -75,15 +93,15 @@
     try {
       await oauth2.withClient(cache, (client) {
         return log.progress('Uploading', () async {
-          // TODO(nweiz): Cloud Storage can provide an XML-formatted error. We
-          // should report that error and exit.
-          var newUri = server.resolve('/api/packages/versions/new');
+          var newUri = server.resolve('api/packages/versions/new');
           var response = await client.get(newUri, headers: pubApiHeaders);
           var parameters = parseJsonResponse(response);
 
           var url = _expectField(parameters, 'url', response);
           if (url is! String) invalidServerResponse(response);
           cloudStorageUrl = Uri.parse(url);
+          // TODO(nweiz): Cloud Storage can provide an XML-formatted error. We
+          // should report that error and exit.
           var request = http.MultipartRequest('POST', cloudStorageUrl);
 
           var fields = _expectField(parameters, 'fields', response);
@@ -181,8 +199,14 @@
     final warnings = <String>[];
     final errors = <String>[];
 
-    await Validator.runAll(entrypoint, packageSize, server.toString(),
-        hints: hints, warnings: warnings, errors: errors);
+    await Validator.runAll(
+      entrypoint,
+      packageSize,
+      server,
+      hints: hints,
+      warnings: warnings,
+      errors: errors,
+    );
 
     if (errors.isNotEmpty) {
       log.error('Sorry, your package is missing '
diff --git a/lib/src/global_packages.dart b/lib/src/global_packages.dart
index a63d6a8..a863d41 100644
--- a/lib/src/global_packages.dart
+++ b/lib/src/global_packages.dart
@@ -123,7 +123,7 @@
       String name, VersionConstraint constraint, List<String> executables,
       {Map<String, FeatureDependency> features,
       bool overwriteBinStubs,
-      String url}) async {
+      Uri url}) async {
     await _installInCache(
         cache.hosted.source
             .refFor(name, url: url)
diff --git a/lib/src/source/hosted.dart b/lib/src/source/hosted.dart
index a3ee1e1..516edae 100644
--- a/lib/src/source/hosted.dart
+++ b/lib/src/source/hosted.dart
@@ -28,6 +28,60 @@
 import '../utils.dart';
 import 'cached.dart';
 
+/// Validates and normalizes a [hostedUrl] which is pointing to a pub server.
+///
+/// A [hostedUrl] is a URL pointing to a _hosted pub server_ as defined by the
+/// [repository-spec-v2][1]. The default value is `pub.dartlang.org`, and can be
+/// overwritten using `PUB_HOSTED_URL`. It can also specified for individual
+/// hosted-dependencies in `pubspec.yaml`, and for the root package using the
+/// `publish_to` key.
+///
+/// The [hostedUrl] is always normalized to a [Uri] with path that ends in slash
+/// unless the path is merely `/`, in which case we normalize to the bare domain
+/// this keeps the [hostedUrl] and maintains avoids unnecessary churn in
+/// `pubspec.lock` files which contain `https://pub.dartlang.org`.
+///
+/// Throws [FormatException] if there is anything wrong [hostedUrl].
+///
+/// [1]: ../../../doc/repository-spec-v2.md
+Uri validateAndNormalizeHostedUrl(String hostedUrl) {
+  Uri u;
+  try {
+    u = Uri.parse(hostedUrl);
+  } on FormatException catch (e) {
+    throw FormatException(
+      'invalid url: ${e.message}',
+      e.source,
+      e.offset,
+    );
+  }
+  if (!u.hasScheme || (u.scheme != 'http' && u.scheme != 'https')) {
+    throw FormatException('url scheme must be https:// or http://', hostedUrl);
+  }
+  if (!u.hasAuthority || u.host == '') {
+    throw FormatException('url must have a hostname', hostedUrl);
+  }
+  if (u.userInfo != '') {
+    throw FormatException('user-info is not supported in url', hostedUrl);
+  }
+  if (u.hasQuery) {
+    throw FormatException('querystring is not supported in url', hostedUrl);
+  }
+  if (u.hasFragment) {
+    throw FormatException('fragment is not supported in url', hostedUrl);
+  }
+  u = u.normalizePath();
+  // If we have a path of only `/`
+  if (u.path == '/') {
+    u = u.replace(path: '');
+  }
+  // If there is a path, and it doesn't end in a slash we normalize to slash
+  if (u.path.isNotEmpty && !u.path.endsWith('/')) {
+    u = u.replace(path: u.path + '/');
+  }
+  return u;
+}
+
 /// A package source that gets packages from a package hosting site that uses
 /// the same API as pub.dartlang.org.
 class HostedSource extends Source {
@@ -43,7 +97,7 @@
           : BoundHostedSource(this, systemCache);
 
