bug#81649: 30.2; auth-source-pass-enable should be user option aware

Sean Whitton <[email protected]> Fri, 21 Aug 2026 15:32:17 +0100

Newsgroups	gmane.emacs.bugs
Message-ID	<[email protected]>

David Bremner [18/Aug  7:19am -03] wrote:
> If
>
> 1) auth-sources is customized,
> 2) the user calls #'auth-source-pass-enabled
> 3) The user switches themes, e.g. with M-x customize-themes
>
> then as part of the theme switch (enable-theme 'user) is called,
> which overwrites auth-sources with the customize value. This is
> inconvenient because it means auth-source-pass stops working and various
> asynchronous things fail in mysterious ways.
>
> It seems to be an error for auth-source-pass-enabled to modify
> auth-sources without using something like setopt to coordinate with
> customize.

Thanks to others for pointing out the typo here, it's
'auth-source-pass-enable'.  I agree that for a customised value
'auth-source-pass-enable' is not the right approach at all.

Does the attached patch resolve the problem for you?

-- 
Sean Whitton

0001-Replace-auth-source-pass-enable.patch (text/x-diff, 10.7 KB)

From ab1123a08fd5c27c3bf9693f51149aef334a8e9f Mon Sep 17 00:00:00 2001
From: Sean Whitton <[email protected]>
Date: Fri, 21 Aug 2026 15:29:48 +0100
Subject: [PATCH] Replace auth-source-pass-enable (bug#81649)

* lisp/auth-source-pass.el (auth-source-pass-enable): Just call
setopt.  Mark obsolete.
* lisp/auth-source.el (auth-sources): Add a :set function to
call auth-source-forget-all-cached.
* test/lisp/auth-source-pass-tests.el
(auth-source-pass--with-store): Bind 'auth-sources'.
(auth-source-pass-can-start-from-auth-source-search)
(auth-source-pass-extra-query-keywords--wild-port-miss)
(auth-source-pass-extra-query-keywords--wild-port-hit)
(auth-source-pass-extra-query-keywords--req-noparam-miss)
(auth-source-pass-extra-query-keywords--req-param)
(auth-source-pass-extra-query-keywords--wild-port-req-miss)
(auth-source-pass-extra-query-keywords--akib)
(auth-source-pass-extra-query-keywords--host)
(auth-source-pass-extra-query-keywords--baseline)
(auth-source-pass-extra-query-keywords--port-type)
(auth-source-pass-extra-query-keywords--hosts-first)
(auth-source-pass-extra-query-keywords--ambiguous-user-host)
(auth-source-pass-extra-query-keywords--suffixed-user)
(auth-source-pass-extra-query-keywords--user-priorities): Don't
call auth-source-pass-enable.
* doc/misc/auth.texi (Help for users): Update docs.
---
 doc/misc/auth.texi                  |  2 +-
 lisp/auth-source-pass.el            |  8 ++++----
 lisp/auth-source.el                 |  7 ++++++-
 test/lisp/auth-source-pass-tests.el | 18 ++----------------
 4 files changed, 13 insertions(+), 22 deletions(-)

diff --git a/doc/misc/auth.texi b/doc/misc/auth.texi
index c0570209ad2..8a0d771b252 100644
--- a/doc/misc/auth.texi
+++ b/doc/misc/auth.texi
@@ -192,7 +192,7 @@ Help for users
 (setopt auth-sources '("secrets:Login"))
 ;;; use pass (@file{~/.password-store})
 ;;; (@pxref{The Unix password store})
-(auth-source-pass-enable)
+(setopt auth-sources '(password-store))
 ;;; JSON data in format [@{ "machine": "SERVER",
 ;;; "login": "USER", "password": "PASSWORD" @}...]
 (setopt auth-sources '("~/.authinfo.json.gpg"))
diff --git a/lisp/auth-source-pass.el b/lisp/auth-source-pass.el
index 15dfa2f358f..fde711f5b90 100644
--- a/lisp/auth-source-pass.el
+++ b/lisp/auth-source-pass.el
@@ -145,10 +145,10 @@ auth-source-pass--build-result-many
 ;;;###autoload
 (defun auth-source-pass-enable ()
   "Enable auth-source-password-store."
-  ;; To add password-store to the list of sources, evaluate the following:
-  (add-to-list 'auth-sources 'password-store)
-  ;; clear the cache (required after each change to #'auth-source-pass-search)
-  (auth-source-forget-all-cached))
+  (setopt auth-sources (cl-adjoin 'password-store auth-sources)))
+(make-obsolete 'auth-source-pass-enable
+               "customize `auth-sources' instead."
+               "32.1")
 
