CRM-20561 Use Composer to install Auth_SASL

[seamuslee001]

ping @totten

---

• CRM-20561: Load Net_SMTP, Auth_SASL, Net_Socket via Composer

[seamuslee001]

@totten Tim this is a diff between the composer version and packages version https://gist.github.com/seamuslee001/e24e709a854339924647f9a6fe227103

[totten]

Discussed a bit on Mattermost. Some general comments:

• This newer version seems to have some code-style cleanup/improvement. Huzzah.
• It looks to support more authn modes (and more forgivingly). That's probably good.
• In theory, the client-server negotiations (with smtpd's and imapd's) could sort out a bit differently when adding new protocols. The only problem scenario I can imagine would be if the new protocol implementations (eg SCRAM*) have incompatibilities. But we're really not in a position to test for smtpd's/imapd incompatibilities -- that's why we rely on a library.

+1 for using updated Auth_SASL

[totten]

Applied both patches locally:

$ git scan am https://github.com/civicrm/civicrm-packages/pull/185 https://github.com/civicrm/civicrm-core/pull/10385
$ composer install

Tried a couple things:

• In cv cli, executed $digest = Auth_SASL::factory('digestmd5');. This seemed to work.
• In Civi GUI, configured an authenticated SMTP service (fastmail.com) and successfully sent a test message.

These sniff-tests are OK but not awesome -- the main limitation is that my testing didn't actually use CRAM-MD5, DIGEST-MD5, or SCRAM*. (The fastmail.com smtpd authenticates using LOGIN/PLAIN-over-SSL.) I'd prefer someone with a relevant smtpd try it out, but I guess it would be OK if we (a) merge #10385 and civicrm/civicrm-packages#185 and (b) also strongly emphasize the need for testing in the 4.7.21 RC.

[Neustradamus]

Dear @civicrm team,

Can you update Auth_SASL, Net_SMTP, etc.?

[demeritcowboy]

@Neustradamus I'm expecting pear/db to do a release shortly which would be good for our php 8.2 drive. We could look at doing them all at once.

[Neustradamus]

@demeritcowboy: A lot of people like the improvements of @schengawegga and wait several new repository builds :)
Recently, he has done a comment here: pear/DB#20 (comment).
I hope before christmas for more security...

[schengawegga]

@demeritcowboy @Neustradamus PEAR/DB v1.12.0 released ;-)

[Neustradamus]

@schengawegga: Thanks!

PEAR/DB 1.12.1 too:

• https://github.com/pear/DB
• https://github.com/pear/DB/releases
• https://pear.php.net/package/DB/

[schengawegga]

@schengawegga: Thanks!

PEAR/DB 1.12.1 too:

* https://github.com/pear/DB

* https://github.com/pear/DB/releases

* https://pear.php.net/package/DB/

There was an urgent needed bugfix in the pear package. Thanks @remicollet