History / Running in a Container

The release record and the pages on upgrading and installing say what 6.3.8 is - build 47 at schema 6108, which it leaves as 6.3.6 and 6.3.7 have it, a security release cut from master with the finished work it held, tagged on 2 November 2026 and published that day at 14:39 UTC at the group's path, the same sixty-two files and the provenance also as one line of JSON, 161 links - and how each kind of server reaches it, and Home, the footer, the sidebar and the Glossary name it as the latest release, where they named 6.3.7. Changes Since 6.2.10: the timeline's row for 6.3.8, 6.3.7's no longer marked the latest, with the tag pipeline's gates (windows-gate on bench150, 2,869 tests, 2,807 passed, 0 failed, 62 skipped; windows-gate-s1vm on S1-WINBENCH, 1,700 tests, 1,682 passed, 0 failed, 18 skipped; linux-suite, 2,749 tests, 2,374 passed, 0 failed, 375 skipped) and the installer smoke test (an upgrade from 6.3.7, 105 checks, and a new installation, 65, none failed); the picture's 6.3.8; 6.3.8's stamp, the CHANGELOG's heading giving 2026-11-01, the day the release was expected to be published; section 2's 6.3.8 adding no step; and a section 4i for 6.3.8 - the files and their bundles (161 links), the x64 installer's SHA-256, the container image and its tags, its two start tests beside PostgreSQL and MariaDB, the published Helm chart started after the release, who installs the release by the live update, the flaws fixed, each with its work item and "CVE requested", no identifier having been assigned on 2 November 2026, the advisory of work item 103, the hardening beside them, the three requests from outside, the twenty-nine items of "What changes on upgrade without a switch" in the CHANGELOG's numbering, and what else 6.3.8 carries and its known issues; section 5's heading points at it, and the CHANGELOG pointer names 6.3.8's section. 4i says when the fixes were public: work item 100's from 19 and 20 October 2026, the others from the batch's push on 1 November 2026 at about 07:14 UTC (merge request !33), about a day and seven hours before the release. Upgrading hMailServer: 18.1 gives 6.3.8's schema, 6108; the path's chart and table gain 6.3.8; 18.2 and its table say that 6.3.8's installer refuses the original's 5.7, where they said the release after 6.3.7; 18.4's download, its check and the version About shows are 6.3.8's; a section 18.4g for upgrading to 6.3.8, from the release notes' Before you upgrade and Upgrading (the backup and no schema step; the live update's routes from 6.3.6 and 6.3.7, from 6.3.4 and 6.3.5 and from older versions; the three leftover trust settings; the install by hand; the container; a Helm release of the 6.3.6 or 6.3.7 chart; what may need doing before the upgrade; the .NET 10 runtime); and 18.7 names 6.3.8 among the releases the three leftover settings refuse. Home: the latest release, the refusal of the original's 5.7, the live update, and the Current release, Database schema, Platform and Regression suite rows and the Changes Since 6.2.10 row. Installing hMailServer: the download, its check (with the provenance's .jsonl) and the refusal of the original's 5.7, which it said the release after 6.3.7 would make. Installing on Linux: 6.3.8's files and schema, the update applied by the helper of 6.3.6 or 6.3.7, and the image's MariaDB client. Before You Install: 6.3.8's files, and the image reaching MariaDB from 6.3.8. Running in a Container: 6.3.8's image, its tags on Docker Hub copied by the registry-mirror job on 2 November 2026, the MariaDB client, the entrypoint that applies a new installation's secure defaults itself, the chart that starts a server - installed from the Helm repository on 2 November 2026, with a release of 6.3.7's chart Ready after the move - and Artifact Hub's listing at 6.3.8, where the page said each of these would come with the release after 6.3.7. Each page's header says it was brought up on 2 November 2026 to 6.3.8 for what 6.3.8 changes on it, or what of 6.3.8 is not yet reflected. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Nov 2, 2026

Four of this wiki's own pages say what UpdateFeed.md, README.md, Acme.md, ContainerImage.md and the CHANGELOG say with batch55 on master, 36bd59faa, where they still said what batch55 corrects or what its chart and Compose file changed. Upgrading hMailServer's 18.4c says that a server from 6.2.28 to 6.3.3 pointed at the feed sees the newest release, and that its live update still installs nothing, the feed offering it only the newest release, which it cannot install, and the server downloading only the installer its check found, so that even the re-hosted releases up to 6.3.3, which verify against its signer, are installed by hand, where it said that such a server saw 6.3.4 and could install the re-hosted releases up to 6.3.3 by its live update; and that the releases after 6.3.4 are signed by the project's GitLab CI, which a 6.3.4 server's live update trusts, every release from 6.3.5 having been signed there, where it said that they were to be signed there and that none had been yet. Encryption and Certificates' 9.1 says that the ACME client loads a new certificate by a reinitialise of the server, the listeners restarting for a few seconds and the sessions in flight cut unless ShutdownDrainSeconds gives them a window, the service itself not restarting, where it said that it reloaded the certificate with no restart. Profiles and Environment's note on the container is headed as not run in a container at 6.3.4 and says, in the past, what had been run then, that the tag pipelines of 6.3.6 and 6.3.7 have run the verb in a container since, starting each pushed image through the entrypoint with the REST listener given through the environment, and that on 23 October 2026 docker compose up and helm install of the chart were run as a user runs them, against 6.3.7's published image, where it said in the present that the entrypoint, the chart and the Compose file had been read and not executed. Running in a Container's note on the chart gives helm install from the project's chart repository as the way to install with the values below from the release after 6.3.7, where it gave it with no release while the same note says that the charts the repository serves, 6.3.6's and 6.3.7's, start no server; and the paragraph on how the chart is checked says that CI lints and renders it and has never installed it, that since 26 October 2026 chart-and-compose also holds the rendered StatefulSet to the pod's user and group, 999:999, to the init container and to the new installation secured before the server, and the resolved Compose file to its command and to the REST listener's pair, and that the first installs into a cluster, by hand on 23 October 2026, found that the charts of 6.3.6 and 6.3.7 start no server, where it said that the chart was proven in CI. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 26, 2026

