History / Stopping Viruses

Six captions of the screenshots retaken from 6.3.7 say where a shot shows the capture server's own values rather than a fresh installation's: Settings Overview's ACME page has the switch off and the contact address and host-name boxes empty as on a fresh installation, while its directory URL box is empty only on that server (a fresh installation fills it with Let's Encrypt's, as the block above it shows) and its port reads 80, where the caption had every box empty "as on a fresh installation"; Stopping Viruses' Blocked attachments page counts the server's own patterns in its pill (a fresh installation seeds fourteen); Security Hardening's Auto-ban card has "Enable auto-ban" unticked on that server, where a fresh installation has it on, as the sentence above says; Monitoring and Health quotes the Diagnostics page's subtitle as the first of its two sentences and says what the second is about; Backup and Restore's caption has the Encryption section begin at the foot of the frame, as the alt text above says, with the buttons, the Scheduled backups card and its Retention section, and the Restore card below it; and Control Panel Pages' Advanced page names the wiki address that server carries as the project's first path and the one a fresh installation has. The check of the refresh found these on 19 October 2026; the shots are retaken on a fresh installation later, with the two left for the Control Panel's fixes. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 19, 2026

Encryption and Certificates, Security Hardening, Stopping Spam, Stopping Viruses and Ports Reference describe the screenshots retaken from 6.3.7, read from each image and from the Control Panel at master, where they described the 6.2.10-era captures and the groups of that build: TLS & certificates is Certificates & encryption, with Automatic certificates (ACME), TLS certificates and TLS versions & ciphers (tabs Protocol versions, Ciphers & verification and Session resumption), and the ACME page says its settings are stored in the database, where the text offered hMailServer.INI instead; Access & abuse protection is Sign-in & access, and Security Hardening embeds the Auto-ban page itself (cp-autoban.png) where the TLS page's capture stood in for it; the Control-Panel-only second factor is set up with the button on the Two-factor tab of Administrative access, the sign-in card no longer carrying a link; Server limits & expert settings opens on its Timeouts and queue bounds card, the front-end proxies being a card of Incoming relays; Spam & virus filtering is two groups, Spam filtering, whose Lists section holds Spam exemptions and Greylisting exemptions, and Virus scanning; DNS blacklists is DNS block lists (DNSBL), and the reject message is the Refusal text, the caption saying that the page was empty on the server it was captured on and that a fresh install has the two inactive rows; Blocked attachments replaces a matching attachment with a short note, where the text said it refused files, and lists file-name patterns; the DANE, DNSSEC and MTA-STS settings of Transport security are on its Encryption tab, ARC and the DKIM timestamps on Signing and the reports on Reports; and the TCP/IP ports page and dialog are described with their AUTH and Listening columns and the dialog's own labels - Bind address, Port, TLS certificate, SMTP authentication and Client certificate policy (mutual TLS) - with the Listening column, not Server status, saying which listeners are up. The sentence that opens the Anti-spam settings page in Stopping Spam is left as it was, with that page's earlier capture. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 19, 2026

Every page's header says whether 6.3.7 is reflected in it, and none calls 6.3.6 the latest release, where thirty-seven headers still said "6.3.6, the latest release (6 October 2026...". The guide and reference pages brought up on 5 October 2026 to 6.3.6 say so with its date and schema, and that 6.3.7, the latest release (17 October 2026, schema 6108), is not yet reflected on them: Aliases, Lists and Public Folders, the APIs Reference, Compliance and eDiscovery, Connecting a Mail Client, Control Panel Pages, the Control Panel Reference, DNS for Your Domain, Encryption and Certificates, Encryption for People, How Email Works, Mail In to a Webhook, Mailing Lists, Message Storage, Migration, Monitoring and Health, Outbound Shaping, the Ports Reference, Profiles and Environment, Rooms and Equipment, Routes and Relays, Rules and Sieve, the Runbooks Digest, Security Hardening, Settings Overview, Sign-in and Identity, Stopping Spam, Stopping Viruses, The Control Deck, The Control Panel, The REST API, The Webmail, Troubleshooting, What hMailServer Is and Is Not and Your First Domain and Mailbox. Backup and Restore says that 6.3.7 is reflected only in the release a failed full restore is made again on, Capabilities and Configuration only in the releases the release jobs have made, and the Settings Reference that its keys were last re-checked at v6.3.6, where its re-check of 5 October 2026 called v6.3.6 the latest release. The COM API and Scripting and the Glossary, whose headers said nothing of a release after 6.3.4, say that 6.3.7 is not yet reflected, the Glossary that its stamp names it; Version History to 6.2.10 that its history ends at 6.2.10 and what came after, up to 6.3.7, is in Changes Since 6.2.10; and the Project Handbook that its status note, and what sections 7, 8, 9 and 11 say of how a change lands, who can approve it, which runners run what and which releases the release jobs have made, are brought up to the tree at 6.3.7, the rest not yet, and that 6.3.7, published on 17 October 2026, was the first of the security releases that go on until 30 September 2027. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 18, 2026

