History / Compliance and eDiscovery

Every page's header says whether 6.3.7 is reflected in it, and none calls 6.3.6 the latest release, where thirty-seven headers still said "6.3.6, the latest release (6 October 2026...". The guide and reference pages brought up on 5 October 2026 to 6.3.6 say so with its date and schema, and that 6.3.7, the latest release (17 October 2026, schema 6108), is not yet reflected on them: Aliases, Lists and Public Folders, the APIs Reference, Compliance and eDiscovery, Connecting a Mail Client, Control Panel Pages, the Control Panel Reference, DNS for Your Domain, Encryption and Certificates, Encryption for People, How Email Works, Mail In to a Webhook, Mailing Lists, Message Storage, Migration, Monitoring and Health, Outbound Shaping, the Ports Reference, Profiles and Environment, Rooms and Equipment, Routes and Relays, Rules and Sieve, the Runbooks Digest, Security Hardening, Settings Overview, Sign-in and Identity, Stopping Spam, Stopping Viruses, The Control Deck, The Control Panel, The REST API, The Webmail, Troubleshooting, What hMailServer Is and Is Not and Your First Domain and Mailbox. Backup and Restore says that 6.3.7 is reflected only in the release a failed full restore is made again on, Capabilities and Configuration only in the releases the release jobs have made, and the Settings Reference that its keys were last re-checked at v6.3.6, where its re-check of 5 October 2026 called v6.3.6 the latest release. The COM API and Scripting and the Glossary, whose headers said nothing of a release after 6.3.4, say that 6.3.7 is not yet reflected, the Glossary that its stamp names it; Version History to 6.2.10 that its history ends at 6.2.10 and what came after, up to 6.3.7, is in Changes Since 6.2.10; and the Project Handbook that its status note, and what sections 7, 8, 9 and 11 say of how a change lands, who can approve it, which runners run what and which releases the release jobs have made, are brought up to the tree at 6.3.7, the rest not yet, and that 6.3.7, published on 17 October 2026, was the first of the security releases that go on until 30 September 2027. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 18, 2026

The guide pages say what 6.3.6 changes in anti-spam, DANE and outbound TLS, backups and restores, calendars, sign-ins, the webmail, Sieve, the store commands and the auto-ban, and every page's header says whether 6.3.6 is reflected in it. Stopping Spam: the SURBL test as 6.3.6 runs it (every registrable domain up to 200, 256 names a list, sixteen lookups at a time, SurblTooManyDomainsScore, a list's error answers never a listing), the Sender MX test by the Public Suffix List, the two FQDN checks, the greylisting key of schema 6107, the sender lists' URL entries. Encryption and Certificates: What DANE actually does for 6.3.6 - DANE-TA, the indeterminate lookups, the validated MX RRset, a resolver that strips DNSSEC, the deferrals where mail bounced, and the log lines as the tag writes them. DNS for Your Domain: the indeterminate rule and the resolver requirement. Routes and Relays: the relayer's STARTTLS required refuses permanently, as it always did; a webhook route held to public addresses through HttpProxy. Mail In to a Webhook: the same. Backup and Restore: the Updates folder and a destination inside the data directory left out, the restore that copies in first and undoes a copy that fails, the full restore that failed on installations made new with 6.3.4 or 6.3.5, this installation's own self-signed pair kept, a message deleted while a backup copies. Rooms and Equipment: the organiser verified by the From address, and the send API believed for nobody. Encryption for People and The Webmail: the S/MIME certificates kept, the HTML view's images, OpenPGP's 32 MB, the attachments' types, the invitation card, days to keep. Connecting a Mail Client: a stored event changed only by a verified sender, the AUTH on port 25 that bans, FETCH's NO [LIMIT]. Sign-in and Identity: the pending sign-ins carried by the browser, sealed. Rules and Sieve: ManageSieve's deadlines and a session that ends. Message Storage: the store commands' link rule. Mailing Lists: every field of a posting removed. Security Hardening: the grant through a junction, who else on the computer may read the mail (/ProtectFolders), AutoBanMinutes for an AUTH on port 25, the checklist's row 12a. Migration: days to keep messages, as the repository's document gives it. Aliases, Lists and Public Folders, Compliance and eDiscovery, Control Panel Pages, Monitoring and Health, Outbound Shaping, Profiles and Environment, Stopping Viruses, What hMailServer Is and Is Not, Your First Domain and Mailbox and How Email Works: the header says that 6.3.5 and 6.3.6 are not yet reflected on the page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