   /// Gets the default URL for the package server for hosted dependencies.
-  String get defaultUrl {
+  Uri get defaultUrl {
     // Changing this to pub.dev raises the following concerns:
     //
     //  1. It would blow through users caches.
@@ -55,49 +109,45 @@
     //
     // Clearly, a bit of investigation is necessary before we update this to
     // pub.dev, it might be attractive to do next time we change the server API.
-    return _defaultUrl ??= _pubHostedUrlConfig() ?? 'https://pub.dartlang.org';
-  }
-
-  String _defaultUrl;
-
-  String _pubHostedUrlConfig() {
-    var url = io.Platform.environment['PUB_HOSTED_URL'];
-    if (url == null) return null;
-    if (url.endsWith('/')) {
-      url = url.substring(0, url.length - 1);
-    }
-    var uri = Uri.parse(url);
-    if (!uri.isScheme('http') && !uri.isScheme('https')) {
+    try {
+      return _defaultUrl ??= validateAndNormalizeHostedUrl(
+        io.Platform.environment['PUB_HOSTED_URL'] ?? 'https://pub.dartlang.org',
+      );
+    } on FormatException catch (e) {
       throw ConfigException(
-          '`PUB_HOSTED_URL` must have either the scheme "https://" or "http://". '
-          '"$url" is invalid.');
+          'Invalid `PUB_HOSTED_URL="${e.source}"`: ${e.message}');
     }
-    return url;
   }
 
+  Uri _defaultUrl;
+
   /// Returns a reference to a hosted package named [name].
   ///
   /// If [url] is passed, it's the URL of the pub server from which the package
-  /// should be downloaded. It can be a [Uri] or a [String].
-  PackageRef refFor(String name, {url}) =>
+  /// should be downloaded. [url] most be normalized and validated using
+  /// [validateAndNormalizeHostedUrl].
+  PackageRef refFor(String name, {Uri url}) =>
       PackageRef(name, this, _descriptionFor(name, url));
 
   /// Returns an ID for a hosted package named [name] at [version].
   ///
   /// If [url] is passed, it's the URL of the pub server from which the package
-  /// should be downloaded. It can be a [Uri] or a [String].
-  PackageId idFor(String name, Version version, {url}) =>
+  /// should be downloaded. [url] most be normalized and validated using
+  /// [validateAndNormalizeHostedUrl].
+  PackageId idFor(String name, Version version, {Uri url}) =>
       PackageId(name, this, version, _descriptionFor(name, url));
 
   /// Returns the description for a hosted package named [name] with the
   /// given package server [url].
-  dynamic _descriptionFor(String name, [url]) {
-    if (url == null) return name;
-
-    if (url is! String && url is! Uri) {
-      throw ArgumentError.value(url, 'url', 'must be a Uri or a String.');
+  dynamic _descriptionFor(String name, [Uri url]) {
+    if (url == null) {
+      return name;
     }
-
+    try {
+      url = validateAndNormalizeHostedUrl(url.toString());
+    } on FormatException catch (e) {
+      throw ArgumentError.value(url, 'url', 'url must be normalized: $e');
+    }
     return {'name': name, 'url': url.toString()};
   }
 
