History / Encryption and Certificates

Four of this wiki's own pages say what UpdateFeed.md, README.md, Acme.md, ContainerImage.md and the CHANGELOG say with batch55 on master, 36bd59faa, where they still said what batch55 corrects or what its chart and Compose file changed. Upgrading hMailServer's 18.4c says that a server from 6.2.28 to 6.3.3 pointed at the feed sees the newest release, and that its live update still installs nothing, the feed offering it only the newest release, which it cannot install, and the server downloading only the installer its check found, so that even the re-hosted releases up to 6.3.3, which verify against its signer, are installed by hand, where it said that such a server saw 6.3.4 and could install the re-hosted releases up to 6.3.3 by its live update; and that the releases after 6.3.4 are signed by the project's GitLab CI, which a 6.3.4 server's live update trusts, every release from 6.3.5 having been signed there, where it said that they were to be signed there and that none had been yet. Encryption and Certificates' 9.1 says that the ACME client loads a new certificate by a reinitialise of the server, the listeners restarting for a few seconds and the sessions in flight cut unless ShutdownDrainSeconds gives them a window, the service itself not restarting, where it said that it reloaded the certificate with no restart. Profiles and Environment's note on the container is headed as not run in a container at 6.3.4 and says, in the past, what had been run then, that the tag pipelines of 6.3.6 and 6.3.7 have run the verb in a container since, starting each pushed image through the entrypoint with the REST listener given through the environment, and that on 23 October 2026 docker compose up and helm install of the chart were run as a user runs them, against 6.3.7's published image, where it said in the present that the entrypoint, the chart and the Compose file had been read and not executed. Running in a Container's note on the chart gives helm install from the project's chart repository as the way to install with the values below from the release after 6.3.7, where it gave it with no release while the same note says that the charts the repository serves, 6.3.6's and 6.3.7's, start no server; and the paragraph on how the chart is checked says that CI lints and renders it and has never installed it, that since 26 October 2026 chart-and-compose also holds the rendered StatefulSet to the pod's user and group, 999:999, to the init container and to the new installation secured before the server, and the resolved Compose file to its command and to the REST listener's pair, and that the first installs into a cluster, by hand on 23 October 2026, found that the charts of 6.3.6 and 6.3.7 start no server, where it said that the chart was proven in CI. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 26, 2026

Seven of this wiki's own pages say what ContainerImage.md, the chart's README, SecureDefaults.md, Acme.md, Channels.md, PackageManagers.md and the CHANGELOG say with batch55 on master, 36bd59faa, of the Helm chart and the Compose file, of ACME, of the build services' installs and of the coverage job. Running in a Container's note on the chart says that the charts the Helm repository serves, 6.3.6's and 6.3.7's, start no server - their pod stops at CreateContainerConfigError, the image naming its user, and given the user by number at a configuration file the empty volume hides, nor do they secure a new installation - that the chart in the tree, on master since 26 October 2026, runs the pod as 999:999, fills the new volumes in an init container and secures the new installation before the server, that the release after 6.3.7 is the first to serve it and until then the chart of a checkout starts the published image, as both were installed on 23 October 2026, and how a release of the published charts is moved, helm upgrade --reset-then-reuse-values and then kubectl delete pod, where it gave the repository's chart as the way to install with the values below; the paragraph on the secure defaults says that the image alone does not apply them, that from the release after 6.3.7 the Compose file and the Helm chart run --apply-new-install-defaults --if-marked before the server and the charts of 6.3.6 and 6.3.7 do not, and that anything else is secured by hand, where it said that a container never applied them by itself; the Compose note says that the tree's file differs from the page's example in three ways, its command securing the new installation and its REST listener taking the pair that makes, and that a key of one's own in ./certs must be readable by the image's user, 999, where it said two ways and that the file mounted the REST certificate and key in; the note headed Not yet run in a container is headed as run as a user runs it on 23 October 2026 and says what was run, keeping what the repository said at 6.3.4; and How the image is built and proven says that from the next release's tag pipeline the start test also asks each image whether its update check knows it runs in a container. Home's Platform row and the passages of Capabilities and Configuration and of the Ports Reference on a new installation's defaults say the same of the chart and the Compose file, where Home named a Helm chart among the platforms without that and the other two said that the container ran the step by hand. Encryption and Certificates, under When it renews, says that from the release after 6.3.7 a certificate that does not name every host AcmeDomains lists is due at once and a save of AcmeDomains starts the check, where up to 6.3.7 a host added waited for the renewal, and names the ways to ask for a check and read its state - POST /api/v1/acme/run and GET /api/v1/acme, Utilities.RunAcmeCheck and Utilities.GetAcmeStatus, Check now on the Control Deck's Certificates page - with the spacing every check keeps and the names left out of the order. Installing on Linux's paragraph on the build services says to import OBS's repository key only once gpg shows its fingerprint, BA0868309CFBD36498CE41D22F0B9419E67EE770, and that on 23 October 2026 6.3.7 was installed from OBS, Copr and the PPA as a user installs it and the server started, where it gave zypper addrepo and zypper install alone. The Assurance Case's table of residual risks, this wiki's own, gives the linux-coverage job's first run on GitLab, 57.58% of the lines and 46.10% of the branches in pipeline 2983513656 on 24 October 2026, and the page's header says so. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 26, 2026