Every link to the project points at its address in the group, gitlab.com/hmailserver/hmailserver, where it has been since 29 September 2026; the identities 6.3.5 was signed with, and the setting row that lists both paths, keep the path the project began at. The project's path in all 63 pages that linked it (548 links), 6.3.6 being the first release made at the group's path. Left as they were: the seven signing identities https://gitlab.com/Progressiverobot/hmailserver//.gitlab-ci.yml@refs/tags/v... (Release Process, Security Policy, The Update Feed, and the UpdateSigningIdentity row of Settings Reference), which name what 6.3.5 was signed as; and the UpdateSourceRepository row of Settings Reference, which lists both paths on purpose. The container registry's name is corrected with the container page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

The wiki is brought up to the published release: 6.3.4 is the signed tag v6.3.4 at 51e2dbda0, published on GitLab on 27 September 2026 (02:37:56 UTC), not 8adce850a of 26 September, where the tag was first made and whose release gate failed. Every page that named 8adce850a as the tag or the release names 51e2dbda0, and every page that dated the release 26 September dates it 27 September: the footer, the sidebar, the page headers, the landing page's Current release, the release timeline's row and picture, section 4e's heading. Each fact those pages took from 8adce850a was checked at 51e2dbda0: the commits between the two change 42 files, whose only documents are CHANGELOG.md, BrandLogos.md, OpenPGP.md and SecretsAtRest.md, none of which a page copies, and which include none of Constants.h, Version.h, formMain.cs, the create scripts, IniFileSettings.cpp, SettingsDefaults.h, the IDL, the Control Panel or .gitlab/allowed_signers, so every file and line cited at the tag holds. Where a page said it read the tag on 26 September, it says it read 8adce850a and that what it read is the same at the tag. The suite has 3,811 [Test] attributes at the tag, not 3,809 (the fixes add two tests); twelve places say so. Changes Since 6.2.10 gains, in batch 40, what the release gate found and the eleven fixes: three change tests alone; of the other eight, three fix what 6.3.3 did too - a relay that refused the OAuth2 login got the server's token into the bounce and the logs (open since 6.2.22-pre1), a rule's forward, copy, reply or notice and an account's forwarding could wait a minute in the queue, and IMAP LIST and LSUB took a literal's length for the pattern - and five fix code new in 6.3.4 (sealed mail and an unnamed part, a closed key's FETCH refusal logged as a critical error, the help desk's password reset read as bytes, the logo and key-directory holds, an alert's encoded Subject over 76 characters). The gate table and the timeline give the re-run on 51e2dbda0 as the logs have it: 2,349 on the first bench (2,252 passed, 0 failed, 97 skipped) and 1,462 on the second (1,446 passed, 0 failed, 16 skipped), the 71 live-update tests elevated, all passed, and the Linux suite on the packaged binary, 2,013 tests, 1,562 passed, 0 failed, 451 skipped (results/b40full3 on linix); the database upgrade gates, the security scans, the fuzzers and the installer smoke test, 65 of 65. The JScript flaw is CVE-2026-100741 (CVSS 3.1 9.8), and the project's issue #43 is public: Security Hardening 17.11, the scripting page, the changes, the capabilities and the API reference name them. The project's download links work (the site has served HTTPS since 26 September; on 27 September they led to 6.3.4's files), so Installing on Linux and Running in a Container no longer say they work once it does. The copies of SECURITY.md and CONTRIBUTING.md give the day GitLab published the release, and the security policy's copy counts the 455 findings .gitlab/security-exceptions.yml accepts at the tag - the 169 of the SAST triage and the 286 that held the release scan - where the repository document still says 169; each header says where the copy differs. Three places said no pipeline had run on the fixed tree; one has, the schedule of 27 September 2026 on master 6bc09509d, which ran the update feed's pages and package-repos jobs alone, and they say so.