@@ -134,9 +184,9 @@
   ///
   /// If the package parses correctly, this returns a (name, url) pair. If not,
   /// this throws a descriptive FormatException.
-  Pair<String, String> _parseDescription(description) {
+  Pair<String, Uri> _parseDescription(description) {
     if (description is String) {
-      return Pair<String, String>(description, defaultUrl);
+      return Pair<String, Uri>(description, defaultUrl);
     }
 
     if (description is! Map) {
@@ -152,7 +202,16 @@
       throw FormatException("The 'name' key must have a string value.");
     }
 
-    return Pair<String, String>(name, description['url'] ?? defaultUrl);
+    var url = defaultUrl;
+    final u = description['url'];
+    if (u != null) {
+      if (u is! String) {
+        throw FormatException("The 'url' key must be a string value.");
+      }
+      url = validateAndNormalizeHostedUrl(u);
+    }
+
+    return Pair<String, Uri>(name, url);
   }
 }
 
@@ -210,8 +269,7 @@
 
   Future<Map<PackageId, _VersionInfo>> _fetchVersionsNoPrefetching(
       PackageRef ref) async {
-    var url = _makeUrl(
-        ref.description, (server, package) => '$server/api/packages/$package');
+    final url = _listVersionsUrl(ref.description);
     log.io('Get versions from $url.');
 
     String bodyText;
@@ -393,15 +451,12 @@
   }
 
   /// Parses [description] into its server and package name components, then
-  /// converts that to a Uri given [pattern].
-  ///
-  /// Ensures the package name is properly URL encoded.
-  Uri _makeUrl(
-      description, String Function(String server, String package) pattern) {
-    var parsed = source._parseDescription(description);
-    var server = parsed.last;
-    var package = Uri.encodeComponent(parsed.first);
-    return Uri.parse(pattern(server, package));
+  /// converts that to a Uri for listing versions of the given package.
+  Uri _listVersionsUrl(description) {
+    final parsed = source._parseDescription(description);
+    final hostedUrl = parsed.last;
+    final package = Uri.encodeComponent(parsed.first);
+    return hostedUrl.resolve('api/packages/$package');
   }
 
   /// Retrieves the pubspec for a specific version of a package that is
@@ -409,8 +464,7 @@
   @override
   Future<Pubspec> describeUncached(PackageId id) async {
     final versions = await _scheduler.schedule(id.toRef());
-    final url = _makeUrl(
-        id.description, (server, package) => '$server/api/packages/$package');
+    final url = _listVersionsUrl(id.description);
     return versions[id]?.pubspec ??
         (throw PackageNotFoundException('Could not find package $id at $url'));
   }
@@ -445,63 +499,71 @@
   Future<Iterable<RepairResult>> repairCachedPackages() async {
     if (!dirExists(systemCacheRoot)) return [];
 