Nineteen of this wiki's own pages say of a [Settings] line edited in hMailServer.ini what RelocatingAnInstallation.md says with batch51 on master, 5e49abf06, and ServiceAccount.md has said since the tag v6.3.4: at the next start the stored value is used and HM5804 names the key, once, and the line is put back where the service may write the file, while under NT SERVICE\hMailServer, to which the file is read-only, as under the Linux packages' hmailserver user, the edit stays in the file (IniSettingStore::Synchronize), where they said without that condition that the line is put back, undone or restored: the APIs Reference, Backup and Restore, Capabilities and Configuration, Changes Since 6.2.10 (its 6.3.4 entry on the settings store and item 20 of its section 5), Control Panel Pages, Encryption and Certificates, the Glossary, Installing hMailServer's table of what writes each key, Monitoring and Health, Ports Reference, Routes and Relays, the Runbooks Digest, Security Hardening, Settings Overview, Settings Reference, The Control Panel, The REST API, Troubleshooting and Upgrading hMailServer. Where the same passages said that the server keeps the file's copy current, writes a deleted line back, brings an older line up to date or rewrites the line after a save, they now say so of a file the service may write, as step 9 of RelocatingAnInstallation.md now says of a save (IniSettingStore::WriteSetting) and ServiceAccount.md's table of the writes to hMailServer.INI says of every start, reinitialise and save: Settings Overview's flowchart has a step for a file the service may not write, where nothing is written, an edit is still named once and a reinitialise names the older lines in the application log where application logging is on; Settings Reference's section 4a says the same of each of its rules, and its rows for HM5803 and HM5804 say that a file the service may not write is not written at all, which the application log says, not as an error, and that HM5804 is said once there because the row records the edited line; and Upgrading hMailServer's note on rolling back from 6.3.4 to 6.3.3 says that the file's permissions under NT SERVICE\hMailServer, like a Linux package installation's unit, keep the server from writing the copy that note relies on. Where Changes Since 6.2.10, Control Panel Pages, the Control Panel Reference, Settings Overview and The Control Panel said that a Control Panel with no connection refuses rather than write a line or a file the server would undo, they say one whose edit the server would not use. The copies of documents that still say it without the condition - Contributing, Diagnosing Stalled Mail, Event Scripts, Migrating the Database Backend, The Update Feed and Warm Standby - follow their documents and are left as they are. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 21, 2026

Home, Ports Reference, Monitoring and Health, Backup and Restore and Encryption and Certificates say what the 6.3.7 Control Panel shows where the text around the retaken screenshots still described the older pages, read from the images and from the Control Panel at master: the Welcome page's alt text counts thirteen task rows, as WelcomeIntents lists them and The Control Panel says, where it said twelve; Ports Reference's table of symptoms sends a reader whose listener never accepted a connection to the Listening column of Connections & protocols, TCP/IP ports, where it sent them to a listener list on Server status, which has none, and its table of outbound connections puts the smart host on the Smart host tab of Delivery of e-mail, in the Server-wide smart host card, where it named an SMTP relayer (smart host) card; Monitoring and Health's table of pages gives Server status its Configuration checks card first, the servers' last start and running time, the database, the counts since the service started, the sessions connected now and the auto-ban ranges in force, and the line with Open Updates that says a newer release is waiting, where it listed five statistics, the update check's verdict and a Warnings list, and gives the delivery queue its State column - delivering now, due, or the next try - and the buttons View source, Trace message, Remove, Deliver all now, Deliver now and Refresh, where it listed a next try time, a file column and four buttons; Backup and Restore says that since 6.3.4 a save applies the message-metadata-only switch, and every key of its schedule and verification table, at once, as the Applies on save under each box says, and that a schedule saved on a server that started without one is registered by the save, where it said that each applied after a service restart, which was so up to 6.3.3; and Encryption and Certificates quotes the TLS versions & ciphers page's subtitle whole and says that its last words point to Auto-ban, where the alt text quoted its first sentence alone and the caption said that the subtitle put Auto-ban under Sign-in & access. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 19, 2026

