msmtp (1.8.22-1) unstable; urgency=medium

    Starting from version 1.8.22, msmtp will no longer be SetGID. Hence the
    creation of the system-wide configuration (/etc/msmtprc) using debconf is
    removed.

    From one side, using the system-wide configuration implied msmtp to be SetGID
    but recent security hardening changes in GLib prevent SetGID binaries built
    against libsecret to talk to the D-Bus session, and therefore prevent it from
    being able to retrieve passwords from gnome-keyring or KWallet.

    On another side, it was easy for a local user to obtain the credentials
    stored in /etc/msmtprc even if the file was not readable for this user
    when msmtp was SetGID.

    More information in the following bug reports:
        - https://bugs.debian.org/944188
        - https://bugs.debian.org/995012

    Scripts (msmtpq and msmtpqueue) are now installed in /usr/libexec/msmtp
    instead of /usr/share/doc/msmtp/examples previously.

 -- Emmanuel Bouthenot <kolter@debian.org>  Tue, 25 Oct 2022 21:49:01 +0000