 (defvar auth-source-pass-backend
   (auth-source-backend
diff --git a/lisp/auth-source.el b/lisp/auth-source.el
index ec48ab31580..4d8c0bfaa36 100644
--- a/lisp/auth-source.el
+++ b/lisp/auth-source.el
@@ -306,7 +306,12 @@ auth-sources
                                                (string
                                                 :tag "Name"))))))
                   (sexp :tag "A data structure (external provider)"))))
-  :link '(custom-manual "(auth) Help for users"))
+  :link '(custom-manual "(auth) Help for users")
+  :set (lambda (sym val)
+         (set-default sym val)
+         ;; FIXME: Maybe this should be a hook.
+         (when (memq 'password-store val)
+           (auth-source-forget-all-cached))))
 
 (defcustom auth-source-gpg-encrypt-to t
   "List of recipient keys that `authinfo.gpg' encrypted to.
diff --git a/test/lisp/auth-source-pass-tests.el b/test/lisp/auth-source-pass-tests.el
index 2afd803240e..6f168693328 100644
--- a/test/lisp/auth-source-pass-tests.el
+++ b/test/lisp/auth-source-pass-tests.el
@@ -94,7 +94,8 @@ auth-source-pass--with-store
            (auth-source-pass--parse-log nil)
            ;; Any existing directory will do, since we shouldn't do I/O
            ;; except for the guard in `auth-source-pass-search'.
-           (auth-source-pass-filename default-directory))
+           (auth-source-pass-filename default-directory)
+           (auth-sources '(password-store)))
        ,@body)))
 
 (defun auth-source-pass--explain-match-entry-p (entry hostname &optional user port)
@@ -469,7 +470,6 @@ auth-source-pass-build-result-with-multiple-hosts-no-match
 
 (ert-deftest auth-source-pass-can-start-from-auth-source-search ()
   (auth-source-pass--with-store '(("gitlab.com" ("user" . "someone")))
-    (auth-source-pass-enable)
     ;; This also asserts an aspect of traditional search behavior
     ;; relative to `auth-source-pass-extra-query-keywords'.
     (let* ((auth-source-pass-extra-query-keywords nil)
@@ -516,7 +516,6 @@ auth-source-pass-extra-query-keywords--wild-port-miss-netrc
 (ert-deftest auth-source-pass-extra-query-keywords--wild-port-miss ()
   (auth-source-pass--with-store '(("x.com" (secret . "a"))
                                   ("x.com:42" (secret . "b")))
-    (auth-source-pass-enable)
     (let* ((auth-source-pass-extra-query-keywords t)
            (results (auth-source-search :host "x.com" :port 22 :max 2)))
       (dolist (result results)
@@ -542,7 +541,6 @@ auth-source-pass-extra-query-keywords--wild-port-hit-netrc
 (ert-deftest auth-source-pass-extra-query-keywords--wild-port-hit ()
   (auth-source-pass--with-store '(("x.com" (secret . "a"))
                                   ("x.com:42" (secret . "b")))
-    (auth-source-pass-enable)
     (let* ((auth-source-pass-extra-query-keywords t)
            (results (auth-source-search :host "x.com" :port 42 :max 2)))
       (dolist (result results)
@@ -564,7 +562,6 @@ auth-source-pass-extra-query-keywords--req-noparam-miss-netrc
 (ert-deftest auth-source-pass-extra-query-keywords--req-noparam-miss ()
   (let ((auth-source-pass-extra-query-keywords t))
     (auth-source-pass--with-store '(("foo" (secret . "a")))
-      (auth-source-pass-enable)
       (should-not (auth-source-search :host "foo" :require '(:user) :max 2)))))
 
 ;; The query requires a user but does not provide a reference value to
@@ -583,7 +580,6 @@ auth-source-pass-extra-query-keywords--req-param-netrc
 (ert-deftest auth-source-pass-extra-query-keywords--req-param ()
   (let ((auth-source-pass-extra-query-keywords t))
     (auth-source-pass--with-store '(("foo/bob" (secret . "a")))
-      (auth-source-pass-enable)
       (let ((results (auth-source-search :host "foo" :require '(:user))))
         (dolist (result results)
           (setf (plist-get result :secret) (auth-info-password result)))
@@ -607,7 +603,6 @@ auth-source-pass-extra-query-keywords--wild-port-req-miss
   (let ((auth-source-pass-extra-query-keywords t))
     (auth-source-pass--with-store '(("x.com" (secret . "a"))
                                     ("x.com:42" (secret . "b")))
-      (auth-source-pass-enable)
       (should-not (auth-source-search
                    :host "x.com" :port 22 :require '(:port) :max 2)))))
 
