{"thread":{"id":"62763","subject":"Re: [PATCH] send-email: implement SMTP bearer authentication","startedAt":"2025-01-07T19:50:23Z","lastAt":"2025-01-11T21:19:40Z","messageCount":3,"participants":["M Hickford","Julian Swagemakers"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"510112","messageId":"20250107194953.2104-1-mirth.hickford@gmail.com","threadId":"62763","inReplyTo":null,"subject":"Re: [PATCH] send-email: implement SMTP bearer authentication","fromName":"M Hickford","fromEmail":"mirth.hickford@gmail.com","sentAt":"2025-01-07T19:49:50Z","receivedAt":"2025-01-07T19:50:23Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"Hi Julian. The patch looks good. Please could you add instructions how to test it? Which servers have you tested?\n\nI have a gmail.com account. I configured Git following https://git-scm.com/docs/git-send-email#_use_gmail_as_the_smtp_server\n\n\t[sendemail]\n\t\tsmtpEncryption = tls\n\t\tsmtpServer = smtp.gmail.com\n\t\tsmtpUser = yourname@gmail.com\n\t\tsmtpServerPort = 587\n\nAnd configured git-credential-oauth following https://github.com/hickford/git-credential-oauth/issues/48#issuecomment-1966486513\n\n\t[credential \"smtp://smtp.gmail.com:587\"]\n\t\toauthClientId = 406964657835-aq8lmia8j95dhl1a2bvharmfk3t1hgqj.apps.googleusercontent.com\n\t\toauthClientSecret = kSmqreRr0qwBWJgbf5Y-PjSU\n\t\toauthScopes = https://mail.google.com/\n\t\toauthAuthURL = https://accounts.google.com/o/oauth2/auth\n\t\toauthTokenURL = https://oauth2.googleapis.com/token\n\nThen tested with: git send-email --smtp-auth=XOAUTH2 --smtp-debug=1 message.txt\n\n\"git credential\" was queried for an OAuth access token as expected. Note that Gmail access tokens are very long (~220 characters).\n\nHowever smtp.gmail.com responded authentication error \"535-5.7.8 Username and Password not accepted\".\n\nLooking at the debug information, it looks like the SMTP command \"AUTH XOAUTH2 <base64>\" was corrupted by a space at column 241. Exactly one base64 string should follow \"AUTH XOAUTH2 \", no spaces.\n\nThe same problem occurs with OAUTHBEARER: git send-email --smtp-auth=OAUTHBEARER --smtp-debug=1 message.txt\n\nI can reproduce this with any sufficiently long combination of user and pass, such as: git send-email --smtp-auth=XOAUTH2 --smtp-user=tim.arsietonarsei@example.com --smtp-pass=arsteiarositanrestnerastarstarstarstarstarsetnrasetnearstrasitenarseitnerasntearnstenarsetnearstarstearsetnariestnearsntenarestnerast --smtp-encryption=tls --smtp-server-port=587 --smtp-server=smtp.gmail.com --smtp-debug=1 message.txt\n\nCan you reproduce this problem?\n\nAny ideas?\n\nI think the bug must be in the call to Net::SMTP.\n"},{"id":"510372","messageId":"D6ZH9HE0N3X8.350NMMZ6IY8QA@swagemakers.org","threadId":"62763","inReplyTo":"20250107194953.2104-1-mirth.hickford@gmail.com","subject":"Re: [PATCH] send-email: implement SMTP bearer authentication","fromName":"Julian Swagemakers","fromEmail":"julian@swagemakers.org","sentAt":"2025-01-11T19:06:41Z","receivedAt":"2025-01-11T19:06:47Z","isPatch":true,"sender":{"key":"julian@swagemakers.org","avatar":"https://gravatar.com/avatar/61b8010bc77390da6713f1622e3276430152d11cd512c11c1c241716991a358b?d=mp&s=160"},"body":"Hi Mirth, thanks for taking a look and testing.\n\n> Please could you add instructions how to test it?