Encryption and Certificates, Security Hardening, Stopping Spam, Stopping Viruses and Ports Reference describe the screenshots retaken from 6.3.7, read from each image and from the Control Panel at master, where they described the 6.2.10-era captures and the groups of that build: TLS & certificates is Certificates & encryption, with Automatic certificates (ACME), TLS certificates and TLS versions & ciphers (tabs Protocol versions, Ciphers & verification and Session resumption), and the ACME page says its settings are stored in the database, where the text offered hMailServer.INI instead; Access & abuse protection is Sign-in & access, and Security Hardening embeds the Auto-ban page itself (cp-autoban.png) where the TLS page's capture stood in for it; the Control-Panel-only second factor is set up with the button on the Two-factor tab of Administrative access, the sign-in card no longer carrying a link; Server limits & expert settings opens on its Timeouts and queue bounds card, the front-end proxies being a card of Incoming relays; Spam & virus filtering is two groups, Spam filtering, whose Lists section holds Spam exemptions and Greylisting exemptions, and Virus scanning; DNS blacklists is DNS block lists (DNSBL), and the reject message is the Refusal text, the caption saying that the page was empty on the server it was captured on and that a fresh install has the two inactive rows; Blocked attachments replaces a matching attachment with a short note, where the text said it refused files, and lists file-name patterns; the DANE, DNSSEC and MTA-STS settings of Transport security are on its Encryption tab, ARC and the DKIM timestamps on Signing and the reports on Reports; and the TCP/IP ports page and dialog are described with their AUTH and Listening columns and the dialog's own labels - Bind address, Port, TLS certificate, SMTP authentication and Client certificate policy (mutual TLS) - with the Listening column, not Server status, saying which listeners are up. The sentence that opens the Anti-spam settings page in Stopping Spam is left as it was, with that page's earlier capture. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 19, 2026

Every page's header says whether 6.3.7 is reflected in it, and none calls 6.3.6 the latest release, where thirty-seven headers still said "6.3.6, the latest release (6 October 2026...". The guide and reference pages brought up on 5 October 2026 to 6.3.6 say so with its date and schema, and that 6.3.7, the latest release (17 October 2026, schema 6108), is not yet reflected on them: Aliases, Lists and Public Folders, the APIs Reference, Compliance and eDiscovery, Connecting a Mail Client, Control Panel Pages, the Control Panel Reference, DNS for Your Domain, Encryption and Certificates, Encryption for People, How Email Works, Mail In to a Webhook, Mailing Lists, Message Storage, Migration, Monitoring and Health, Outbound Shaping, the Ports Reference, Profiles and Environment, Rooms and Equipment, Routes and Relays, Rules and Sieve, the Runbooks Digest, Security Hardening, Settings Overview, Sign-in and Identity, Stopping Spam, Stopping Viruses, The Control Deck, The Control Panel, The REST API, The Webmail, Troubleshooting, What hMailServer Is and Is Not and Your First Domain and Mailbox. Backup and Restore says that 6.3.7 is reflected only in the release a failed full restore is made again on, Capabilities and Configuration only in the releases the release jobs have made, and the Settings Reference that its keys were last re-checked at v6.3.6, where its re-check of 5 October 2026 called v6.3.6 the latest release. The COM API and Scripting and the Glossary, whose headers said nothing of a release after 6.3.4, say that 6.3.7 is not yet reflected, the Glossary that its stamp names it; Version History to 6.2.10 that its history ends at 6.2.10 and what came after, up to 6.3.7, is in Changes Since 6.2.10; and the Project Handbook that its status note, and what sections 7, 8, 9 and 11 say of how a change lands, who can approve it, which runners run what and which releases the release jobs have made, are brought up to the tree at 6.3.7, the rest not yet, and that 6.3.7, published on 17 October 2026, was the first of the security releases that go on until 30 September 2027. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 18, 2026