-    return (await Future.wait(listDir(systemCacheRoot).map(
-      (serverDir) async {
-        var url = _directoryToUrl(p.basename(serverDir));
-        final results = <RepairResult>[];
-        var packages = <Package>[];
-        for (var entry in listDir(serverDir)) {
-          try {
-            packages.add(Package.load(null, entry, systemCache.sources));
-          } catch (error, stackTrace) {
-            log.error('Failed to load package', error, stackTrace);
-            results.add(
-              RepairResult(
-                _idForBasename(
-                  p.basename(entry),
-                  url: _directoryToUrl(serverDir),
-                ),
-                success: false,
+    return (await Future.wait(listDir(systemCacheRoot).map((serverDir) async {
+      final directory = p.basename(serverDir);
+      Uri url;
+      try {
+        url = _directoryToUrl(directory);
+      } on FormatException {
+        log.error('Unable to detect hosted url from directory: $directory');
+        // If _directoryToUrl can't intepret a directory name, we just silently
+        // ignore it and hope it's because it comes from a newer version of pub.
+        //
+        // This is most likely because someone manually modified PUB_CACHE.
+        return <RepairResult>[];
+      }
+
+      final results = <RepairResult>[];
+      var packages = <Package>[];
+      for (var entry in listDir(serverDir)) {
+        try {
+          packages.add(Package.load(null, entry, systemCache.sources));
+        } catch (error, stackTrace) {
+          log.error('Failed to load package', error, stackTrace);
+          results.add(
+            RepairResult(
+              _idForBasename(
+                p.basename(entry),
+                url: url,
               ),
-            );
-            tryDeleteEntry(entry);
-          }
-        }
-
-        // Delete the cached package listings.
-        tryDeleteEntry(p.join(serverDir, _versionListingDirectory));
-
-        packages.sort(Package.orderByNameAndVersion);
-
-        return results
-          ..addAll(await Future.wait(
-            packages.map(
-              (package) async {
-                var id = source.idFor(package.name, package.version, url: url);
-                try {
-                  await _download(id, package.dir);
-                  return RepairResult(id, success: true);
-                } catch (error, stackTrace) {
-                  var message = 'Failed to repair ${log.bold(package.name)} '
-                      '${package.version}';
-                  if (url != source.defaultUrl) message += ' from $url';
-                  log.error('$message. Error:\n$error');
-                  log.fine(stackTrace);
-
-                  tryDeleteEntry(package.dir);
-                  return RepairResult(id, success: false);
-                }
-              },
+              success: false,
             ),
-          ));
-      },
-    )))
+          );
+          tryDeleteEntry(entry);
+        }
+      }
+
+      // Delete the cached package listings.
+      tryDeleteEntry(p.join(serverDir, _versionListingDirectory));
+
+      packages.sort(Package.orderByNameAndVersion);
+
+      return results
+        ..addAll(await Future.wait(
+          packages.map((package) async {
+            var id = source.idFor(package.name, package.version, url: url);
+            try {
+              await _download(id, package.dir);
+              return RepairResult(id, success: true);
+            } catch (error, stackTrace) {
+              var message = 'Failed to repair ${log.bold(package.name)} '
+                  '${package.version}';
+              if (url != source.defaultUrl) message += ' from $url';
+              log.error('$message. Error:\n$error');
+              log.fine(stackTrace);
+
+              tryDeleteEntry(package.dir);
+              return RepairResult(id, success: false);
+            }
+          }),
+        ));
+    })))
         .expand((x) => x);
   }
 
   /// Returns the best-guess package ID for [basename], which should be a
   /// subdirectory in a hosted cache.
-  PackageId _idForBasename(String basename, {String url}) {
+  PackageId _idForBasename(String basename, {Uri url}) {
     var components = split1(basename, '-');
     var version = Version.none;
     if (components.length > 1) {
@@ -599,7 +661,11 @@
   ///
   /// Always throws an error, either the original one or a better one.
   void _throwFriendlyError(
-      error, StackTrace stackTrace, String package, String url) {
+    error,
+    StackTrace stackTrace,
+    String package,
+    Uri url,
+  ) {
     if (error is PubHttpException) {
       if (error.response.statusCode == 404) {
         throw PackageNotFoundException(
@@ -643,7 +709,8 @@
   /// any collisions, so the encoding is reversible.
   ///
   /// This behavior is a bug, but is being preserved for compatibility.
-  String _urlToDirectory(String url) {
+  String _urlToDirectory(Uri hostedUrl) {
+    var url = hostedUrl.toString();
     // Normalize all loopback URLs to "localhost".
     url = url.replaceAllMapped(
         RegExp(r'^(https?://)(127\.0\.0\.1|\[::1\]|localhost)?'), (match) {
@@ -656,7 +723,10 @@
       return '$scheme$localhost';
     });
     return replace(
-        url, RegExp(r'[<>:"\\/|?*%]'), (match) => '%${match[0].codeUnitAt(0)}');
+      url,
+      RegExp(r'[<>:"\\/|?*%]'),
+      (match) => '%${match[0].codeUnitAt(0)}',
+    );
   }
 