Christopher Holloway committed Sep 27, 2026

The wiki is brought up to the release itself, the signed tag v6.3.4 at 8adce850a: what it said of 6.3.4 had been read from master 92b8f9f63, which the tag's last batch, batch40, follows. Schema 6104, not 6103: 6.3.4 is sixty-four steps from 6.3.3's 6040, the last, 6103 to 6104, adding hm_fetchaccounts.faorigin (Constants.h:1224, formMain.cs:314 and the three create scripts at the tag); every header, table, count and diagram that gave 6103 as 6.3.4's schema says 6104, the upgrade table's step counts are each one more, the step tables gain the 6104 row, and where 6103 means the secrets-at-rest step it stays. No page calls 92b8f9f63 the release or the tree 6.3.4 was cut from any more: a page checked against it says so and that the tag adds a last batch, and a page that copies a repository document the tag leaves as it was says the document is the same at the tag. The copies of repository documents batch40 changes are brought up to the tag, hunk by hunk from the version each copy had reached, their own additions kept: Security Policy (the SSH-signed sums of a release made by hand and the two commands that check a download, an SBOM for every compiled file, a release held by its security scans, secrets refused before they are pushed; its note no longer says the document calls 6.3.3 the latest), Release Process (A release made by hand, the security gate, the SBOM jobs), Upgrading Guide (the installer's HM_ADMIN_PASSWORD, the named lock on MySQL and MariaDB, the probe that stops an upgrade on too old a server at 6041 and the repair of a half-done one), Contributing, Governance (rebuilt on the tag's document, which gives the GitLab roles the owner set on 26 September 2026; the map and the note on code-signing material kept), Assurance Case, Regulatory Scope, Third-Party Binaries, Fuzzing, Migrating the Database Backend and Regression Test Environment. The installer's password handling as the tag has it: the password page is skipped for HM_ADMIN_PASSWORD as for /adminpassword, the database step hands the password (or the live update's token, as token:<hex>) to DBSetupQuick and DBSetup in HM_ADMIN_PASSWORD and DBSetupQuick to DBUpdater the same way, never on a command line, the switch table has the variable, and the unattended upgrade takes either (Installing hMailServer, Upgrading hMailServer 18.4a). How to verify a download: 6.3.4's hmailserver-6.3.4-SHA256SUMS.txt and its .sig, checked with ssh-keygen -Y verify against .gitlab/allowed_signers and sha256sum -c, as SECURITY.md at the tag gives them, and each installer's and package's own SBOM (Installing hMailServer 4.1, Installing on Linux, Upgrading hMailServer 18.4 and 18.4c, home, Release Process, Project Handbook, Troubleshooting, Glossary, Assurance Case, Regulatory Scope). The /download/ links no longer wait on issue #30: the feed's site has had its certificate since 26 September 2026. Changes Since 6.2.10 gains batch 40 in section 4e (the audit before the release, GitLab's SAST and the release gate, the installer's password, the SBOMs and signed sums, the stable download links, the release chain and landing through merge requests, what the first pipeline found, Windows on ARM compiled), items 47 to 51 in section 5 (reserved domain names, a one-time code taken once, the outbound relay's OAuth2 token over TLS only, the fetchers and schema 6104, a pre-6.3.4 hash of a password above U+00FF refused), SQLOLEDB in item 38, the 6041 probe in item 36, and the installer's own PBKDF2 in item 39. Also what the tag makes false elsewhere: the suite has 3,809 [Test] attributes, not 3,698; hmailserver/docs holds 105 documents; Windows on ARM compiles and has never run, where it was "not built"; IMAP offers STARTTLS only before sign-in and TLS and COMPRESS=DEFLATE only after sign-in (Capabilities and Configuration); a parent-domain passkey relying party needs passkey_allowed_origins (Sign-in and Identity); the Settings Reference counts 193 hm_settings rows with PasskeyAllowedOrigins and WebPushLoopbackHttpForTests; and the Linux suite's CI job first ran in the pipeline of 26 September 2026 rather than never.

Christopher Holloway committed Sep 26, 2026

The feature pages now describe 6.3.4, the latest release (26 September 2026, schema 6103), built from the tree at 92b8f9f63. What they labelled as in the tree after 6.3.3 and not yet released is in 6.3.4 and says "since 6.3.4"; dates inside the release become the version; the sidebar names 6.3.4 as the latest release. What landed after 540347500 is added where a reader meets it. Connecting a Mail Client gains what 6.3.4 changed in IMAP's answers after Dovecot's imaptest (NO where BAD was wrong, \Seen on every BODY[section] without PEEK, APPEND stored byte for byte, a command pipelined behind APPEND answered, SORT and THREAD as the RFCs say, \Recent counted), what a new installation asks of a password (STARTTLS offered, TLS required for authentication from the Internet range, a self-signed certificate), rooms in CalDAV's room finder, and that a mailbox encrypted at rest takes its own password only. The Webmail gains a folder of a hundred thousand messages - one page copied, Oldest, a bounded search that goes on, select-all handed to the server - labelled built and not yet measured. Migration gains PST import: the import directory that is empty as shipped, what comes in and what is refused, and the reader in a child process, which is crash containment and not a sandbox. The Control Panel pages gain the Discovery page (65 pages), the Message store tab, the Windows service account card and what the virtual account refuses; the Control Deck page gains the Discovery and Inbound webhooks views (40), the twelve checklist items, the census of 466, 458 and 586 routes, and the update feed as it stands: 6.3.4 carries no Sigstore bundle and is installed by hand. The remaining pages gain the webhook route that outranks aliases and lists, a legal hold beside rules and Sieve, the Run function name rule, the three new permissions and the administrator password rehashed at sign-in. Four new pages give features with no wiki home one: Compliance and eDiscovery (cases, searches, holds, exports, and the erasure a hold outranks), Message Storage (compression and attachments held once, mailbox encryption at rest, object storage on S3 and Azure Blob, each off by default), Rooms and Equipment, and Mail In to a Webhook. Each is in the sidebar in its natural place, and every sidebar entry resolves to a page.

Christopher Holloway committed Sep 26, 2026