The guide pages say what 6.3.6 changes in anti-spam, DANE and outbound TLS, backups and restores, calendars, sign-ins, the webmail, Sieve, the store commands and the auto-ban, and every page's header says whether 6.3.6 is reflected in it. Stopping Spam: the SURBL test as 6.3.6 runs it (every registrable domain up to 200, 256 names a list, sixteen lookups at a time, SurblTooManyDomainsScore, a list's error answers never a listing), the Sender MX test by the Public Suffix List, the two FQDN checks, the greylisting key of schema 6107, the sender lists' URL entries. Encryption and Certificates: What DANE actually does for 6.3.6 - DANE-TA, the indeterminate lookups, the validated MX RRset, a resolver that strips DNSSEC, the deferrals where mail bounced, and the log lines as the tag writes them. DNS for Your Domain: the indeterminate rule and the resolver requirement. Routes and Relays: the relayer's STARTTLS required refuses permanently, as it always did; a webhook route held to public addresses through HttpProxy. Mail In to a Webhook: the same. Backup and Restore: the Updates folder and a destination inside the data directory left out, the restore that copies in first and undoes a copy that fails, the full restore that failed on installations made new with 6.3.4 or 6.3.5, this installation's own self-signed pair kept, a message deleted while a backup copies. Rooms and Equipment: the organiser verified by the From address, and the send API believed for nobody. Encryption for People and The Webmail: the S/MIME certificates kept, the HTML view's images, OpenPGP's 32 MB, the attachments' types, the invitation card, days to keep. Connecting a Mail Client: a stored event changed only by a verified sender, the AUTH on port 25 that bans, FETCH's NO [LIMIT]. Sign-in and Identity: the pending sign-ins carried by the browser, sealed. Rules and Sieve: ManageSieve's deadlines and a session that ends. Message Storage: the store commands' link rule. Mailing Lists: every field of a posting removed. Security Hardening: the grant through a junction, who else on the computer may read the mail (/ProtectFolders), AutoBanMinutes for an AUTH on port 25, the checklist's row 12a. Migration: days to keep messages, as the repository's document gives it. Aliases, Lists and Public Folders, Compliance and eDiscovery, Control Panel Pages, Monitoring and Health, Outbound Shaping, Profiles and Environment, Stopping Viruses, What hMailServer Is and Is Not, Your First Domain and Mailbox and How Email Works: the header says that 6.3.5 and 6.3.6 are not yet reflected on the page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

Every link to the project points at its address in the group, gitlab.com/hmailserver/hmailserver, where it has been since 29 September 2026; the identities 6.3.5 was signed with, and the setting row that lists both paths, keep the path the project began at. The project's path in all 63 pages that linked it (548 links), 6.3.6 being the first release made at the group's path. Left as they were: the seven signing identities https://gitlab.com/Progressiverobot/hmailserver//.gitlab-ci.yml@refs/tags/v... (Release Process, Security Policy, The Update Feed, and the UpdateSigningIdentity row of Settings Reference), which name what 6.3.5 was signed as; and the UpdateSourceRepository row of Settings Reference, which lists both paths on purpose. The container registry's name is corrected with the container page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

Seven features 6.3.4 added have a page of their own, each a copy of its repository document as the tag v6.3.4 (51e2dbda0) has it, headed by the Source of truth note the other copies carry (GitLab issue #25): The SNMP Agent (Snmp.md), Event Scripts (EventScripts.md: the JavaScript engine of the Linux builds, and the contract for all three languages), Secure Defaults (SecureDefaults.md), The Service Account (ServiceAccount.md), Secrets at Rest (SecretsAtRest.md), Database TLS (DatabaseTls.md) and The Update Feed (UpdateFeed.md). A link to a document the wiki copies became a wiki link - Command Line, Third-Party Binaries, Warm Standby, High Availability Runbook, Upgrading Guide and The Service Account, the last two to their sections - and every other became a link to the document at v6.3.4. Each note says where the tag has moved on from its document. The installer smoke test SecureDefaults.md expects on a branch is in the tree at the tag, and does not yet make the checks it lists. ServiceAccountName and ServiceAccountPassword, which ServiceAccount.md calls no longer read, are still loaded by the settings loader (IniFileSettings.cpp:457-458) and used by nothing. The site that UpdateFeed.md's opening note calls not yet deployed has served the feed over HTTPS since 26 September 2026, and at 05:31 UTC on 27 September answered /releases/latest and /releases.json with 6.3.4 and /download/hMailServer-x64.exe with a 302 to 6.3.4's installer. The sidebar and the landing page list each page in its group: Database TLS, Secure Defaults, The Service Account and Secrets at Rest under Secure it; The SNMP Agent and The Update Feed under Operate it; Event Scripts under Extend it. The landing page counts 72 pages (the 74 files less the sidebar and the footer), the other 71, and twenty-two with a Source of truth note; the guides stay 38, since a copy is a repository document. The Runbooks Digest names the seven among the copies. Monitoring and Health, The COM API and Scripting, Security Hardening, Encryption and Certificates, Migrating the Database Backend and Upgrading hMailServer keep what they say of each feature, and gain a line pointing to its page. Every page was rendered with GitLab's Markdown API in the project's context on 27 September 2026: every wiki link, relative link, anchor and link into the repository, at master and at v6.3.4, resolves, and nothing on the new pages is HTML that could be stripped. The one finding, a link to Sigstore's cosign on GitHub from Installing hMailServer, is that project's own page and predates this change.