The guide pages say what 6.3.6 changes in anti-spam, DANE and outbound TLS, backups and restores, calendars, sign-ins, the webmail, Sieve, the store commands and the auto-ban, and every page's header says whether 6.3.6 is reflected in it. Stopping Spam: the SURBL test as 6.3.6 runs it (every registrable domain up to 200, 256 names a list, sixteen lookups at a time, SurblTooManyDomainsScore, a list's error answers never a listing), the Sender MX test by the Public Suffix List, the two FQDN checks, the greylisting key of schema 6107, the sender lists' URL entries. Encryption and Certificates: What DANE actually does for 6.3.6 - DANE-TA, the indeterminate lookups, the validated MX RRset, a resolver that strips DNSSEC, the deferrals where mail bounced, and the log lines as the tag writes them. DNS for Your Domain: the indeterminate rule and the resolver requirement. Routes and Relays: the relayer's STARTTLS required refuses permanently, as it always did; a webhook route held to public addresses through HttpProxy. Mail In to a Webhook: the same. Backup and Restore: the Updates folder and a destination inside the data directory left out, the restore that copies in first and undoes a copy that fails, the full restore that failed on installations made new with 6.3.4 or 6.3.5, this installation's own self-signed pair kept, a message deleted while a backup copies. Rooms and Equipment: the organiser verified by the From address, and the send API believed for nobody. Encryption for People and The Webmail: the S/MIME certificates kept, the HTML view's images, OpenPGP's 32 MB, the attachments' types, the invitation card, days to keep. Connecting a Mail Client: a stored event changed only by a verified sender, the AUTH on port 25 that bans, FETCH's NO [LIMIT]. Sign-in and Identity: the pending sign-ins carried by the browser, sealed. Rules and Sieve: ManageSieve's deadlines and a session that ends. Message Storage: the store commands' link rule. Mailing Lists: every field of a posting removed. Security Hardening: the grant through a junction, who else on the computer may read the mail (/ProtectFolders), AutoBanMinutes for an AUTH on port 25, the checklist's row 12a. Migration: days to keep messages, as the repository's document gives it. Aliases, Lists and Public Folders, Compliance and eDiscovery, Control Panel Pages, Monitoring and Health, Outbound Shaping, Profiles and Environment, Stopping Viruses, What hMailServer Is and Is Not, Your First Domain and Mailbox and How Email Works: the header says that 6.3.5 and 6.3.6 are not yet reflected on the page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

Every link to the project points at its address in the group, gitlab.com/hmailserver/hmailserver, where it has been since 29 September 2026; the identities 6.3.5 was signed with, and the setting row that lists both paths, keep the path the project began at. The project's path in all 63 pages that linked it (548 links), 6.3.6 being the first release made at the group's path. Left as they were: the seven signing identities https://gitlab.com/Progressiverobot/hmailserver//.gitlab-ci.yml@refs/tags/v... (Release Process, Security Policy, The Update Feed, and the UpdateSigningIdentity row of Settings Reference), which name what 6.3.5 was signed as; and the UpdateSourceRepository row of Settings Reference, which lists both paths on purpose. The container registry's name is corrected with the container page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

