Subject: bug#78189: 31.0.50; require properties :key and :cert in auth search done from `network-stream-certificate'

From: Ted Zlatanov <[email-masked]>
Date: Sun, 04 May 2025 16:15:01 -0400

On Thu, 1 May 2025 16:36:42 +0200 Jens Schmidt <[email-masked]> wrote: 

JS> Function `network-stream-certificate' attempts to find a suitable client
JS> certificate for HOST and SERVICE by doing a search through the available
JS> auth sources, like this ("old search"):

JS>   (let* ((auth-info
JS>           (ignore-errors
JS>             (car (auth-source-search :max 1
JS>                                      :host host
JS>                                      :port (format "%s" service)))))

JS> I think this search should better explicitly require properties :key and
JS> :cert for the auth source search, like this ("new search"):

JS>   (let* ((auth-info
JS>           (ignore-errors
JS>             (car (auth-source-search :max 1
JS>                                      :host host
JS>                                      :port (format "%s" service)
JS>                                      :require '(:key :cert)))))

JS> The rest of this mail tries to convince me and you that this is TRT to
JS> do.  If you don't need convincing, you might skip it and instead check
JS> the attached patch.

I'm OK with a patch to prefer entries with :key and :cert.

I wonder if it might be better to just say "prefer the most
specific/interesting" in a generic way? Like

:prefer '(:key :cert)

which can also be one of these

:prefer 'most-keys ;;; count of keys
:prefer 'most-detail ;;; length of serialized entry?
:prefer 'network-stream-keys ;;; knows to look for host, port, key, cert

but that's extra work and maybe your proposed patch is simple enough to
Just Work.

Ted