Christopher Holloway committed Sep 27, 2026

The wiki is brought up to the published release: 6.3.4 is the signed tag v6.3.4 at 51e2dbda0, published on GitLab on 27 September 2026 (02:37:56 UTC), not 8adce850a of 26 September, where the tag was first made and whose release gate failed. Every page that named 8adce850a as the tag or the release names 51e2dbda0, and every page that dated the release 26 September dates it 27 September: the footer, the sidebar, the page headers, the landing page's Current release, the release timeline's row and picture, section 4e's heading. Each fact those pages took from 8adce850a was checked at 51e2dbda0: the commits between the two change 42 files, whose only documents are CHANGELOG.md, BrandLogos.md, OpenPGP.md and SecretsAtRest.md, none of which a page copies, and which include none of Constants.h, Version.h, formMain.cs, the create scripts, IniFileSettings.cpp, SettingsDefaults.h, the IDL, the Control Panel or .gitlab/allowed_signers, so every file and line cited at the tag holds. Where a page said it read the tag on 26 September, it says it read 8adce850a and that what it read is the same at the tag. The suite has 3,811 [Test] attributes at the tag, not 3,809 (the fixes add two tests); twelve places say so. Changes Since 6.2.10 gains, in batch 40, what the release gate found and the eleven fixes: three change tests alone; of the other eight, three fix what 6.3.3 did too - a relay that refused the OAuth2 login got the server's token into the bounce and the logs (open since 6.2.22-pre1), a rule's forward, copy, reply or notice and an account's forwarding could wait a minute in the queue, and IMAP LIST and LSUB took a literal's length for the pattern - and five fix code new in 6.3.4 (sealed mail and an unnamed part, a closed key's FETCH refusal logged as a critical error, the help desk's password reset read as bytes, the logo and key-directory holds, an alert's encoded Subject over 76 characters). The gate table and the timeline give the re-run on 51e2dbda0 as the logs have it: 2,349 on the first bench (2,252 passed, 0 failed, 97 skipped) and 1,462 on the second (1,446 passed, 0 failed, 16 skipped), the 71 live-update tests elevated, all passed, and the Linux suite on the packaged binary, 2,013 tests, 1,562 passed, 0 failed, 451 skipped (results/b40full3 on linix); the database upgrade gates, the security scans, the fuzzers and the installer smoke test, 65 of 65. The JScript flaw is CVE-2026-100741 (CVSS 3.1 9.8), and the project's issue #43 is public: Security Hardening 17.11, the scripting page, the changes, the capabilities and the API reference name them. The project's download links work (the site has served HTTPS since 26 September; on 27 September they led to 6.3.4's files), so Installing on Linux and Running in a Container no longer say they work once it does. The copies of SECURITY.md and CONTRIBUTING.md give the day GitLab published the release, and the security policy's copy counts the 455 findings .gitlab/security-exceptions.yml accepts at the tag - the 169 of the SAST triage and the 286 that held the release scan - where the repository document still says 169; each header says where the copy differs. Three places said no pipeline had run on the fixed tree; one has, the schedule of 27 September 2026 on master 6bc09509d, which ran the update feed's pages and package-repos jobs alone, and they say so.