The wiki is brought up to the published release: 6.3.4 is the signed tag v6.3.4 at 51e2dbda0, published on GitLab on 27 September 2026 (02:37:56 UTC), not 8adce850a of 26 September, where the tag was first made and whose release gate failed. Every page that named 8adce850a as the tag or the release names 51e2dbda0, and every page that dated the release 26 September dates it 27 September: the footer, the sidebar, the page headers, the landing page's Current release, the release timeline's row and picture, section 4e's heading. Each fact those pages took from 8adce850a was checked at 51e2dbda0: the commits between the two change 42 files, whose only documents are CHANGELOG.md, BrandLogos.md, OpenPGP.md and SecretsAtRest.md, none of which a page copies, and which include none of Constants.h, Version.h, formMain.cs, the create scripts, IniFileSettings.cpp, SettingsDefaults.h, the IDL, the Control Panel or .gitlab/allowed_signers, so every file and line cited at the tag holds. Where a page said it read the tag on 26 September, it says it read 8adce850a and that what it read is the same at the tag. The suite has 3,811 [Test] attributes at the tag, not 3,809 (the fixes add two tests); twelve places say so. Changes Since 6.2.10 gains, in batch 40, what the release gate found and the eleven fixes: three change tests alone; of the other eight, three fix what 6.3.3 did too - a relay that refused the OAuth2 login got the server's token into the bounce and the logs (open since 6.2.22-pre1), a rule's forward, copy, reply or notice and an account's forwarding could wait a minute in the queue, and IMAP LIST and LSUB took a literal's length for the pattern - and five fix code new in 6.3.4 (sealed mail and an unnamed part, a closed key's FETCH refusal logged as a critical error, the help desk's password reset read as bytes, the logo and key-directory holds, an alert's encoded Subject over 76 characters). The gate table and the timeline give the re-run on 51e2dbda0 as the logs have it: 2,349 on the first bench (2,252 passed, 0 failed, 97 skipped) and 1,462 on the second (1,446 passed, 0 failed, 16 skipped), the 71 live-update tests elevated, all passed, and the Linux suite on the packaged binary, 2,013 tests, 1,562 passed, 0 failed, 451 skipped (results/b40full3 on linix); the database upgrade gates, the security scans, the fuzzers and the installer smoke test, 65 of 65. The JScript flaw is CVE-2026-100741 (CVSS 3.1 9.8), and the project's issue #43 is public: Security Hardening 17.11, the scripting page, the changes, the capabilities and the API reference name them. The project's download links work (the site has served HTTPS since 26 September; on 27 September they led to 6.3.4's files), so Installing on Linux and Running in a Container no longer say they work once it does. The copies of SECURITY.md and CONTRIBUTING.md give the day GitLab published the release, and the security policy's copy counts the 455 findings .gitlab/security-exceptions.yml accepts at the tag - the 169 of the SAST triage and the 286 that held the release scan - where the repository document still says 169; each header says where the copy differs. Three places said no pipeline had run on the fixed tree; one has, the schedule of 27 September 2026 on master 6bc09509d, which ran the update feed's pages and package-repos jobs alone, and they say so.