   /// Given a directory name in the system cache, returns the URL of the server
@@ -666,26 +736,27 @@
   /// directory name does not preserve the scheme, this has to guess at it. It
   /// chooses "http" for loopback URLs (mainly to support the pub tests) and
   /// "https" for all others.
-  String _directoryToUrl(String url) {
+  Uri _directoryToUrl(String directory) {
     // Decode the pseudo-URL-encoded characters.
     var chars = '<>:"\\/|?*%';
     for (var i = 0; i < chars.length; i++) {
       var c = chars.substring(i, i + 1);
-      url = url.replaceAll('%${c.codeUnitAt(0)}', c);
+      directory = directory.replaceAll('%${c.codeUnitAt(0)}', c);
     }
 
     // If the URL has an explicit scheme, use that.
-    if (url.contains('://')) return url;
+    if (directory.contains('://')) {
+      return Uri.parse(directory);
+    }
 
     // Otherwise, default to http for localhost and https for everything else.
     var scheme =
-        isLoopback(url.replaceAll(RegExp(':.*'), '')) ? 'http' : 'https';
-    return '$scheme://$url';
+        isLoopback(directory.replaceAll(RegExp(':.*'), '')) ? 'http' : 'https';
+    return Uri.parse('$scheme://$directory');
   }
 
   /// Returns the server URL for [description].
-  Uri _serverFor(description) =>
-      Uri.parse(source._parseDescription(description).last);
+  Uri _serverFor(description) => source._parseDescription(description).last;
 
   /// Enables speculative prefetching of dependencies of packages queried with
   /// [getVersions].
diff --git a/lib/src/validator.dart b/lib/src/validator.dart
index a7a948a..7d58c5c 100644
--- a/lib/src/validator.dart
+++ b/lib/src/validator.dart
@@ -122,7 +122,7 @@
   /// package, in bytes. This is used to validate that it's not too big to
   /// upload to the server.
   static Future<void> runAll(
-      Entrypoint entrypoint, Future<int> packageSize, String serverUrl,
+      Entrypoint entrypoint, Future<int> packageSize, Uri serverUrl,
       {List<String> hints, List<String> warnings, List<String> errors}) {
     var validators = [
       GitignoreValidator(entrypoint),
diff --git a/lib/src/validator/relative_version_numbering.dart b/lib/src/validator/relative_version_numbering.dart
index febd2ff..6609074 100644
--- a/lib/src/validator/relative_version_numbering.dart
+++ b/lib/src/validator/relative_version_numbering.dart
@@ -18,7 +18,7 @@
   static const String semverUrl =
       'https://dart.dev/tools/pub/versioning#semantic-versions';
 
-  final String _server;
+  final Uri _server;
 
   RelativeVersionNumberingValidator(Entrypoint entrypoint, this._server)
       : super(entrypoint);
diff --git a/test/get/hosted/explain_bad_hosted_url_test.dart b/test/get/hosted/explain_bad_hosted_url_test.dart
index 4e547a6..6de6860 100644
--- a/test/get/hosted/explain_bad_hosted_url_test.dart
+++ b/test/get/hosted/explain_bad_hosted_url_test.dart
@@ -16,15 +16,19 @@
     // Get once so it gets cached.
     await pubGet(
       environment: {'PUB_HOSTED_URL': 'abc://bad_scheme.com'},
-      error: contains(
-          'PUB_HOSTED_URL` must have either the scheme "https://" or "http://".'),
+      error: allOf(
+        contains('PUB_HOSTED_URL'),
+        contains('url scheme must be https:// or http://'),
+      ),
       exitCode: 78,
     );
 