Christopher Holloway committed Sep 27, 2026

The wiki is brought up to the release itself, the signed tag v6.3.4 at 8adce850a: what it said of 6.3.4 had been read from master 92b8f9f63, which the tag's last batch, batch40, follows. Schema 6104, not 6103: 6.3.4 is sixty-four steps from 6.3.3's 6040, the last, 6103 to 6104, adding hm_fetchaccounts.faorigin (Constants.h:1224, formMain.cs:314 and the three create scripts at the tag); every header, table, count and diagram that gave 6103 as 6.3.4's schema says 6104, the upgrade table's step counts are each one more, the step tables gain the 6104 row, and where 6103 means the secrets-at-rest step it stays. No page calls 92b8f9f63 the release or the tree 6.3.4 was cut from any more: a page checked against it says so and that the tag adds a last batch, and a page that copies a repository document the tag leaves as it was says the document is the same at the tag. The copies of repository documents batch40 changes are brought up to the tag, hunk by hunk from the version each copy had reached, their own additions kept: Security Policy (the SSH-signed sums of a release made by hand and the two commands that check a download, an SBOM for every compiled file, a release held by its security scans, secrets refused before they are pushed; its note no longer says the document calls 6.3.3 the latest), Release Process (A release made by hand, the security gate, the SBOM jobs), Upgrading Guide (the installer's HM_ADMIN_PASSWORD, the named lock on MySQL and MariaDB, the probe that stops an upgrade on too old a server at 6041 and the repair of a half-done one), Contributing, Governance (rebuilt on the tag's document, which gives the GitLab roles the owner set on 26 September 2026; the map and the note on code-signing material kept), Assurance Case, Regulatory Scope, Third-Party Binaries, Fuzzing, Migrating the Database Backend and Regression Test Environment. The installer's password handling as the tag has it: the password page is skipped for HM_ADMIN_PASSWORD as for /adminpassword, the database step hands the password (or the live update's token, as token:<hex>) to DBSetupQuick and DBSetup in HM_ADMIN_PASSWORD and DBSetupQuick to DBUpdater the same way, never on a command line, the switch table has the variable, and the unattended upgrade takes either (Installing hMailServer, Upgrading hMailServer 18.4a). How to verify a download: 6.3.4's hmailserver-6.3.4-SHA256SUMS.txt and its .sig, checked with ssh-keygen -Y verify against .gitlab/allowed_signers and sha256sum -c, as SECURITY.md at the tag gives them, and each installer's and package's own SBOM (Installing hMailServer 4.1, Installing on Linux, Upgrading hMailServer 18.4 and 18.4c, home, Release Process, Project Handbook, Troubleshooting, Glossary, Assurance Case, Regulatory Scope). The /download/ links no longer wait on issue #30: the feed's site has had its certificate since 26 September 2026. Changes Since 6.2.10 gains batch 40 in section 4e (the audit before the release, GitLab's SAST and the release gate, the installer's password, the SBOMs and signed sums, the stable download links, the release chain and landing through merge requests, what the first pipeline found, Windows on ARM compiled), items 47 to 51 in section 5 (reserved domain names, a one-time code taken once, the outbound relay's OAuth2 token over TLS only, the fetchers and schema 6104, a pre-6.3.4 hash of a password above U+00FF refused), SQLOLEDB in item 38, the 6041 probe in item 36, and the installer's own PBKDF2 in item 39. Also what the tag makes false elsewhere: the suite has 3,809 [Test] attributes, not 3,698; hmailserver/docs holds 105 documents; Windows on ARM compiles and has never run, where it was "not built"; IMAP offers STARTTLS only before sign-in and TLS and COMPRESS=DEFLATE only after sign-in (Capabilities and Configuration); a parent-domain passkey relying party needs passkey_allowed_origins (Sign-in and Identity); the Settings Reference counts 193 hm_settings rows with PasskeyAllowedOrigins and WebPushLoopbackHttpForTests; and the Linux suite's CI job first ran in the pipeline of 26 September 2026 rather than never.

