After upgrading the libcurl4t64 package from 8.16.0-1 to 8.17.0~rc3-1,
sasl-xoauth2 stopped working.

The output of `sasl-xoauth2-tool test-token-refresh` is the following, and
is consistent with the Postfix log:

Config check passed.
auth failed:
  2025-10-31 12:37:23: TokenStore::Read:
file=/var/lib/postfix/sasl-xoauth2/<snip>
  2025-10-31 12:37:23: TokenStore::Read: refresh=1//03k<snip>206, user=
  2025-10-31 12:37:23: TokenStore::Refresh: attempt 1
  2025-10-31 12:37:23: TokenStore::Refresh: token_endpoint:
https://accounts.google.com/o/oauth2/token
  2025-10-31 12:37:23: TokenStore::Refresh: request: client_id=69<snip>
0a9.apps.googleusercontent.com
&client_secret=GOCS<snip>Ykw&grant_type=refresh_token&refresh_token=1//03k<snip>hxM
  2025-10-31 12:37:23: TokenStore::Refresh: code=0, response={
  "access_token": "ya2<snip>206",
  "expires_in": 3599,
  "scope": "https://mail.google.com/",
  "token_type": "Bearer"
}
  2025-10-31 12:37:23: TokenStore::Refresh: request failed
Token refresh failed.

Note the `code=0` which should be `code=200`. This is despite the request
clearly being successful, since we get a proper response back.

This is being investigated upstream and I already sent in a patch:
https://github.com/tarickb/sasl-xoauth2/issues/115

Hello Etienne and Daniel,

Etienne Dechamps [2025-10-31 14:32 +0000]:

Thanks! I am currently moving my mbsync config from an app password to oauth2,
and this is a really nice tool.

As this package looks unmaintained, I took the liberty to do a DELAYED/7 upload
that updates to the latest upstream version 0.27 and cherry-picks the patch for
this:

https://github.com/tarickb/sasl-xoauth2/commit/dc77ca4fb9a4e283d738dcbd6710e693454d9fcf

debian/* only debdiff attached.

@ Daniel: If you agree, I'm also happy to re-upload immediately.

Thanks!

Martin

Hello again,

Martin Pitt [2026-08-16 17:15 +0200]:

Pitti

We believe that the bug you reported is fixed in the latest version of
sasl-xoauth2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1119802@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Pitt <mpitt@debian.org> (supplier of updated sasl-xoauth2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 16 Aug 2026 15:57:26 +0200
Source: sasl-xoauth2
Architecture: source
Version: 0.27-0.1
Distribution: experimental
Urgency: medium
Maintainer: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Changed-By: Martin Pitt <mpitt@debian.org>
Closes: 1119802
Changes:
 sasl-xoauth2 (0.27-0.1) experimental; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
   * Add new python3-msal build dependency for the new version.
   * Add 0001-fix-curl_easy_getinfo.patch: Fix refresh token with libcurl 8.17.
     Patch backported from upstream master. (Closes: #1119802)
Checksums-Sha1:
 7a1cb8abcabecf7d632eca5841b7aafea0c6be61 2017 sasl-xoauth2_0.27-0.1.dsc
 3f19eec405abad649142f1e915370e6f22b2574a 26816 sasl-xoauth2_0.27.orig.tar.xz
 4f61dd279993b786b7b1171f02c46d7753969387 4028 sasl-xoauth2_0.27-0.1.debian.tar.xz
 068402f359b037b78b39bd735c78123c32c72afc 8847 sasl-xoauth2_0.27-0.1_source.buildinfo
Checksums-Sha256:
 4e5275dfa73edfd4214f41699db7519accb4a89949c97738d556fc138e75951e 2017 sasl-xoauth2_0.27-0.1.dsc
 389653e0e685faeaafadbb7403d2d9bbf50378613cc4a5083bc5a9b15a5bc8cc 26816 sasl-xoauth2_0.27.orig.tar.xz
 17557e40d42e125e397ce4e6cb334ea3b2641a9707dc0af03f7a1a897a6ce9a9 4028 sasl-xoauth2_0.27-0.1.debian.tar.xz
 e6c417c85895e074794755d1de0669385abb21e7b1b4757b7d83de6a705c4e99 8847 sasl-xoauth2_0.27-0.1_source.buildinfo
Files:
 90bd12aba50d2263b5797a52cf16ba78 2017 utils optional sasl-xoauth2_0.27-0.1.dsc
 1d6b4f0e1212ad47e113ac398fcfcf7f 26816 utils optional sasl-xoauth2_0.27.orig.tar.xz
 17c52667d26874e542254ccb71d461de 4028 utils optional sasl-xoauth2_0.27-0.1.debian.tar.xz
 067ef9112e0470f274143259ba7c4f93 8847 utils optional sasl-xoauth2_0.27-0.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEbEuHi35jHxYFV8PN7nvd5LhrVxMFAmqBw0sACgkQ7nvd5Lhr
VxOdVBAAz0SkcDdRjTuC1CzZwstihZ0VdoBjckP1r4/J/tE8V5g7Fw3nhIj+e7Op
H4kOb/rbWbxbmZ7Jlt/KOLKZi2aWuhVG8rSnG1A1ONdVjGdeZf/fo8WW+fX0awL6
e1n4NOTDy17JQMUNGUoaRpDHt3k/xO4xNqggrcQoDmW8BB9q53F5JI04khSTxJIc
tl+eRVLi5RRotQv4x75UyHMu237ZEq1RZ+ytCnQYOumVHEawT1wxp84f1djxOqbr
UQwCn8L4RBJO+guitqmD35TT1PRMwPMd4Pu33iYsWv8viEyGe1Bde5i+qZLFOBX5
MnpwTMpphN8yZY4TalRGDJXFwSiJGLmFH4smhmQ5ijUZAMXUKGU24YndPjFL+ldv
uA+bkSh8EEFu2meUHz7OdzvteNN0vK6dahHHcyqcrej8KXcZTYqaZh3jD0Uvwfgs
AchDIVZJn5Q6Nn3jK2OzUSG4libtt3WPPiUZeNWigP8C/8Y9K/JDrasyed0GY57h
z1KX3RWTVaxaBPpObGUhGkgmZFJLJwHI6q1GNpvqNg84Gj7q7wQkZgiGW1MAnhyp
D3y2ZdHNRvaeZVpBfNr5rAdJezQD14pMj5dPyzvypMfvZdabJG1aN1xTmSTb+kSq
ZmVH6RCh4uMBXrZoFJK3XcaoT2eJ5pK2vYQPvltG/0KSApVZAT4=
=bjhf
-----END PGP SIGNATURE-----