     await pubGet(
       environment: {'PUB_HOSTED_URL': ''},
-      error: contains(
-          'PUB_HOSTED_URL` must have either the scheme "https://" or "http://".'),
+      error: allOf(
+        contains('PUB_HOSTED_URL'),
+        contains('url scheme must be https:// or http://'),
+      ),
       exitCode: 78,
     );
   });
diff --git a/test/hosted/fail_gracefully_on_invalid_url_test.dart b/test/hosted/fail_gracefully_on_invalid_url_test.dart
new file mode 100644
index 0000000..9cbfbe8
--- /dev/null
+++ b/test/hosted/fail_gracefully_on_invalid_url_test.dart
@@ -0,0 +1,109 @@
+// Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// @dart=2.10
+
+import 'package:pub/src/exit_codes.dart' as exit_codes;
+import 'package:test/test.dart';
+
+import '../descriptor.dart' as d;
+import '../test_pub.dart';
+
+void main() {
+  forBothPubGetAndUpgrade((command) {
+    test('fails gracefully if the url is invalid', () async {
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': 'not@url-com'}
+          }
+        })
+      ]).create();
+
+      await pubCommand(
+        command,
+        error: contains('url scheme must be https:// or http://'),
+        exitCode: exit_codes.DATA,
+        environment: {
+          'PUB_MAX_HTTP_RETRIES': '2',
+        },
+      );
+    });
+    test('fails gracefully if the url has querystring', () async {
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': 'http://example.foo/?key=value'}
+          }
+        })
+      ]).create();
+
+      await pubCommand(
+        command,
+        error: contains('querystring'),
+        exitCode: exit_codes.DATA,
+        environment: {
+          'PUB_MAX_HTTP_RETRIES': '2',
+        },
+      );
+    });
+
+    test('fails gracefully if the url has fragment', () async {
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': 'http://example.foo/#hash'}
+          }
+        })
+      ]).create();
+
+      await pubCommand(
+        command,
+        error: contains('fragment'),
+        exitCode: exit_codes.DATA,
+        environment: {
+          'PUB_MAX_HTTP_RETRIES': '2',
+        },
+      );
+    });
+
+    test('fails gracefully if the url has user-info (1)', () async {
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': 'http://user:pwd@example.foo/'}
+          }
+        })
+      ]).create();
+
+      await pubCommand(
+        command,
+        error: contains('user-info'),
+        exitCode: exit_codes.DATA,
+        environment: {
+          'PUB_MAX_HTTP_RETRIES': '2',
+        },
+      );
+    });
+
+    test('fails gracefully if the url has user-info (2)', () async {
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': 'http://user@example.foo/'}
+          }
+        })
+      ]).create();
+
+      await pubCommand(
+        command,
+        error: contains('user-info'),
+        exitCode: exit_codes.DATA,
+        environment: {
+          'PUB_MAX_HTTP_RETRIES': '2',
+        },
+      );
+    });
+  });
+}
diff --git a/test/hosted/will_normalize_hosted_url_test.dart b/test/hosted/will_normalize_hosted_url_test.dart
new file mode 100644
index 0000000..f2da266
--- /dev/null
+++ b/test/hosted/will_normalize_hosted_url_test.dart
@@ -0,0 +1,145 @@
+// Copyright (c) 2021, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// @dart=2.10
+
+import 'package:http/http.dart' as http;
+import 'package:pub/src/exit_codes.dart' as exit_codes;
+import 'package:shelf/shelf.dart';
+import 'package:test/test.dart';
+
+import '../descriptor.dart' as d;
+import '../test_pub.dart';
+
+void main() {
+  forBothPubGetAndUpgrade((command) {
+    test('does not require slash on bare domain', () async {
+      await servePackages((b) => b..serve('foo', '1.2.3'));
+      // All the tests in this file assumes that [globalPackageServer.url]
+      // will be on the form:
+      //   http://localhost:<port>
+      // In particular, that it doesn't contain anything path segment.
+      expect(Uri.parse(globalPackageServer.url).path, isEmpty);
+
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': globalPackageServer.url},
+          },
+        }),
+      ]).create();
+
+      await pubCommand(
+        command,
+        silent: contains('${globalPackageServer.url}/api/packages/foo'),
+      );
+    });
+
+    test('normalizes extra slash', () async {