Seven of this wiki's own pages say what ContainerImage.md, the chart's README, SecureDefaults.md, Acme.md, Channels.md, PackageManagers.md and the CHANGELOG say with batch55 on master, 36bd59faa, of the Helm chart and the Compose file, of ACME, of the build services' installs and of the coverage job. Running in a Container's note on the chart says that the charts the Helm repository serves, 6.3.6's and 6.3.7's, start no server - their pod stops at CreateContainerConfigError, the image naming its user, and given the user by number at a configuration file the empty volume hides, nor do they secure a new installation - that the chart in the tree, on master since 26 October 2026, runs the pod as 999:999, fills the new volumes in an init container and secures the new installation before the server, that the release after 6.3.7 is the first to serve it and until then the chart of a checkout starts the published image, as both were installed on 23 October 2026, and how a release of the published charts is moved, helm upgrade --reset-then-reuse-values and then kubectl delete pod, where it gave the repository's chart as the way to install with the values below; the paragraph on the secure defaults says that the image alone does not apply them, that from the release after 6.3.7 the Compose file and the Helm chart run --apply-new-install-defaults --if-marked before the server and the charts of 6.3.6 and 6.3.7 do not, and that anything else is secured by hand, where it said that a container never applied them by itself; the Compose note says that the tree's file differs from the page's example in three ways, its command securing the new installation and its REST listener taking the pair that makes, and that a key of one's own in ./certs must be readable by the image's user, 999, where it said two ways and that the file mounted the REST certificate and key in; the note headed Not yet run in a container is headed as run as a user runs it on 23 October 2026 and says what was run, keeping what the repository said at 6.3.4; and How the image is built and proven says that from the next release's tag pipeline the start test also asks each image whether its update check knows it runs in a container. Home's Platform row and the passages of Capabilities and Configuration and of the Ports Reference on a new installation's defaults say the same of the chart and the Compose file, where Home named a Helm chart among the platforms without that and the other two said that the container ran the step by hand. Encryption and Certificates, under When it renews, says that from the release after 6.3.7 a certificate that does not name every host AcmeDomains lists is due at once and a save of AcmeDomains starts the check, where up to 6.3.7 a host added waited for the renewal, and names the ways to ask for a check and read its state - POST /api/v1/acme/run and GET /api/v1/acme, Utilities.RunAcmeCheck and Utilities.GetAcmeStatus, Check now on the Control Deck's Certificates page - with the spacing every check keeps and the names left out of the order. Installing on Linux's paragraph on the build services says to import OBS's repository key only once gpg shows its fingerprint, BA0868309CFBD36498CE41D22F0B9419E67EE770, and that on 23 October 2026 6.3.7 was installed from OBS, Copr and the PPA as a user installs it and the server started, where it gave zypper addrepo and zypper install alone. The Assurance Case's table of residual risks, this wiki's own, gives the linux-coverage job's first run on GitLab, 57.58% of the lines and 46.10% of the branches in pipeline 2983513656 on 24 October 2026, and the page's header says so. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 26, 2026

Running in a Container and the Project Handbook, this wiki's own pages, say what ContainerImage.md, the CHANGELOG and build/make-app-icon.ps1 say with batch54 on master, 9336fdd59, of the Helm chart's listing and the packages' icon. Running in a Container's note on the chart says that since 6.3.6 each release carries it as hmailserver-chart-<version>.tgz, with its Sigstore bundle, and that the project's chart repository, https://updates.progressiverobot.com/helm/, serves it (helm repo add hmailserver https://updates.progressiverobot.com/helm/, then helm install mail hmailserver/hmailserver), which Artifact Hub lists at 6.3.7, and that the chart of 6.3.7 and earlier has no icon while the next release's names the fork's own, the Control Panel's, which Artifact Hub shows on the listing, as ContainerImage.md's The Helm chart and Artifact Hub say, where it said that the chart was not published to a chart repository and was installed from a checkout, which has not been so since 6.3.6: the CHANGELOG's 6.3.6 section has the chart as a file of each release, served from that address, and this wiki's Changes Since 6.2.10 gives 6.3.6 the Helm repository; read on 24 October 2026, the repository's index lists 6.3.7 and 6.3.6, and Artifact Hub's API gives the listing at 6.3.7, from that address, as a verified publisher's, with no logo. The example from a checkout stays. The Handbook's inventory of build/ says that make-app-icon.ps1 also writes the .ico's 256 px image as hmailserver/source/Server/platform/packaging/hmailserver.png, the packages' icon, as the script's header has said since batch54, where it named the .ico alone. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 24, 2026

Installing hMailServer and Running in a Container, this wiki's own pages, say what the installer's code, the chart and the documents say with batch53 on master, 6fb8164c6, where 3770baf left them saying otherwise. Installing hMailServer's row for the refusal of an installation of the original hMailServer's 5.7, in the table of what setup checks before it shows anything, says that from the release after 6.3.7 setup refuses an earlier installation whose hMailServer.exe is before 6 when the running service answers a database past schema 5708 and before 6001, or, where the service is not running or does not answer, when its DBScripts folder holds the original's own upgrade scripts past 5708 (Upgrade5708to5709*.sql), unless the settings file the installed server reads keeps the database's password as only this fork does (PasswordEncryption 6), a database of this fork's own, which setup does not refuse; and that a refusal by the scripts also says that the database's version could not be read and that a database at 5708 or older, or this fork's own, is upgraded once the service runs and setup is run again, as OriginalHMailServerKind and OriginalHMailServerMessage in hmailserver/installation/OriginalHMailServer.iss and Upgrading.md's Where you can upgrade from have it, where the row said that, with the service's answer unread, the installed server's settings file and the original's scripts showed the database past 5708 and before 6001, a version they do not show. Its section 4.5, Unattended install, says in the row for /adminpassword that with /LOG the setup log records setup's command line, the switch with it, as README.md and PackageManagers.md say since batch53, and its example sets HM_ADMIN_PASSWORD in the elevated prompt and passes no /adminpassword, where it passed /adminpassword=<password> beside /LOG, which put the administrator password in the setup log. Running in a Container's row for the chart's database values says that the chart of 6.3.7 and earlier passes database.port, whose default is 5432, whatever database.type is, so that, told MySQL, it needs database.port: 3306, as templates/statefulset.yaml and values.yaml of the chart at the tags v6.3.4 to v6.3.7 and CHANGELOG.md's Unreleased entry on the chart have it, where it said that that chart passes 5432 whatever the type, as though it could not be given another port. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 22, 2026