@@ -634,7 +629,6 @@ auth-source-pass-extra-query-keywords--akib
   (auth-source-pass--with-store '(("x.com" (secret . "a"))
                                   ("[email protected]" (secret . "b"))
                                   ("z.com" (secret . "c")))
-    (auth-source-pass-enable)
     (let* ((auth-source-pass-extra-query-keywords t)
            (results (auth-source-search :host "disroot.org" :max 2)))
       (dolist (result results)
@@ -661,7 +655,6 @@ auth-source-pass-extra-query-keywords--netrc-host
 (ert-deftest auth-source-pass-extra-query-keywords--host ()
   (auth-source-pass--with-store '(("libera.chat" (secret . "a"))
                                   ("Libera.Chat" (secret . "b")))
-    (auth-source-pass-enable)
     (let* ((auth-source-pass-extra-query-keywords t)
            (results (auth-source-search :host "Libera.Chat" :max 2)))
       (dolist (result results)
@@ -684,7 +677,6 @@ auth-source-pass-extra-query-keywords--netrc-baseline
 (ert-deftest auth-source-pass-extra-query-keywords--baseline ()
   (let ((auth-source-pass-extra-query-keywords t))
     (auth-source-pass--with-store '(("foo"))
-      (auth-source-pass-enable)
       (should (equal (auth-source-search :host "foo") '((:host "foo")))))))
 
 ;; Output port type (int or string) matches that of input parameter.
@@ -693,11 +685,9 @@ auth-source-pass-extra-query-keywords--port-type
   (let ((auth-source-pass-extra-query-keywords t)
         (f (lambda (r) (setf (plist-get r :secret) (auth-info-password r)) r)))
     (auth-source-pass--with-store '(("x.com:42" (secret . "a")))
-      (auth-source-pass-enable)
       (should (equal (mapcar f (auth-source-search :host "x.com" :port 42))
                      '((:host "x.com" :port 42 :secret "a")))))
     (auth-source-pass--with-store '(("x.com:42" (secret . "a")))
-      (auth-source-pass-enable)
       (should (equal (mapcar f (auth-source-search :host "x.com" :port "42"))
                      '((:host "x.com" :port "42" :secret "a")))))))
 
@@ -718,7 +708,6 @@ auth-source-pass-extra-query-keywords--hosts-first
                                   ("x.com" (secret . "c"))
                                   ("fake.com" (secret . "d"))
                                   ("x.com/foo" (secret . "e")))
-    (auth-source-pass-enable)
     (let* ((auth-source-pass-extra-query-keywords t)
            (results (auth-source-search :host '("x.com" "gnu.org") :max 3)))
       (dolist (result results)
@@ -736,7 +725,6 @@ auth-source-pass-extra-query-keywords--ambiguous-user-host
                                   ("foo.com" (secret . "b"))
                                   ("bar.org" (secret . "c"))
                                   ("fake.com" (secret . "d")))
-    (auth-source-pass-enable)
     (let* ((auth-source-pass-extra-query-keywords t)
            (results (auth-source-search :host "bar.org" :max 3)))
       (dolist (result results)
@@ -757,7 +745,6 @@ auth-source-pass-extra-query-keywords--suffixed-user
                                       ("s p@m@fa ke" (secret . "e"))))
                      (lambda (&rest _) (zerop (random 2))))))
     (auth-source-pass--with-store store
-      (auth-source-pass-enable)
       (let* ((auth-source-pass-extra-query-keywords t)
              (results (auth-source-search :host '("x.com" "fa ke" "y.org")
                                           :user "s p@m"
@@ -788,7 +775,6 @@ auth-source-pass-extra-query-keywords--user-priorities
                                       ("u@g:2" (secret . "@"))))
                      (lambda (&rest _) (zerop (random 2))))))
     (auth-source-pass--with-store store
-      (auth-source-pass-enable)
       (let* ((auth-source-pass-extra-query-keywords t)
              (results (auth-source-search :host '("h" "g")
                                           :port 2
-- 
2.43.7