+      await servePackages((b) => b..serve('foo', '1.2.3'));
+
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': globalPackageServer.url + '/'},
+          },
+        }),
+      ]).create();
+
+      await pubCommand(
+        command,
+        silent: contains('${globalPackageServer.url}/api/packages/foo'),
+      );
+    });
+
+    test('cannot normalize double slash', () async {
+      await servePackages((b) => b..serve('foo', '1.2.3'));
+      globalPackageServer.expect(
+        'GET',
+        '//api/packages/foo',
+        (request) => Response.notFound(''),
+      );
+
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': globalPackageServer.url + '//'},
+          },
+        }),
+      ]).create();
+
+      await pubCommand(
+        command,
+        error: contains(
+            'could not find package foo at ${globalPackageServer.url}//'),
+        exitCode: exit_codes.UNAVAILABLE,
+      );
+    });
+
+    /// Proxy request for '/my-folder/...' -> '/...'
+    ///
+    /// This is a bit of a hack, to easily test if hosted pub URLs with a path
+    /// segment works and if the slashes are normalized.
+    void _proxyMyFolderToRoot() {
+      globalPackageServer.extraHandlers[RegExp('/my-folder/.*')] = (r) async {
+        if (r.method != 'GET' && r.method != 'HEAD') {
+          return Response.forbidden(null);
+        }
+        final path = r.requestedUri.path.substring('/my-folder/'.length);
+        final res = await http.get(
+          Uri.parse(globalPackageServer.url + '/$path'),
+        );
+        return Response(res.statusCode, body: res.bodyBytes, headers: {
+          'Content-Type': res.headers['Content-Type'],
+        });
+      };
+    }
+
+    test('will use normalized url with path', () async {
+      await servePackages((b) => b..serve('foo', '1.2.3'));
+      _proxyMyFolderToRoot();
+
+      // testing with a normalized URL
+      final testUrl = globalPackageServer.url + '/my-folder/';
+      final normalizedUrl = globalPackageServer.url + '/my-folder/';
+
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': testUrl},
+          },
+        }),
+      ]).create();
+
+      await pubCommand(command);
+
+      await d.dir(appPath, [
+        d.file('pubspec.lock', contains('"$normalizedUrl"')),
+      ]).validate();
+    });
+
+    test('will normalize url with path by adding slash', () async {
+      await servePackages((b) => b..serve('foo', '1.2.3'));
+      _proxyMyFolderToRoot();
+
+      // Testing with a URL that is missing the slash.
+      final testUrl = globalPackageServer.url + '/my-folder';
+      final normalizedUrl = globalPackageServer.url + '/my-folder/';
+
+      await d.dir(appPath, [
+        d.appPubspec({
+          'foo': {
+            'hosted': {'name': 'foo', 'url': testUrl},
+          },
+        }),
+      ]).create();
+
+      await pubCommand(command);
+
+      await d.dir(appPath, [
+        d.file('pubspec.lock', contains('"$normalizedUrl"')),
+      ]).validate();
+    });
+  });
+}
diff --git a/test/validator/relative_version_numbering_test.dart b/test/validator/relative_version_numbering_test.dart
index e7bf261..0a9a1f7 100644
--- a/test/validator/relative_version_numbering_test.dart
+++ b/test/validator/relative_version_numbering_test.dart
@@ -13,8 +13,10 @@
 import '../test_pub.dart';
 import 'utils.dart';
 
-Validator validator(Entrypoint entrypoint) =>
-    RelativeVersionNumberingValidator(entrypoint, globalPackageServer.url);
+Validator validator(Entrypoint entrypoint) => RelativeVersionNumberingValidator(
+      entrypoint,
+      Uri.parse(globalPackageServer.url),
+    );
 
 Future<void> setup({String sdkConstraint}) async {
   await d.validPackage.create();
diff --git a/test/version_solver_test.dart b/test/version_solver_test.dart
index 8ae5a6e..44d0399 100644
--- a/test/version_solver_test.dart
+++ b/test/version_solver_test.dart
@@ -2968,7 +2968,7 @@
       // If the dep uses the default hosted source, grab it from the test
       // package server rather than pub.dartlang.org.
       dep = registry.hosted
-          .refFor(dep.name, url: globalPackageServer.url)
+          .refFor(dep.name, url: Uri.parse(globalPackageServer.url))
           .withConstraint(dep.constraint);
     }
     expect(dep.allows(id), isTrue, reason: 'Expected $id to match $dep.');