Eight of this wiki's own pages say what the documents say with batch53 on master, 6fb8164c6, of the container image and MariaDB, of the installer and the original hMailServer's 5.7, and of the Chocolatey package. Running in a Container says that the image carries libpq and, from the release after 6.3.7, MariaDB Connector/C, which the server opens when HM_DB_TYPE is MySQL, and that 6.3.7's image and the ones before it carry libpq alone, reach PostgreSQL only and, told HM_DB_TYPE=MySQL, stop at the entrypoint's --create-database, as ContainerImage.md says, where it said only to point the image at a PostgreSQL or MariaDB server; its row for HM_DB_TYPE and its row for the chart's database values say the same, the latter also that the chart from the release after 6.3.7 passes database.port only when it is set, the type's own port otherwise, and that the chart of 6.3.7 and earlier passes 5432 whatever the type, as the chart's README and values say; and How the image is built and proven says that the image jobs of a v* tag's pipeline made 6.3.6's and 6.3.7's images and that container-image-start and container-image-start-arm64 start each pushed image beside PostgreSQL alone up to 6.3.7 and, from the next release's tag pipeline, beside PostgreSQL and beside MariaDB, where it said that the smoke test had no replacement yet. Before You Install says that a container image reaches MariaDB from the release after 6.3.7, and Installing on Linux that the image installs libmariadb3 itself from that release, as the packaging README says. Upgrading hMailServer's 18.2, after its flowchart and in its table's row for the original's 5.7 builds of August and September 2026, Installing hMailServer, Home's download line and Migration's row for a server of the original's 5.7 say that from the release after 6.3.7 the installer refuses an installation of the original's 5.7 before it changes anything and that the installers of 6.3.7 and earlier do not look and must not be run over one, as Upgrading.md, ForkAndOriginal.md, Migration.md and README.md say, where Upgrading hMailServer said only that setup replaced the program files before DBUpdater stopped and not to run this fork's installer over one, and the other three said nothing of a refusal. Upgrading hMailServer also says that over an installation that the original's 5.7.0 build 3013 or later made new, setup up to 6.3.7 takes it for a new installation and sets up a new, empty database beside the original's, and Installing hMailServer's table of what setup checks before it shows anything has the refusal as a row of its own, with its exit code 1, its log line and its file in %TEMP%. Installing hMailServer and Changes Since 6.2.10's 6.3.4 entry on the winget and Chocolatey manifests say that a moderator returned the Chocolatey package of 20 October 2026 on 21 October, asking that its authors also credit the original hMailServer's author, Martin Knafve, and that chocolatey-publish sent 6.3.7 again on 22 October 2026, saying that it is the fork but not yet crediting him, which the community repository's feed lists as Submitted, as PackageManagers.md says, where they said that the package of 20 October waited for moderation. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 22, 2026

Nine of this wiki's own pages say what the documents say with batch52 on master, 72be22b4e, of the fork and the original, of the channels and of the container image's copies, where they said otherwise. Home says that the wiki documents Progressive Robot's fork of hMailServer, not the original hMailServer by Martin Knafve, with a link to ForkAndOriginal.md, which says how the two differ, where it called it the modernised fork, and that the installer upgrades in place every earlier release of this fork and the original up to 5.6, not the original's 5.7 releases, where it said that it upgraded any earlier hMailServer. What hMailServer Is and Is Not's About this fork says the same, that the original released 5.7.0 on 28 September 2026 and 5.7.1 and a 5.7.2 pre-release on 29 September, and that this fork is not made by Martin Knafve or the original project and is not its successor, and links ForkAndOriginal.md; its two sentences on the design rule say that an installation it upgrades behaves no differently until something is turned on, where they said that an existing hMailServer installation upgrades. Migration's table of routes has the original's 5.7, a migration of kind imap with the domains and accounts made here first, and the Runbooks Digest's table of routes has the original up to 5.6 in place and its 5.7 by that migration, where it had the upstream hMailServer in place; Upgrading hMailServer's 18.2 points at ForkAndOriginal.md. Installing hMailServer says that the Chocolatey package is hmailserver-progressiverobot, pushed by chocolatey-publish on 20 October 2026 and waiting for moderation, that choco install hmailserver finds nothing and is not this project's, the id being the original's, that winget is not submitted and that winget install hMailServer will install the original once a community packager's pull request is merged, and that both installers register as hMailServer_is1, where it said that winget install hMailServer and choco install hmailserver would work once a first submission was reviewed; Changes Since 6.2.10's 6.3.4 entry on the manifests is titled for the manifests and names both ids, where its title was those two commands. Installing on Linux says that OBS, Copr and the PPA carry 6.3.7, for which releases and with what commands, as Channels.md gives them on 21 October 2026, and that the AUR and the Snap Store have nothing yet; it and Running in a Container say that the owner made the copy on ghcr.io public on 20 October 2026 and that the image was copied to Docker Hub as docker.io/progressiverobot/hmailserver on 21 October 2026, each pulling without signing in, where they said that the copy was private and being made public. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 22, 2026

Home, the sidebar, the footer and thirteen of this wiki's own pages say where the project is worked on and where to ask as the documents say it from batch49 - GitLab the one place the project is worked on, and github.com/RainbowWizard-coder/hMailServer its mirror since 18 October 2026, with Discussions and no Issues - where they said that GitHub had been unavailable to the project since 18 September 2026, sent a question to GitLab alone, called the original hMailServer unmaintained and gave the licence as AGPL-3.0; the suspension of the account Progressiverobot on 18 September 2026, and what did not run or answered 404 after it, stay as history. Home's Source and issues: the repository on GitLab, the one place the project is worked on, its mirror on GitHub with copies of the releases and of this wiki, Discussions and no Issues, a pull request there landed through GitLab, and the former account's addresses answering 404 since its suspension, where it said the project's GitHub addresses answered 404; a new Questions: an issue with the Question template, the Q&A of GitHub's Discussions or the forum, and a vulnerability privately, never in a public issue, a discussion or a pull request (SUPPORT.md, SECURITY.md and README.md from batch49). Its row for The Update Feed says since GitHub suspended the project's old account, where it said since GitHub went. The sidebar names the mirror and where a question goes, and the footer links the mirror. Troubleshooting 19.12: issues opened on GitLab alone, a question also in GitHub's Discussions or on the forum, the former project's issues and discussions still gone, a vulnerability reported privately, never in a public issue, a discussion or a pull request; and its row for an update feed answering 404 names the former account's API, where it said the project's GitHub account had been unavailable. The Glossary's footer names the mirror and the licence AGPL-3.0-or-later, and its CodeQL row says that GitHub's own CodeQL default setup analyses the copy on GitHub since 18 October 2026, no workflow of the project's, and that since 6.3.6 static-analysis (cppcheck and clang-tidy) and semgrep fail the pipeline of master, a batch* branch or a release tag on a finding new to their baselines that master's exceptions file does not accept, while dependency-scan (Trivy with OSV) blocks no pipeline and the release job reads its report, as README.md says, where it said only that the workflow had not run since the suspension and that the jobs in its place were not yet blocking. The Project Handbook's and the Runbooks Digest's status notes say that GitLab is the project's home and the one place it is worked on, the account Progressiverobot suspended and GitHub's copy GitLab's mirror, where they began "GitHub has been unavailable to the project since 18 September 2026"; the Handbook also says where a question and a security report go now - a security report never to a public issue, a discussion or a pull request - that sbom.yml and sign-release.yml ran once on 18 October 2026 on the copies of the releases up to 6.2.22-pre6 and have been disabled since, what .github/ holds from batch49, the third reporting route, and that the OpenSSF API, which on 19 October 2026 still served the old workflow's last result, of 18 September 2026, and none for the GitHub copy, is to carry the copy's score once its workflow has run on master (ContinuousIntegration.md from batch49). Changes Since 6.2.10's preamble and Capabilities and Configuration's quality-gates line say the same of the old workflows, where they said that none had run since GitHub became unavailable. Running in a Container and Installing on Linux say that the image was copied to ghcr.io/rainbowwizard-coder/hmailserver on 18 October 2026 and is private, and is not to be pulled from there, as ContainerImage.md words it from batch49, where Running in a Container said that the old account's registry had been unavailable and Installing on Linux that GitLab's registry held no image yet. Installing hMailServer says that every release from 6.0.0-B1 to 6.3.7 is also on GitHub's releases page, copied from GitLab byte for byte, where it called 6.3.4 the first release published on GitLab alone, and gives the licence as AGPL-3.0-or-later; Upgrading hMailServer names the suspended account's Releases API that a server from 6.2.28 to 6.3.3 reads, and the original hMailServer without "unmaintained"; Version History to 6.2.10 says the original project had gone quiet for years and has since resumed development separately, as README.md does from batch49, and What hMailServer Is and Is Not's About this fork says so too, and that Progressive Robot Ltd forked it in 2026 and released 6.0.0 on 12 June 2026, where it said that the original project stopped being maintained; and The COM API and Scripting names GitHub's private vulnerability reporting beside the confidential issue and the Service Desk address. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 19, 2026

