Subject: Re: bug#77760: 31.0.50; false positive match for smtpmail-try-auth-methods with password-store

From: Julien Cubizolles <[email-masked]>
Date: Sun, 20 Apr 2025 11:55:22 +0200

Robert Pluim <[email-masked]> writes:

>>>>>> On Fri, 18 Apr 2025 00:04:20 +0200, Julien Cubizolles <[email-masked]> said:
>
>     Julien> Robert Pluim <[email-masked]> writes:
>     >>>>>>> On Sat, 12 Apr 2025 11:13:15 +0200, Julien Cubizolles <[email-masked]> said:
>     >> 
>     Julien> The smtpmail-try-auth-methods give positive results for entries in the
>     Julien> password-store that don't match the right host. All
>     Julien> entries with the right :user and that hold a :secret are considered
>     Julien> valid. Adding :type 'netrc fixes this problem. I thought that adding :host in the
>     Julien> :require field should also fix it but for some reason it doesn't…
>     >> 
>     >> If youʼre testing in a single emacs session, then
>     >> `auth-source-forget-all-cached' will get things back into a sane state.
>
>     Julien> I tried it. It doesn't change the fact that the call to
>     Julien> auth-source-search from smtpmail-try-auth-methods will return a result
>     Julien> with a "match" for an entry in password-store with the right :user field
>     Julien> but a wrong :host. In my case, the right entry for smtp identification is
>     Julien> defined in .authinfo.gpg but because of entries with the same user field
>     Julien> but different host in password store, this smtp entry is not picked.
>
> Ah, youʼre using both password store and .authinfo.gpg? That might
> explain why I canʼt reproduce it using just .authinfo.gpg.

Actually, it's not the .authinfo.gpg source that's problematic, it's
only the password-store.

I tried with a minimal .password-store like the following

.password-store
├── web
    ├── website.fr
        ├── [email-masked]

and [email-masked] holding only a password, 

> Could you give me a (sanitized) sample of the failing config?
>
> Robert

auth-sources is only (password-store)

Attempting to send a message through Gnus with these headers

> From: Julien Cubizolles <[email-masked]>
> To: Julien Cubizolles <[email-masked]>
> Subject: test
> Date: Sun, 20 Apr 2025 11:50:07 +0200
> Message-ID: <[email-masked]>
> User-Agent: Gnus/5.13 (Gnus v5.13)

Fails with the following error : 

> Debugger entered--Lisp error: (error "Sending failed: 554 5.7.1 <unknown[37.166.5.196]>: Client host rejected: Access denied")
>   error("Sending failed: %s" "554 5.7.1 <unknown[37.166.5.196]>: Client host rejected: Access denied")

And the *Messages* buffer : 

> Decrypting /home/wilk/.password-store/web/website.fr/[email-masked]...done
> auth-source-pass: found 1 entry matching "[email-masked]": "web/website.fr/[email-masked]"
> auth-source-pass: return (:host smtp.free.fr :port 587 :user j.cubizolles) as final result (plus hidden password)
> auth-source-search: found 1 results (max 1) matching (:host "smtp.free.fr" :port "587" :user "j.cubizolles" :max 1 :require nil :create nil)

As you can see, auth-source-search claims to have found a match for
the host smtp.free.fr and user j.cubizolles when only the user is a match.

-- 
Julien Cubizolles