Skip to content

hMailServer 6.2.24

Choose a tag to compare

View all tags
@chrisholloway5 chrisholloway5 released this 04 Sep 18:42
· 235 commits to master since this release
Immutable release. Only release title and notes can be modified.
v6.2.24
0d9a77a

hMailServer 6.2.24

The first stable release since 6.2.21. It is the code of 6.2.23 Alpha 2, cut the same day, plus NuGet lock files for the .NET tools and the CI changes that hold every restore to them. Nothing that ships changed between the two; the alpha's regression gate stands, and this release ran the full gate again on its own stamped binary. Schema 6025, unchanged since Alpha 1.

If you are on 6.2.21, everything the two pre-release lines introduced arrives at once. The section after next is written for you.

What is in it since 6.2.21

Two pre-release lines, 6.2.22 (pre1 to pre6) and 6.2.23 (Alpha 1 and 2), carried the work. Their notes are the detailed record - 6.2.22 pre-releases, Alpha 1, Alpha 2 - and this is the shape of it:

  • Mail that was silently lost is not any more. A delegated APPEND, COPY or MOVE filed bytes under the wrong account; a MOVE destroyed the only readable copy. Thunderbird's every Sent copy was refused once UTF8=ACCEPT was enabled (#53). A kept-open log was never flushed (#33). The ACME client had never worked against real Let's Encrypt (#34).
  • Anti-spam bypasses closed. A sender could steer a per-account spam override into un-marking their own mail by forging a header; a sender could choose which address the DNSBL, SPF and HELO tests ran against through the HELO literal in the Received header; RSET before EHLO or STARTTLS without a fresh EHLO opened a transaction with the HELO host empty, skipping the HELO-host test and the script events.
  • Features. Shared and delegated IMAP mailboxes, full-text search, RFC 3464 machine-readable bounces, BINARYMIME, per-account spam thresholds, a sender blacklist, domain-wide out-of-office, distribution-list moderation, Windows Event Log integration, OTLP metrics and logs, a reverse-proxy PROXY-protocol front for SMTP, an external HTTP filter hook, eleven IMAP extensions (APPENDLIMIT, LITERAL-, LIST-STATUS, UNAUTHENTICATE, QUOTA, PREVIEW, MULTIAPPEND, REPLACE, SAVEDATE, METADATA, BINARY), Microsoft 365 XOAUTH2 in both directions, app passwords, TOTP for the Control Panel, a quarantine, password history, message trace, per-domain outbound relay, a disk-space floor, and a substantial Control Panel overhaul.
  • Hardening. Control Flow Guard on the server; a reproducible build (two clean builds give the same bytes); signed release tags; SBOMs and Sigstore bundles on every release; a COM vtable layout repaired to be binary-compatible with 6.2.21; an unattended install that fails its database step now exits non-zero; an unattended upgrade can no longer hang on a password dialog.

Upgrading from 6.2.21

The database schema moves from 6011 to 6025 in fourteen steps, one way. DBUpdater runs them in order and resumes from wherever a partial upgrade stopped. There is no downgrade: an older server refuses a newer database rather than misreading it, so take a database backup and a data-directory backup before you install, with your backend's own tools. Rollback is only as good as that snapshot.

Two of the steps are worth planning for:

Step What it does
6024 → 6025 Rewrites hm_messages.messageflags from tinyint to smallint on MS SQL, SQL Server Compact and MySQL/MariaDB - a table-rewriting operation on the largest table you have, holding locks for its duration. Size the maintenance window by your message count. PostgreSQL is unaffected (already smallint).
6022 → 6023 Creates the full-text index tables. Empty and inert until you enable indexing; costs nothing on upgrade.

Behaviour that changes on upgrade, without a switch:

  1. A client that sends MAIL FROM or AUTH straight after the STARTTLS handshake, without saying EHLO again, now receives 503 Bad sequence of commands. RFC 3207 has required the second EHLO all along and every mainstream client sends it; a home-grown submission script that skips it will find out here.
  2. For mail arriving through an incoming relay or fetched from an external account, the anti-spam tests run against the address the relay actually observed, not the first bracketed value in the Received header (which was the client's HELO literal). If you tuned scores around the old behaviour, expect verdicts to move.
  3. Mail is refused with a temporary error when the data volume falls below 100 MB free (MinimumFreeDiskSpaceMB, Control Panel: Server settings). Set it to 0 to restore the old behaviour of writing until the disk is full.
  4. Critical and high-severity errors also go to the Windows Event Log (source hMailServer, throttled). A service account that cannot create the event source logs a single line saying so and continues.
  5. Existing per-account out-of-office replies now honour the RFC 3834 suppressions (no reply to bulk, list, auto-submitted or bounce mail) that previously applied only to the domain-wide one.
  6. A bulk prune of old hm_imapexpunged rows runs once at first start (IMAPExpungeRetentionRecords, default 5000; set 0 to defer).
  7. Early-bound COM clients compiled against a 6.2.22 pre-release interop assembly must be recompiled against this release's type library; the pre-release layout was the broken one. Late-bound scripts (VBScript, PowerShell, PHP) are unaffected, and so is anything compiled against 6.2.21.

Everything else keeps its previous default. The full list of the 23 new INI settings, all shipped off or inert, is in the Alpha 1 notes and in README.md.

What changed since Alpha 2

  • NuGet lock files beside all nine .NET tool projects, and every restore in CI held to them (--locked-mode, RestoreLockedMode), so a package bump without its lock-file update fails the build rather than building against a graph nobody reviewed. This was the last OpenSSF Scorecard finding that code could fix; the other four are dismissed on the security page with the reason on each, and eight required status checks were added to the master branch ruleset.
  • The version stamp. Nothing compiled into the server, the tools or the installer changed otherwise.

Known limitations

The Alpha 1 and Alpha 2 lists still apply. The three worth repeating for a stable release:

  1. Statement timeouts were built for PostgreSQL and MySQL and have been exercised only against SQL Server Compact, the bench backend.
  2. The weekly C++ CodeQL analysis is not running: it targets a self-hosted runner that is no longer registered. The C# analysis runs on every push and pull request.
  3. SCRAM-SHA-1 is not offered (#49, with the reason); clients without SCRAM-SHA-256 use PLAIN or LOGIN over TLS.

Downloads and verification

Asset What it is
hMailServer-6.2.24-x64.exe The installer (Inno Setup). Not Authenticode-signed.
*.spdx.json, *.cdx.json SBOMs, SPDX and CycloneDX, covering the .NET and native dependencies.
*.cosign.bundle A Sigstore bundle per asset, keyless, bound to this repository's workflow identity.

Verify the tag, from any clone:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers verify-tag v6.2.24

Verify an asset with cosign:

cosign verify-blob --bundle hMailServer-6.2.24-x64.exe.cosign.bundle \
  --certificate-identity-regexp '^https://github\.com/Progressiverobot/hmailserver/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  hMailServer-6.2.24-x64.exe

The server binary is reproducible: two clean Release builds of this tag produce a byte-identical hMailServer.exe, SHA-256 64406163b1a3a8a865e34d74883b5e2a05a5a1c476b500b26745cde67d8a989b, with the v145 toolset (MSVC 14.51), Windows SDK 10.0.26100 and the library layout in README.md. The regression suite on that binary: 1838/1838, nothing skipped, 31 minutes. Control Panel unit suite: 645/645.

Assets 9
Loading