The release record and the pages on upgrading and installing say what 6.3.7 is - build 46 at schema 6108, which it leaves as 6.3.6 has it, the first security release made while releases pause, tagged and published on 17 October 2026 at the group's path, the same sixty-two files - and how each kind of server reaches it, and Home, the footer, the sidebar and the Glossary name it as the latest release, where they named 6.3.6. Changes Since 6.2.10: the timeline's rows for 6.3.5, 6.3.6 and 6.3.7, 6.3.4's row no longer marked the latest, with the tag pipeline's gates for 6.3.7 (windows-gate on bench150, 2,794 tests, 2,732 passed, 0 failed, 62 skipped; windows-gate-s1vm on S1-WINBENCH, 1,652 tests, 1,634 passed, 0 failed, 18 skipped; linux-suite, 2,652 tests, 2,284 passed, 0 failed, 368 skipped) and the installer smoke test (an upgrade from 6.3.6, 98 checks, and a new installation, 64, none failed); 6.3.7's stamp; section 2 to 6108, and 6.3.7 adding no step; and a section 4h for 6.3.7 - the files and their bundles (160 links), the x64 installer's SHA-256, the container image and its tags, who installs the release by the live update, the flaws fixed with the five identifiers GitLab has assigned and "CVE requested" for the twelve requests still queued, the hardening beside them, the three reports from outside, the four cases of the program folder's permissions not fixed in this release, the thirty-three items of "What changes on upgrade without a switch" in the CHANGELOG's numbering, and what else 6.3.7 carries; section 5's heading points at it, and the CHANGELOG pointer names 6.3.7's section. Upgrading hMailServer: 18.1 gives 6.3.7's schema, 6108, where it gave 6.3.4's 6104 as the current release's; the path's chart and table gain 6.3.5, 6.3.6 and 6.3.7, with the count of steps from each older version to 6108; 18.4's download, its check and the version About shows are 6.3.7's; a section 18.4f for upgrading to 6.3.7, in the release notes' order (the backup and no schema step; the live update's routes from 6.3.6, from 6.3.4 and 6.3.5 and from older versions; the three leftover trust settings; the install by hand; the container; what may need doing before the upgrade; the .NET 10 runtime an upgraded server keeps; what 6.3.7 does not fix; the Control Panel's moved pages); and 18.7's Updates page and the refusal of every release after 6.3.6 by the three leftover settings. Home: the latest release, the download's check, the Current release, Database schema and Regression suite rows and the Changes Since 6.2.10 row. Installing hMailServer: the download link's release, and the program folder, Bin and ControlPanel that /ProtectFolders hardens from 6.3.7. Installing on Linux: 6.3.7's files and schema, and the update applied by the helper of the version it replaces - 6.3.6's helper applies 6.3.7 - where it said so of 6.3.6. Before You Install and Running in a Container: 6.3.7's files and image, and the registry, which held no image when that page's note was written. Each page's header says it was brought up on 18 October 2026 to 6.3.7 for what 6.3.7 changes on it, or what of 6.3.7 is not yet reflected. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 18, 2026

The release record and the pages on upgrading and installing say what 6.3.6 is - build 45 at schema 6108, published 6 October 2026, signed at the group's path, the last release for the time being - and what an upgrade from 6.3.5 needs. Changes Since 6.2.10: section 2's schema table gains the steps 6104 to 6105, 6105 to 6106, 6106 to 6107 and 6107 to 6108; a section 4f for 6.3.5 (build 44, schema 6105, the first release the tag's pipeline made, its five items) and a section 4g for 6.3.6 - the flaws fixed, with the identifier GitLab has assigned to each or "CVE requested" where the request was still queued, the hardening beside them, the forty-six items of "What changes on upgrade without a switch" in the CHANGELOG's numbering, and what else changes in Operations; section 5's heading points at them. The libraries at the tag (OpenSSL 4.0.3, PostgreSQL 18.6's libpq), days to keep -1 for a move, and the AArch64 packages 6.3.6 carries again. Upgrading hMailServer: 18.2a's step table, 18.4d (upgrading to 6.3.5) and 18.4e (upgrading to 6.3.6, in the release notes' order: the backup and the three one-way steps; DANE and a resolver that strips DNSSEC; the outbound TLS deferrals; days to keep; COM; the administrator's commands, the service account and the installer; the live update's trust and the three leftover settings; the by-hand install under NT SERVICE\hMailServer; Linux by the package manager; the reverse proxy and Host; port 25, the URI lists, ManageSieve, IP addresses in text and the auto-ban across a stop; the webmail's S/MIME certificates; an account's retention; the full restore; the Compose file, the monitor sentence and tlds.txt); 18.5 clears the three leftover trust settings before the update; 18.6 has the installer's exit codes 10 and 11 and the Linux helper's rule. Home: the latest release, the downloads, the Current release and Platform rows. The footer, the sidebar and the Glossary: the stamp. Installing hMailServer: /ProtectFolders at every installation and upgrade, the grant through a junction the administrators control and /GrantServiceAccess's exit code 7, --grant-database-login, the program folder's folders private, a new installation set up with no window; the download link's release. Installing on Linux: 6.3.6's packages for both architectures and each supported distribution release, the version-less download links, the AppImage's folders made 0700, the schema line, the packages' requirements and licence files, the .rpm's character-set converters, a store command run as root, --check-config's character sets, tlds.txt gone, the backup and event logs in UTF-8, the live update helper's --unit and --image and the copies it installs from, the drain left on a refused request (HM7151), the auto-ban after a stop, and the AArch64 row. Before You Install: what 6.3.6 carries, libpq 18.6, the pre-flight line. Running in a Container: the image at the group's registry path and its 6.3.6 tag, PostgreSQL 18 at /var/lib/postgresql in the Compose file, the container's update check, HM_DB_WAIT_SECONDS. Each page's header says it was brought up on 5 October 2026 to 6.3.6 for what 6.3.6 changes on it. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