Christopher Holloway committed Sep 27, 2026

The wiki is brought up to the release itself, the signed tag v6.3.4 at 8adce850a: what it said of 6.3.4 had been read from master 92b8f9f63, which the tag's last batch, batch40, follows. Schema 6104, not 6103: 6.3.4 is sixty-four steps from 6.3.3's 6040, the last, 6103 to 6104, adding hm_fetchaccounts.faorigin (Constants.h:1224, formMain.cs:314 and the three create scripts at the tag); every header, table, count and diagram that gave 6103 as 6.3.4's schema says 6104, the upgrade table's step counts are each one more, the step tables gain the 6104 row, and where 6103 means the secrets-at-rest step it stays. No page calls 92b8f9f63 the release or the tree 6.3.4 was cut from any more: a page checked against it says so and that the tag adds a last batch, and a page that copies a repository document the tag leaves as it was says the document is the same at the tag. The copies of repository documents batch40 changes are brought up to the tag, hunk by hunk from the version each copy had reached, their own additions kept: Security Policy (the SSH-signed sums of a release made by hand and the two commands that check a download, an SBOM for every compiled file, a release held by its security scans, secrets refused before they are pushed; its note no longer says the document calls 6.3.3 the latest), Release Process (A release made by hand, the security gate, the SBOM jobs), Upgrading Guide (the installer's HM_ADMIN_PASSWORD, the named lock on MySQL and MariaDB, the probe that stops an upgrade on too old a server at 6041 and the repair of a half-done one), Contributing, Governance (rebuilt on the tag's document, which gives the GitLab roles the owner set on 26 September 2026; the map and the note on code-signing material kept), Assurance Case, Regulatory Scope, Third-Party Binaries, Fuzzing, Migrating the Database Backend and Regression Test Environment. The installer's password handling as the tag has it: the password page is skipped for HM_ADMIN_PASSWORD as for /adminpassword, the database step hands the password (or the live update's token, as token:<hex>) to DBSetupQuick and DBSetup in HM_ADMIN_PASSWORD and DBSetupQuick to DBUpdater the same way, never on a command line, the switch table has the variable, and the unattended upgrade takes either (Installing hMailServer, Upgrading hMailServer 18.4a). How to verify a download: 6.3.4's hmailserver-6.3.4-SHA256SUMS.txt and its .sig, checked with ssh-keygen -Y verify against .gitlab/allowed_signers and sha256sum -c, as SECURITY.md at the tag gives them, and each installer's and package's own SBOM (Installing hMailServer 4.1, Installing on Linux, Upgrading hMailServer 18.4 and 18.4c, home, Release Process, Project Handbook, Troubleshooting, Glossary, Assurance Case, Regulatory Scope). The /download/ links no longer wait on issue #30: the feed's site has had its certificate since 26 September 2026. Changes Since 6.2.10 gains batch 40 in section 4e (the audit before the release, GitLab's SAST and the release gate, the installer's password, the SBOMs and signed sums, the stable download links, the release chain and landing through merge requests, what the first pipeline found, Windows on ARM compiled), items 47 to 51 in section 5 (reserved domain names, a one-time code taken once, the outbound relay's OAuth2 token over TLS only, the fetchers and schema 6104, a pre-6.3.4 hash of a password above U+00FF refused), SQLOLEDB in item 38, the 6041 probe in item 36, and the installer's own PBKDF2 in item 39. Also what the tag makes false elsewhere: the suite has 3,809 [Test] attributes, not 3,698; hmailserver/docs holds 105 documents; Windows on ARM compiles and has never run, where it was "not built"; IMAP offers STARTTLS only before sign-in and TLS and COMPRESS=DEFLATE only after sign-in (Capabilities and Configuration); a parent-domain passkey relying party needs passkey_allowed_origins (Sign-in and Identity); the Settings Reference counts 193 hm_settings rows with PasskeyAllowedOrigins and WebPushLoopbackHttpForTests; and the Linux suite's CI job first ran in the pipeline of 26 September 2026 rather than never.

Christopher Holloway committed Sep 26, 2026

What the check of the wiki's 6.3.4 pages found: the Control Deck's Update row named the next release by number, and now says the releases after 6.3.4 are to be signed by the project's GitLab CI once its signing job exists; the Control Panel reference said GitLab CI signs the releases after 6.3.3, which 6.3.4, unsigned, is not; the restart row counted 26 bootstrap keys where build/ini-settings-baseline.txt now has 29, [Database] TlsMode and TlsCaFile and [Security] StoredSecretsKey added; the stored-secrets key is made by the Windows installer alone, and the Linux packages need the verb as an upgrade does; the sandbox's shipped types include shortcuts, disk images and PDFs; the object store's fixture needs a lab store and skips without one, rather than running against the lab as a matter of course; PasswordPepper is the one setting the virtual service account refuses to save; a shaping wait spares a message's retries only until it outlives its retry schedule; and the database connection's new TLS is MySQL's, MariaDB's and SQL Server's, unverified unless TlsMode asks, PostgreSQL's being unchanged.