Christopher Holloway committed Sep 26, 2026

The operator pages describe 6.3.4, the release of 26 September 2026 at schema 6103, as the installer script, the Linux unit and the repository documents at master 92b8f9f63 have it. What they labelled as in the tree after 6.3.3 and not yet released is labelled as 6.3.4's, and what landed after 540347500 is added where an operator meets it. Installing hMailServer walks the installer as it now runs: the server profile and service account pages, a new installation's service on NT SERVICE\hMailServer granted its folders by /GrantServiceAccess and moved only once that succeeds, the administrator password written as PBKDF2 by the server rather than as MD5 by the installer, the secure defaults (a self-signed certificate, STARTTLS on the four seeded listeners, TLS required for authentication on the Internet range) and the stored-secrets key made for a database the installation created, and an upgrade that keeps its account, listeners and ranges. It says 6.3.4 carries an Authenticode signature and no Sigstore bundle, so no server's live update installs it and every server is upgraded by hand, how to check the signature, and which feed and signers a server trusts. Installing on Linux says 6.3.4 carries the x86-64 .deb and .rpm only and links the AArch64 packages and the AppImages to 6.3.3's release, where the latest-release links would break; it adds the unit's first start securing a new installation, the stored-secrets key, database TLS and --check-database, event scripts in QuickJS, SNMP, and the new server verbs. Running in a Container adds HM_DB_TLS_MODE and HM_DB_TLS_CA, the key the container's --create-database makes and how to export it, and that the secure defaults are applied there only by hand; Before You Install gains the service account, the secure defaults, database TLS, MySQL's utf8mb4 floor and where the exported key is kept. Security Hardening rewrites the least-privilege section for the installer's account and the retired ServiceAccountName, and adds secrets at rest, the JScript escaping fix (every release from 6.0.0 to 6.3.3, what it exposed and what closes it) and the database connection, with checklist rows for each. Monitoring and Health adds the SNMP agent, off and answering nobody until a manager is listed, with no COM property or Control Panel page. Backup and Restore adds the restore that lists an archive and refuses an unsafe one whole (HM7540), 7-Zip 26.03, the stored-secrets key that no backup carries, messages in an object store, and the account stores counted at 6.3.4. Encryption and Certificates adds what a new installation starts with, the database's TLS modes, certificates for IP addresses on Linux and what the server keeps encrypted at rest, mailbox encryption at rest off on every account. Troubleshooting gains the rows an operator of 6.3.4 will meet: the sign-in refused before STARTTLS, the self-signed certificate, the unverifiable 6.3.4 offered to a live update, and HM7460, HM7463, HM7494, HM7495, HM7530, HM7531 and HM7540.

Christopher Holloway committed Sep 26, 2026

The five pages on securing the server are brought up to master 540347500, every addition labelled as in the tree after 6.3.3 and not yet released. DNS for Your Domain adds the DKIM rotation policy (it never edits DNS, it says what to publish and waits), the report mailbox through which the server reads the DMARC and TLS-RPT reports a domain receives, the openpgpkey host the Web Key Directory needs, and that BIMI is read for display and not published. Encryption and Certificates says it is about transport, points to the new Encryption for People page, notes which of its keys wait for a reinitialise now that a save applies, and gains section 9.6b on gateway encryption to a partner's OpenPGP key or certificate (the Subject is not hidden; refuse is the default fallback). Stopping Spam gains the hardened greylisting and its bypass list, the SMTP policy switches and the domain white and black list, the three-level allow and block lists with URL entries and the quarantine digest, the refusals each adds, and a section on impersonation protection, spam traps, country blocking and complaints. Stopping Viruses gains the sandbox, what the scanner and the attachment list do with a message sealed end to end, and the attachment conditions of the mail flow rules. Security Hardening gains passkeys, single sign-on, SCIM, account recovery, the breach check, devices and sessions, administrator roles, compromised-account detection, country blocking, verified send-as, masked addresses and restricted delivery, with checklist rows for them.

Christopher Holloway committed Sep 24, 2026

The wiki describes the tree after 6.3.3 as it lands on master: the settings store, the audit trail and alerts, what a domain does to a message, remote-domain policy, a backup that carries everything, and the rest of three batches Twenty-seven pages, each written from the code at 3233b0cc4 and then checked sentence by sentence against it by a second reader: 166 claims verified, 23 corrected before this commit. Everything the tree holds that no release has is labelled as in the tree after 6.3.3 and not yet released, and the next release is called that rather than given a number. The changes page carries the four schema steps 6042 to 6045 in section 2, the second and third batches in section 4e beside the first, the gate for 3233b0cc4 (2,410 tests, 2,402 passed, none failed, 8 skipped; the Linux figures are a placeholder until that run lands), and in section 5 the changes an upgrade makes with no switch - above all that the database is the settings store, that an edit to [Settings] in hMailServer.ini is undone at the next start and reported as HM5804, what to do instead, and that the password pepper stays in the file and out of every backup, so a restore onto new hardware needs it brought along. Fourteen pages that told a reader to edit the file now say how the same setting is changed once the store lands, and what an edit to the file does then; the settings reference says the table of INI keys is closed. The feature pages cover the backup that carries every per-account store, the audit trail and alerts with what each does not yet record or raise, syslog export, per-domain reports, remote-domain policy and mandatory TLS, SPF as RFC 7208, hmctl's configuration document, the tours, and the REST routes counted at the commit rather than guessed at. The checking found things the tree itself gets wrong, which are recorded for the next batch rather than papered over here: hmctl's configuration document has an empty ini section because it reads a route that answers names only; the packaged Linux ini's RestApiPort=0 is adopted into the store at first start, so the packaging README's edit-the-file way of turning the REST listener on no longer works; the OpenAPI text for the ini routes and the note the server writes into hMailServer.ini still describe the file as the store; and five repository documents say what their wiki copies said before this commit.