Every link to the project points at its address in the group, gitlab.com/hmailserver/hmailserver, where it has been since 29 September 2026; the identities 6.3.5 was signed with, and the setting row that lists both paths, keep the path the project began at. The project's path in all 63 pages that linked it (548 links), 6.3.6 being the first release made at the group's path. Left as they were: the seven signing identities https://gitlab.com/Progressiverobot/hmailserver//.gitlab-ci.yml@refs/tags/v... (Release Process, Security Policy, The Update Feed, and the UpdateSigningIdentity row of Settings Reference), which name what 6.3.5 was signed as; and the UpdateSourceRepository row of Settings Reference, which lists both paths on purpose. The container registry's name is corrected with the container page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

The pages on CI, the release process, the test environment and the project's home are brought up to the tree as it stands for 6.3.6 (batch42 at d8a84f66c, with the branch b42-feeds-docs) and to master's first full pipeline (GitLab work item #21). The five copies of repository documents take every change their documents have had since the tag v6.3.4 (51e2dbda0), merged three ways from the document at the tag to the document now, so that this wiki's own additions stay: Security Policy (SECURITY.md: "While releases pause" - 6.3.6 the last release for the time being, security fixes for the 6.3 line until 30 September 2027 by the maintainers' decision, what gets a release, how a report is handled, the five steps of a security release only the owner can take, what a release depends on that expires; no Azure secret on GitLab; the .sigstore.json copies and the SLSA provenance from 6.3.6), Release Process (RELEASE.md: "A security release during the pause", placed before this wiki's "The release at a glance"; the release jobs' fifty-seven files from 6.3.6 and the batch branches' rehearsal), Contributing (Roadmap3.md, the AppImage's own runtime, the upgrade gate from 6029's create script, linux-repro, three new checkers, and the package, release and rehearsal jobs in place of the release job the document called a placeholder, which the tree now corrects as well), Fuzzing (the commit the old workflow is at) and Regression Test Environment (the Linux suite's counts and the coverage schedule). Each header says what it was brought up to, and where it still differs from its document: the latest release is given as 6.3.4, published on 27 September 2026, until 6.3.5 is out, where the tree is already stamped for 6.3.5; Security Policy keeps its account of the 455 findings accepted at 6.3.4. The statements that no GitLab job had run are replaced with what ran. Master's pipeline 2886389460, 27 September 2026 04:19 to 07:55 UTC on 6bc09509d, read from GitLab's API on 29 September 2026: 29 jobs, 25 passed; windows-gate on bench150, 3,811 tests, 3,736 passed, 0 failed, 74 skipped, 1 inconclusive, and linux-suite on linix, 2,020 tests, 1,710 passed, 0 failed, 310 skipped, each 8,563 s; db-matrix left manual; secret_detection, semgrep and static-analysis failed, each on a fault of the tree's that batch41 mends (#21's notes). So on Home (the regression suite; the current release, with the pause; following releases, with updates.progressiverobot.com/releases.atom from 6.3.6 beside GitLab's own feed; the Security Policy and Release Process rows), the Project Handbook (the status note and sections 7, 8, 9, 11 and 12: GitLab CI's jobs have run, a change lands through a merge request the other maintainer approves with build/land-via-mr.py, the pause), Installing on Linux (linux-cross passed, 559 s), Running in a Container (linux-image and chart-and-compose passed), Changes Since 6.2.10 (GitLab CI runs the checks' replacements; the first full pipeline on the fixed tree), Contributing (a note marked Now) and Regression Test Environment (its header). Fuzzing's Now note: the schedule exists (4461177), and its first two nights, pipelines 2887914840 and 2891652158 on 28 and 29 September 2026, ran linux-fuzz alone and passed, about an hour each. Governance and Regulatory Scope were read and left: their documents have not changed since v6.3.4, and what they say of CI and the release jobs (written, not yet run on a release tag) is still true. Every wiki link and in-page anchor the changes add resolves. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Sep 29, 2026

The wiki is brought up to the published release: 6.3.4 is the signed tag v6.3.4 at 51e2dbda0, published on GitLab on 27 September 2026 (02:37:56 UTC), not 8adce850a of 26 September, where the tag was first made and whose release gate failed. Every page that named 8adce850a as the tag or the release names 51e2dbda0, and every page that dated the release 26 September dates it 27 September: the footer, the sidebar, the page headers, the landing page's Current release, the release timeline's row and picture, section 4e's heading. Each fact those pages took from 8adce850a was checked at 51e2dbda0: the commits between the two change 42 files, whose only documents are CHANGELOG.md, BrandLogos.md, OpenPGP.md and SecretsAtRest.md, none of which a page copies, and which include none of Constants.h, Version.h, formMain.cs, the create scripts, IniFileSettings.cpp, SettingsDefaults.h, the IDL, the Control Panel or .gitlab/allowed_signers, so every file and line cited at the tag holds. Where a page said it read the tag on 26 September, it says it read 8adce850a and that what it read is the same at the tag. The suite has 3,811 [Test] attributes at the tag, not 3,809 (the fixes add two tests); twelve places say so. Changes Since 6.2.10 gains, in batch 40, what the release gate found and the eleven fixes: three change tests alone; of the other eight, three fix what 6.3.3 did too - a relay that refused the OAuth2 login got the server's token into the bounce and the logs (open since 6.2.22-pre1), a rule's forward, copy, reply or notice and an account's forwarding could wait a minute in the queue, and IMAP LIST and LSUB took a literal's length for the pattern - and five fix code new in 6.3.4 (sealed mail and an unnamed part, a closed key's FETCH refusal logged as a critical error, the help desk's password reset read as bytes, the logo and key-directory holds, an alert's encoded Subject over 76 characters). The gate table and the timeline give the re-run on 51e2dbda0 as the logs have it: 2,349 on the first bench (2,252 passed, 0 failed, 97 skipped) and 1,462 on the second (1,446 passed, 0 failed, 16 skipped), the 71 live-update tests elevated, all passed, and the Linux suite on the packaged binary, 2,013 tests, 1,562 passed, 0 failed, 451 skipped (results/b40full3 on linix); the database upgrade gates, the security scans, the fuzzers and the installer smoke test, 65 of 65. The JScript flaw is CVE-2026-100741 (CVSS 3.1 9.8), and the project's issue #43 is public: Security Hardening 17.11, the scripting page, the changes, the capabilities and the API reference name them. The project's download links work (the site has served HTTPS since 26 September; on 27 September they led to 6.3.4's files), so Installing on Linux and Running in a Container no longer say they work once it does. The copies of SECURITY.md and CONTRIBUTING.md give the day GitLab published the release, and the security policy's copy counts the 455 findings .gitlab/security-exceptions.yml accepts at the tag - the 169 of the SAST triage and the 286 that held the release scan - where the repository document still says 169; each header says where the copy differs. Three places said no pipeline had run on the fixed tree; one has, the schedule of 27 September 2026 on master 6bc09509d, which ran the update feed's pages and package-repos jobs alone, and they say so.