\n\nSure, below you can find steps which can be used for testing.\n\n   # requirement git-credentials-oauth installed\n\n   # build patched git\n   git clone https://git.kernel.org/pub/scm/git/git.git tmp_git\n   cd tmp_git\n   curl https://lore.kernel.org/git/20240225103413.9845-1-julian@swagemakers.org/raw |git am\n   make\n\n   # backup gitconfig\n   mv ~/.gitconfig{,_backup}\n\n   # create minimal gitconfig\n   cat << EOF >> ~/.gitconfig\n\n   [credential]\n      helper = cache --timeout 7200\n      helper = oauth\n   [credential \"smtp://smtp.gmail.com:587\"]\n      oauthClientId = 406964657835-aq8lmia8j95dhl1a2bvharmfk3t1hgqj.apps.googleusercontent.com\n      oauthClientSecret = kSmqreRr0qwBWJgbf5Y-PjSU\n      oauthScopes = https://mail.google.com/\n      oauthAuthURL = https://accounts.google.com/o/oauth2/auth\n      oauthTokenURL = https://oauth2.googleapis.com/token\n   [user]\n      email = you@example.com\n      name = Your Name\n\n   EOF\n\n   # create email to send\n   cat << EOF >> message.txt\n   Subject: test email from git\n\n   Hay from git\n\n   EOF\n\n   # update PATH to use patched git\n   export PATH=\"${PWD}:${PATH}\"\n\n   # confirm you are using the correct git version, should look\n   # something like `git version 2.48.0.rc2.32.g5adec67521`\n   git --version\n\n   git send-email \\\n    --to=email@example.com \\\n    --smtp-auth=XOAUTH2 \\\n    --smtp-encryption=tls \\\n    --smtp-server-port=587 \\\n    --smtp-server=smtp.gmail.com \\\n    --smtp-debug=1 \\\n    --smtp-user=you@example.com \\\n    message.txt\n\n    # now the browser should open with the oauth flow.\n\n> Which servers have you tested?\n\nI've tested this with gmail using a consumer google account as well as a\nmanaged google account and with the office settings I've tested\noffice365.\n\n> Looking at the debug information, it looks like the SMTP command \"AUTH\n> XOAUTH2 <base64>\" was corrupted by a space at column 241. Exactly one\n> base64 string should follow \"AUTH XOAUTH2 \", no spaces.\n\nI can also see a space in the debug output, but the position depends on\nmy terminal size, and it is not interfering with authentication in my\ncase. I think it is caused by output formatting of the debug statement\nand not the source of the issue you are having.\n\nIf you have a coded auth string you can use openssl client directly\nto test it.\n\n   openssl s_client -starttls smtp -connect smtp.gmail.com:587\n\n   AUTH XOAUTH2 auth_sting\n\nIf you have the xoauth2 access token you can create the auth string with\n\n   echo -n -e \"user=${EMAIL}\\x01auth=Bearer ${TOKEN}\\x01\\x01\" | base64 -w0\n\nIf that does not help, can you give me some more details on your setup?\nThen I'll try to reproduce the problem.\n\nI've tested the steps above on Arch Linux with Perl v5.40.0, and\nUbuntu with Perl v5.38.2.\n\nRegards Julian\n\n"},{"id":"510374","messageId":"CAKcCxfCepXUzcyT_i_eZ1wREU0J_T+LgrjcEzb++gY5J05phmg@mail.gmail.com","threadId":"62763","inReplyTo":"D6ZH9HE0N3X8.350NMMZ6IY8QA@swagemakers.org","subject":"Re: [PATCH] send-email: implement SMTP bearer authentication","fromName":"M Hickford","fromEmail":"mirth.hickford@gmail.com","sentAt":"2025-01-11T21:19:28Z","receivedAt":"2025-01-11T21:19:40Z","isPatch":true,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"On Sat, Jan 11, 2025 at 7:06 PM Julian Swagemakers\n<julian@swagemakers.org> wrote:\n>\n> Hi Mirth, thanks for taking a look and testing.