chrisholloway5 committed Sep 15, 2026

The wiki rewritten in depth: 141 diagrams drawn from the code, every reference page made exhaustive, and twenty-one defaults corrected that no page had ever stated The wiki was accurate after this morning's sweep and thin. This is the depth pass the owner asked for: every page read against the code again, every reference page completed, and a diagram wherever a diagram says it better than a paragraph. 141 Mermaid diagrams across 49 pages, each drawn from the handler rather than from memory: the SMTP submission sequence with the checks in the order ProtocolMAIL_ and ProtocolRCPT_ actually run them, the IMAP session state machine from the per-command authentication guards, the DMARC evaluation, the delivery pipeline and its retry arithmetic, the ACME renewal state machine, the spam decision from connection to delivery, the schema chain, the component and threading models of the whole server, the CI workflows and what each one gates, the release draft-sign-publish flow, and a map of the journeys through the wiki itself on the landing page. The reference pages are now exhaustive rather than representative: every route with its method, authentication, request and response shape and its error codes; every [Settings] key with its default, its effect and whether it needs a restart; every port with the key that opens it; every rule criterion and action; every Sieve extension the server advertises; every metric the listener exposes. Twenty-one facts were wrong or absent, and each is corrected against the code rather than adjusted. The ones that will save somebody an afternoon: IMAP SASL PLAIN and SCRAM are not advertised on a default install, which looks exactly like a client bug; SMTP AUTH PLAIN is off by default too; DMARC checking is on while SPF and DKIM as scored tests are off, and the DMARC test evaluates both itself regardless; the seeded DNSBL and SURBL servers are inactive; a new mailbox contains INBOX and nothing else, which is the real cause of the classic missing Sent folder; MTA-STS hosting and autoconfiguration default on while both web-service ports default to 0, so the shipped default is features on with nothing listening; and TLS-RPT and DMARC report sending are inert until their From address is set, with each completed day discarded unsent. Eleven screenshots are named as wanted, with what each should show. The existing images are from a 6.2.10-era build and the pages say so where it matters.

chrisholloway5 committed Sep 8, 2026

Every page read against the tree on 8 September 2026: the release and schema stamps (6.2.27, schema 6031, 2,124 tests), the routes, keys and pages that were missing, the listener paragraphs that were false, and the unreleased work labelled as such An audit of all 51 pages against master produced about 360 findings on 43 of them, applied here. The largest: the APIs reference lacked 47 routes and described the listeners as single-threaded HTTP/1.0 (they run on the Boost.Asio HTTP/1.1 server); the settings reference lacked the fourteen Update* keys and IMAPCompressionEnabled and counted 195 keys instead of 236; every "current release" stamp said 6.2.24; Changes Since 6.2.10 ended three releases and one schema step early; Architecture said the optional listeners were deliberately not Boost.Asio and built their own SSL contexts (neither is true); the upgrading pages still warned of a silent-upgrade hang fixed in 6.2.23; the Control Panel pages knew nothing of the seventeen languages, the Updates card or the stalled-mail page; and two pages did not render (a header inside a code block, CR and TAB bytes in file names). Anything in the tree but not in v6.2.27 - the live update, the self-service portal and /api/v1/me, the HttpServer listeners, IMAP COMPRESS=DEFLATE, the seventeen-language Control Panel, the Control Deck views - is documented and marked "in the tree after 6.2.27, not yet released". The Control Panel screenshots are still from a 6.2.10 build and the pages now say so.

chrisholloway5 committed Sep 8, 2026

The hMailServer 6.2.24 wiki: the corrected manual, the runbooks, and the references generated from the code

chrisholloway5 committed Sep 4, 2026