Re: [PATCH b4 2/2] b4: add support for oauth2 SMTP authentication

[Tomas Melin <tomas.melin@vaisala.com>]

Hi,

On 29/01/2026 11:10, Tomas Melin wrote:

> 
> diff --git a/src/b4/__init__.py b/src/b4/__init__.py
> index 3d774f70c026..0adf5ca4e435 100644
> --- a/src/b4/__init__.py
> +++ b/src/b4/__init__.py
> @@ -30,6 +30,7 @@ import shutil
>  import mailbox
>  import pwd
>  import io
> +import base64
>  
>  import requests
>  
> @@ -2922,6 +2923,16 @@ def git_credential_fill(gitdir: Optional[str], protocol: str, host: str, usernam
>      return None
>  
>  
> +def git_credential_helper(name: str) -> str:
> +    if not name:
> +        raise ValueError("credential helper name cannot be empty")
> +    name = 'credential-' + name
> +    ecode, out = git_run_command(None, args=[name])
> +    if ecode == 0:
> +        return out.strip()
> +    return ''

For V2 I will expand this function to work for general case with custom
command syntax, as is the case with git credentials.
(https://git-scm.com/docs/gitcredentials)

Before preparing V2 I would also appreciate any other feedback.

Thanks,
Tomas



> +
> +
>  def git_get_command_lines(gitdir: Optional[str], args: List[str]) -> List[str]:
>      ecode, out = git_run_command(gitdir, args)
>      lines = list()
> @@ -4050,6 +4061,15 @@ def get_sendemail_config() -> Dict[str, Optional[Union[str, List[str]]]]:
>      return SENDEMAIL_CONFIG
>  
>  
> +def get_oauth2_token(server: str, smtpuser: str) -> str:
> +    creds = get_config_from_git(rf'credential.*{server}*')
> +    access_token = git_credential_helper(creds.get('helper', ''))
> +    if not access_token:
> +        raise smtplib.SMTPException(f'Unable to get access token from git credential helper for server {server}')
> +    auth_string = f'user={smtpuser}\x01auth=Bearer {access_token}\x01\x01'
> +    return base64.b64encode(auth_string.encode()).decode()
> +
> +
>  def get_smtp(dryrun: bool = False) -> Tuple[Union[smtplib.SMTP, smtplib.SMTP_SSL, List[str], None], str]:
>      sconfig = get_sendemail_config()
>      # Limited support for smtp settings to begin with, but should cover the vast majority of cases
> @@ -4118,6 +4138,11 @@ def get_smtp(dryrun: bool = False) -> Tuple[Union[smtplib.SMTP, smtplib.SMTP_SSL
>          if smtpauth.lower() == 'none':
>              return smtp, fromaddr
>  
> +        if (sconfig.get('smtpauth').lower() == 'xoauth2'):
> +            logger.debug('Authenticating to SMTP server using oauth2')
> +            auth_b64 = get_oauth2_token(server, sconfig.get('smtpuser'))
> +            smtp.docmd('AUTH', 'XOAUTH2 ' + auth_b64)
> +
>          auser = str(sconfig.get('smtpuser', ''))
>          apass = str(sconfig.get('smtppass', ''))
>          if auser and not apass:
>