\n>\n> > Please could you add instructions how to test it?\n>\n> Sure, below you can find steps which can be used for testing.\n>\n>    # requirement git-credentials-oauth installed\n>\n>    # build patched git\n>    git clone https://git.kernel.org/pub/scm/git/git.git tmp_git\n>    cd tmp_git\n>    curl https://lore.kernel.org/git/20240225103413.9845-1-julian@swagemakers.org/raw |git am\n>    make\n>\n>    # backup gitconfig\n>    mv ~/.gitconfig{,_backup}\n>\n>    # create minimal gitconfig\n>    cat << EOF >> ~/.gitconfig\n>\n>    [credential]\n>       helper = cache --timeout 7200\n>       helper = oauth\n>    [credential \"smtp://smtp.gmail.com:587\"]\n>       oauthClientId = 406964657835-aq8lmia8j95dhl1a2bvharmfk3t1hgqj.apps.googleusercontent.com\n>       oauthClientSecret = kSmqreRr0qwBWJgbf5Y-PjSU\n>       oauthScopes = https://mail.google.com/\n>       oauthAuthURL = https://accounts.google.com/o/oauth2/auth\n>       oauthTokenURL = https://oauth2.googleapis.com/token\n>    [user]\n>       email = you@example.com\n>       name = Your Name\n>\n>    EOF\n>\n>    # create email to send\n>    cat << EOF >> message.txt\n>    Subject: test email from git\n>\n>    Hay from git\n>\n>    EOF\n>\n>    # update PATH to use patched git\n>    export PATH=\"${PWD}:${PATH}\"\n>\n>    # confirm you are using the correct git version, should look\n>    # something like `git version 2.48.0.rc2.32.g5adec67521`\n>    git --version\n>\n>    git send-email \\\n>     --to=email@example.com \\\n>     --smtp-auth=XOAUTH2 \\\n>     --smtp-encryption=tls \\\n>     --smtp-server-port=587 \\\n>     --smtp-server=smtp.gmail.com \\\n>     --smtp-debug=1 \\\n>     --smtp-user=you@example.com \\\n>     message.txt\n>\n>     # now the browser should open with the oauth flow.\n>\n> > Which servers have you tested?\n>\n> I've tested this with gmail using a consumer google account as well as a\n> managed google account and with the office settings I've tested\n> office365.\n>\n> > Looking at the debug information, it looks like the SMTP command \"AUTH\n> > XOAUTH2 <base64>\" was corrupted by a space at column 241. Exactly one\n> > base64 string should follow \"AUTH XOAUTH2 \", no spaces.\n>\n> I can also see a space in the debug output, but the position depends on\n> my terminal size, and it is not interfering with authentication in my\n> case. I think it is caused by output formatting of the debug statement\n> and not the source of the issue you are having.\n>\n> If you have a coded auth string you can use openssl client directly\n> to test it.\n>\n>    openssl s_client -starttls smtp -connect smtp.gmail.com:587\n>\n>    AUTH XOAUTH2 auth_sting\n>\n> If you have the xoauth2 access token you can create the auth string with\n>\n>    echo -n -e \"user=${EMAIL}\\x01auth=Bearer ${TOKEN}\\x01\\x01\" | base64 -w0\n>\n> If that does not help, can you give me some more details on your setup?\n> Then I'll try to reproduce the problem.\n\nOops I had my email accounts mixed up.\n\nI confirm both XOAUTH2 and OAUTHBEARER work to send email with gmail.com\n\nTested-by: mirth.hickford@gmail.com\n\n>\n> I've tested the steps above on Arch Linux with Perl v5.40.0, and\n> Ubuntu with Perl v5.38.2.\n>\n> Regards Julian\n>\n"}]}