Christopher Holloway committed Sep 27, 2026

The wiki is brought up to the release itself, the signed tag v6.3.4 at 8adce850a: what it said of 6.3.4 had been read from master 92b8f9f63, which the tag's last batch, batch40, follows. Schema 6104, not 6103: 6.3.4 is sixty-four steps from 6.3.3's 6040, the last, 6103 to 6104, adding hm_fetchaccounts.faorigin (Constants.h:1224, formMain.cs:314 and the three create scripts at the tag); every header, table, count and diagram that gave 6103 as 6.3.4's schema says 6104, the upgrade table's step counts are each one more, the step tables gain the 6104 row, and where 6103 means the secrets-at-rest step it stays. No page calls 92b8f9f63 the release or the tree 6.3.4 was cut from any more: a page checked against it says so and that the tag adds a last batch, and a page that copies a repository document the tag leaves as it was says the document is the same at the tag. The copies of repository documents batch40 changes are brought up to the tag, hunk by hunk from the version each copy had reached, their own additions kept: Security Policy (the SSH-signed sums of a release made by hand and the two commands that check a download, an SBOM for every compiled file, a release held by its security scans, secrets refused before they are pushed; its note no longer says the document calls 6.3.3 the latest), Release Process (A release made by hand, the security gate, the SBOM jobs), Upgrading Guide (the installer's HM_ADMIN_PASSWORD, the named lock on MySQL and MariaDB, the probe that stops an upgrade on too old a server at 6041 and the repair of a half-done one), Contributing, Governance (rebuilt on the tag's document, which gives the GitLab roles the owner set on 26 September 2026; the map and the note on code-signing material kept), Assurance Case, Regulatory Scope, Third-Party Binaries, Fuzzing, Migrating the Database Backend and Regression Test Environment. The installer's password handling as the tag has it: the password page is skipped for HM_ADMIN_PASSWORD as for /adminpassword, the database step hands the password (or the live update's token, as token:<hex>) to DBSetupQuick and DBSetup in HM_ADMIN_PASSWORD and DBSetupQuick to DBUpdater the same way, never on a command line, the switch table has the variable, and the unattended upgrade takes either (Installing hMailServer, Upgrading hMailServer 18.4a). How to verify a download: 6.3.4's hmailserver-6.3.4-SHA256SUMS.txt and its .sig, checked with ssh-keygen -Y verify against .gitlab/allowed_signers and sha256sum -c, as SECURITY.md at the tag gives them, and each installer's and package's own SBOM (Installing hMailServer 4.1, Installing on Linux, Upgrading hMailServer 18.4 and 18.4c, home, Release Process, Project Handbook, Troubleshooting, Glossary, Assurance Case, Regulatory Scope). The /download/ links no longer wait on issue #30: the feed's site has had its certificate since 26 September 2026. Changes Since 6.2.10 gains batch 40 in section 4e (the audit before the release, GitLab's SAST and the release gate, the installer's password, the SBOMs and signed sums, the stable download links, the release chain and landing through merge requests, what the first pipeline found, Windows on ARM compiled), items 47 to 51 in section 5 (reserved domain names, a one-time code taken once, the outbound relay's OAuth2 token over TLS only, the fetchers and schema 6104, a pre-6.3.4 hash of a password above U+00FF refused), SQLOLEDB in item 38, the 6041 probe in item 36, and the installer's own PBKDF2 in item 39. Also what the tag makes false elsewhere: the suite has 3,809 [Test] attributes, not 3,698; hmailserver/docs holds 105 documents; Windows on ARM compiles and has never run, where it was "not built"; IMAP offers STARTTLS only before sign-in and TLS and COMPRESS=DEFLATE only after sign-in (Capabilities and Configuration); a parent-domain passkey relying party needs passkey_allowed_origins (Sign-in and Identity); the Settings Reference counts 193 hm_settings rows with PasskeyAllowedOrigins and WebPushLoopbackHttpForTests; and the Linux suite's CI job first ran in the pipeline of 26 September 2026 rather than never.

Christopher Holloway committed Sep 26, 2026

The wiki is brought up to the tree batch40 will contain: the branches ns-verifier, gl-project, gov, ci-hyg and tf, read from the repository on 26 September 2026. The copies of repository documents take the changes batch40 makes to them - CONTRIBUTING, SECURITY, RELEASE, GOVERNANCE, ASSURANCE-CASE, Fuzzing, RegulatoryScope, ThirdPartyBinaries and RegressionEnvironment - each header saying so. The seven links into /-/blob/master/.github/ point at .gitlab/allowed_signers, .gitlab/hmailserver.openvex.json, or name the GitHub workflow as being in the git history at v6.3.3, since .github/ is gone from the tree; the verify-tag commands read .gitlab/allowed_signers. What the sweep made false is put right: the PKGBUILD builds from the tag on GitLab; the Compose file and the chart name registry.gitlab.com/progressiverobot/hmailserver, a registry that is switched on and holds no image yet; OpenSSL's release archive comes from Debian's archive against its pinned hash; linuxdeploy is no longer downloaded; the build-inputs-1 files come from the package registry; the manifests name the installer's file there. The live update's third signer, the group hmailserver the project is to move to, with the project's id required, is on the update and security pages, the Settings Reference and the changes for 6.3.4, with the three GitLab settings that keep a server to the present path. Governance names Zain Ul Abidin as zainulabidin1990 on GitLab and gives the owner's rule that release tags are created by the Progressiverobot account alone. The /download/ links at updates.progressiverobot.com are given beside the permalinks, labelled as working once that site serves HTTPS (issue #30; it still failed at 05:16). Contributing gains a section of its own on the issue and merge-request templates, the Service Desk, the two boards and the labels as they are on GitLab.

Christopher Holloway committed Sep 26, 2026

What the check of the wiki's 6.3.4 pages found: the backup page counted 60 per-account tables in the AccountStores declaration where it names 62 (24 carried and 38 declared exceptions), and called the booking answers and the booking queue the two exceptions added in 6.3.4 when they are the last two, added with rooms and equipment on 25 September 2026. Several pages said GitLab CI's jobs build, compile, lint, scan or run the suites, when ContinuousIntegration.md records that no GitLab job had run yet when it was written on 25 September 2026; the Linux page, the container page, the regression environment's header, the project handbook, the regulatory scope's Annex I table and the security policy's table now say the jobs are written and not yet run. And the installer page said the secure defaults' failure is shown in a message box on the built-in database's branch only, when the installer shows it on both branches and only logs an exit 5 after DBSetup, a database it attached.

Christopher Holloway committed Sep 26, 2026

The operator pages describe 6.3.4, the release of 26 September 2026 at schema 6103, as the installer script, the Linux unit and the repository documents at master 92b8f9f63 have it. What they labelled as in the tree after 6.3.3 and not yet released is labelled as 6.3.4's, and what landed after 540347500 is added where an operator meets it. Installing hMailServer walks the installer as it now runs: the server profile and service account pages, a new installation's service on NT SERVICE\hMailServer granted its folders by /GrantServiceAccess and moved only once that succeeds, the administrator password written as PBKDF2 by the server rather than as MD5 by the installer, the secure defaults (a self-signed certificate, STARTTLS on the four seeded listeners, TLS required for authentication on the Internet range) and the stored-secrets key made for a database the installation created, and an upgrade that keeps its account, listeners and ranges. It says 6.3.4 carries an Authenticode signature and no Sigstore bundle, so no server's live update installs it and every server is upgraded by hand, how to check the signature, and which feed and signers a server trusts. Installing on Linux says 6.3.4 carries the x86-64 .deb and .rpm only and links the AArch64 packages and the AppImages to 6.3.3's release, where the latest-release links would break; it adds the unit's first start securing a new installation, the stored-secrets key, database TLS and --check-database, event scripts in QuickJS, SNMP, and the new server verbs. Running in a Container adds HM_DB_TLS_MODE and HM_DB_TLS_CA, the key the container's --create-database makes and how to export it, and that the secure defaults are applied there only by hand; Before You Install gains the service account, the secure defaults, database TLS, MySQL's utf8mb4 floor and where the exported key is kept. Security Hardening rewrites the least-privilege section for the installer's account and the retired ServiceAccountName, and adds secrets at rest, the JScript escaping fix (every release from 6.0.0 to 6.3.3, what it exposed and what closes it) and the database connection, with checklist rows for each. Monitoring and Health adds the SNMP agent, off and answering nobody until a manager is listed, with no COM property or Control Panel page. Backup and Restore adds the restore that lists an archive and refuses an unsafe one whole (HM7540), 7-Zip 26.03, the stored-secrets key that no backup carries, messages in an object store, and the account stores counted at 6.3.4. Encryption and Certificates adds what a new installation starts with, the database's TLS modes, certificates for IP addresses on Linux and what the server keeps encrypted at rest, mailbox encryption at rest off on every account. Troubleshooting gains the rows an operator of 6.3.4 will meet: the sign-in refused before STARTTLS, the self-signed certificate, the unverifiable 6.3.4 offered to a live update, and HM7460, HM7463, HM7494, HM7495, HM7530, HM7531 and HM7540.

Christopher Holloway committed Sep 26, 2026

The operator pages that name GitHub because the code or the packaging still does now say, beside each such fact, that moving it off GitHub is planned roadmap work and not yet done, as the reference pages already do. Installing hMailServer says that only GitHub Actions can issue the signing identity the update verifier pins, so no later release can carry it, and that the package-manager manifests and their workflow are to move; Installing on Linux says it of the PKGBUILD, whose source is git+ its url and whose url is still github.com/Progressiverobot/hmailserver at master 540347500, of the default release feed, and of the image on ghcr.io; Running in a Container of the image and of the ghcr.io names in the Compose file and the chart (docker-compose.yml and values.yaml at master); the Control Panel Reference of the default feed and the About view's compiled-in GitHub link (AboutView.cs); and Troubleshooting, Upgrading hMailServer and the Control Deck's Update view of the default feed (UpdateChecker.cpp's STABLE_FEED and PRERELEASE_FEED).

Christopher Holloway committed Sep 24, 2026

What the adversarial check of the wiki's catch-up found, put right. The REST API's route counts left out the settings groups: RestApiSettings.cpp writes /api/v1/settings and its named groups into the OpenAPI document from its group tables, so no path literal shows them, and the document names 146 paths and 219 operations in 6.3.3 and 417 and 588 at master 540347500, not the 137 and 202 and 404 and 563 the literals alone give; the landing page, The REST API, the APIs Reference and Capabilities and Configuration now say so. The landing page counted 53 pages and listed none of the eight new ones: it counts 61, lists all eight where the sidebar has them, says fifteen pages carry a Source of truth note rather than eight, and names the eight among the guides. A documentation error was said to become an issue with the documentation label, which neither the Default template nor a visitor can set; the sidebar, the footer and the landing page ask for an issue naming the page. Regulatory Scope's table linked Changes Since 6.2.10 as [[Page|Page]], which GitLab splits at the pipe. Capabilities and Configuration placed the 6.3.3 version stamp at 3233b0cc4; it is still 6.3.3 build 42 at 540347500. The Webmail counted Greek, Korean and European Portuguese among what the tree adds, when 6.3.3's twenty already had them; Connecting a Mail Client listed S/MIME in the page as new, which it has been since 6.3.2, where the new thing is a domain's S/MIME authority; Changes Since 6.2.10's collection sweep read 87 calls, six fixed and 84 others, which is three loops and three members; the COM page said every class now carries ISupportErrorInfo, where the checker holds every class that raises an error. And the wiki's own pages stop saying that GitHub's CI runs: Encryption for People's GnuPG proof, the Linux builds on the ARM runner and with both compilers, the translation-unit census, the Compose file and the chart, the settings-index generator, the ini-coverage checker, the account-stores checker and the C++ CodeQL job ran there until 18 September 2026 and are run by hand, or not at all, since. The APIs Reference's server states gain 5, Draining.

Christopher Holloway committed Sep 24, 2026

Running in a Container and Connecting a Mail Client said the opposite of the tree after 6.3.3, and now say what it does. The container page called configuration from the environment a roadmap row and warned that a changed HM_REST_* variable is ignored after the first start; since 23 September every [Settings] key and every database setting has an environment name (HM_SETTING_<key>, HM_PROPERTY_<name>, and _FILE forms for a secret), the entrypoint stores them with --apply-environment at every start, the environment wins and an administrator's change to a setting it names is refused, and HM_PROFILE applies a setting profile once. The page says which generation 6.3.3's image is, that none of this has yet been run in a container, and that GHCR belongs to the GitHub organisation while GitLab's registry holds no image, with the steps to build the image from the release's .deb in the meantime. The mail-client page said CardDAV serves one address book, CalDAV one calendar per account, and that iMIP and free-busy are not there; the tree serves every book an account can see (its own, shared ones and the organisation's directory), several calendars shared with accounts, groups and delegates, invitations by mail filed on delivery, and free-busy within the domain. It also says that passkeys and single sign-on reach the webmail and the Deck and not a mail client.

Christopher Holloway committed Sep 24, 2026

The wiki describes the tree after 6.3.3 as it lands on master: the settings store, the audit trail and alerts, what a domain does to a message, remote-domain policy, a backup that carries everything, and the rest of three batches Twenty-seven pages, each written from the code at 3233b0cc4 and then checked sentence by sentence against it by a second reader: 166 claims verified, 23 corrected before this commit. Everything the tree holds that no release has is labelled as in the tree after 6.3.3 and not yet released, and the next release is called that rather than given a number. The changes page carries the four schema steps 6042 to 6045 in section 2, the second and third batches in section 4e beside the first, the gate for 3233b0cc4 (2,410 tests, 2,402 passed, none failed, 8 skipped; the Linux figures are a placeholder until that run lands), and in section 5 the changes an upgrade makes with no switch - above all that the database is the settings store, that an edit to [Settings] in hMailServer.ini is undone at the next start and reported as HM5804, what to do instead, and that the password pepper stays in the file and out of every backup, so a restore onto new hardware needs it brought along. Fourteen pages that told a reader to edit the file now say how the same setting is changed once the store lands, and what an edit to the file does then; the settings reference says the table of INI keys is closed. The feature pages cover the backup that carries every per-account store, the audit trail and alerts with what each does not yet record or raise, syslog export, per-domain reports, remote-domain policy and mandatory TLS, SPF as RFC 7208, hmctl's configuration document, the tours, and the REST routes counted at the commit rather than guessed at. The checking found things the tree itself gets wrong, which are recorded for the next batch rather than papered over here: hmctl's configuration document has an empty ini section because it reads a route that answers names only; the packaged Linux ini's RestApiPort=0 is adopted into the store at first start, so the packaging README's edit-the-file way of turning the REST listener on no longer works; the OpenAPI text for the ini routes and the note the server writes into hMailServer.ini still describe the file as the store; and five repository documents say what their wiki copies said before this commit.

chrisholloway5 committed Sep 15, 2026

Four pages catch up with what is in the tree since 6.3.3 and with what shipped in it. The client page gains a CalDAV section beside the CardDAV one, written the way the CardDAV section is: the same listener, the same discovery and the same credentials, one calendar per account at /dav/calendars/<address>/calendar/ made the first time it is asked for, VEVENT and VTODO in the one collection so a phone's calendar and its reminders are the same thing, a repeating event expanded by the server across daylight saving in any of the 592 zone names the new iCalendar module knows, and calendar-query, multiget and sync-collection with ETags. It says what is not there too, because a calendar that silently drops an invitation is worse than one that never offered: no iMIP, no free-busy, no per-calendar time zone, no partial calendar-data, and no time-range filter on an alarm. The webmail paragraph loses a label that went stale the moment 6.3.3 was published - it said "6.3.3, unreleased" of what is now the current release - and gains the twelve features that followed it, each in the reader's terms rather than the roadmap's: the page installed as an app with its unread badge, contacts in and out, saved searches as folders, the reader's own time zone, undo on three more actions, the tracker notice counting what it kept out, swipe actions and snooze presets, three stars that every IMAP client sees as keywords, rows coloured by a rule, @mentions that add the person to the recipients, a formatted signature, and Report phishing beside Junk. The container page gains the two files people expect and this repository now ships. The Compose section says that the file is in the tree, that a workflow resolves it with docker compose config on every change - so it is a file known to parse rather than an example in a document - and how it differs from the page's own shortest-thing-that-starts version: the two passwords are Compose secrets read from files, and the REST certificate is mounted in. Then a Kubernetes section: a StatefulSet of one, because a message store is not something two pods may share, the three volumes as claim templates, the database pointed at and never bundled with the chart refusing to render without a host, the two passwords as a Secret the chart makes or an existing one it is pointed at, the REST listener needing a kubernetes.io/tls Secret because off loopback the server requires TLS, a LoadBalancer with externalTrafficPolicy Local so the server sees the client's address, and probes on port 25 as the image's own health check is. It ends with how the chart is proven, since neither Helm nor Docker is on the bench that gates the code: linted, rendered with a real install's values, and checked for its two refusals, on every change. The REST page gains wave J's routes with the unreleased label: the account groups as a resource (a listing, a create, a read, a rename, a delete, and the members beneath a group as their own small collection, because a membership is a pair and not a property of either side), a message copied into another folder of its account, and the rule-criterion probe that answers what the delivery path would decide without reading or writing anything. And the fuzzing page is re-copied from the repository document it declares as its source of truth, which now carries the nightly job: the three harnesses every night on a hosted runner, the corpus kept in the Actions cache under a key that carries the run id so it grows, and the crash, hang or violated invariant that fails the job and lands the reproducer as an artifact.

chrisholloway5 committed Sep 15, 2026

The container page no longer says the base release is the only one the package installs on: Boost is linked statically since 11 September, so the .deb installs on later releases too; the image stays on the release it was built for

chrisholloway5 committed Sep 11, 2026

Running in a Container: the image, the variables the entrypoint writes, reaching the API, a Compose first start, volumes and ports, upgrading, backups, auto-ban from the host, and how the image is proven; linked from the sidebar, the index and the Linux page, labelled as published with 6.3.2

chrisholloway5 committed Sep 11, 2026