Christopher Holloway committed Sep 26, 2026

The feature pages now describe 6.3.4, the latest release (26 September 2026, schema 6103), built from the tree at 92b8f9f63. What they labelled as in the tree after 6.3.3 and not yet released is in 6.3.4 and says "since 6.3.4"; dates inside the release become the version; the sidebar names 6.3.4 as the latest release. What landed after 540347500 is added where a reader meets it. Connecting a Mail Client gains what 6.3.4 changed in IMAP's answers after Dovecot's imaptest (NO where BAD was wrong, \Seen on every BODY[section] without PEEK, APPEND stored byte for byte, a command pipelined behind APPEND answered, SORT and THREAD as the RFCs say, \Recent counted), what a new installation asks of a password (STARTTLS offered, TLS required for authentication from the Internet range, a self-signed certificate), rooms in CalDAV's room finder, and that a mailbox encrypted at rest takes its own password only. The Webmail gains a folder of a hundred thousand messages - one page copied, Oldest, a bounded search that goes on, select-all handed to the server - labelled built and not yet measured. Migration gains PST import: the import directory that is empty as shipped, what comes in and what is refused, and the reader in a child process, which is crash containment and not a sandbox. The Control Panel pages gain the Discovery page (65 pages), the Message store tab, the Windows service account card and what the virtual account refuses; the Control Deck page gains the Discovery and Inbound webhooks views (40), the twelve checklist items, the census of 466, 458 and 586 routes, and the update feed as it stands: 6.3.4 carries no Sigstore bundle and is installed by hand. The remaining pages gain the webhook route that outranks aliases and lists, a legal hold beside rules and Sieve, the Run function name rule, the three new permissions and the administrator password rehashed at sign-in. Four new pages give features with no wiki home one: Compliance and eDiscovery (cases, searches, holds, exports, and the erasure a hold outranks), Message Storage (compression and attachments held once, mailbox encryption at rest, object storage on S3 and Azure Blob, each off by default), Rooms and Equipment, and Mail In to a Webhook. Each is in the sidebar in its natural place, and every sidebar entry resolves to a page.

Christopher Holloway committed Sep 26, 2026

The five pages on securing the server are brought up to master 540347500, every addition labelled as in the tree after 6.3.3 and not yet released. DNS for Your Domain adds the DKIM rotation policy (it never edits DNS, it says what to publish and waits), the report mailbox through which the server reads the DMARC and TLS-RPT reports a domain receives, the openpgpkey host the Web Key Directory needs, and that BIMI is read for display and not published. Encryption and Certificates says it is about transport, points to the new Encryption for People page, notes which of its keys wait for a reinitialise now that a save applies, and gains section 9.6b on gateway encryption to a partner's OpenPGP key or certificate (the Subject is not hidden; refuse is the default fallback). Stopping Spam gains the hardened greylisting and its bypass list, the SMTP policy switches and the domain white and black list, the three-level allow and block lists with URL entries and the quarantine digest, the refusals each adds, and a section on impersonation protection, spam traps, country blocking and complaints. Stopping Viruses gains the sandbox, what the scanner and the attachment list do with a message sealed end to end, and the attachment conditions of the mail flow rules. Security Hardening gains passkeys, single sign-on, SCIM, account recovery, the breach check, devices and sessions, administrator roles, compromised-account detection, country blocking, verified send-as, masked addresses and restricted delivery, with checklist rows for them.

Christopher Holloway committed Sep 24, 2026

The wiki rewritten in depth: 141 diagrams drawn from the code, every reference page made exhaustive, and twenty-one defaults corrected that no page had ever stated The wiki was accurate after this morning's sweep and thin. This is the depth pass the owner asked for: every page read against the code again, every reference page completed, and a diagram wherever a diagram says it better than a paragraph. 141 Mermaid diagrams across 49 pages, each drawn from the handler rather than from memory: the SMTP submission sequence with the checks in the order ProtocolMAIL_ and ProtocolRCPT_ actually run them, the IMAP session state machine from the per-command authentication guards, the DMARC evaluation, the delivery pipeline and its retry arithmetic, the ACME renewal state machine, the spam decision from connection to delivery, the schema chain, the component and threading models of the whole server, the CI workflows and what each one gates, the release draft-sign-publish flow, and a map of the journeys through the wiki itself on the landing page. The reference pages are now exhaustive rather than representative: every route with its method, authentication, request and response shape and its error codes; every [Settings] key with its default, its effect and whether it needs a restart; every port with the key that opens it; every rule criterion and action; every Sieve extension the server advertises; every metric the listener exposes. Twenty-one facts were wrong or absent, and each is corrected against the code rather than adjusted. The ones that will save somebody an afternoon: IMAP SASL PLAIN and SCRAM are not advertised on a default install, which looks exactly like a client bug; SMTP AUTH PLAIN is off by default too; DMARC checking is on while SPF and DKIM as scored tests are off, and the DMARC test evaluates both itself regardless; the seeded DNSBL and SURBL servers are inactive; a new mailbox contains INBOX and nothing else, which is the real cause of the classic missing Sent folder; MTA-STS hosting and autoconfiguration default on while both web-service ports default to 0, so the shipped default is features on with nothing listening; and TLS-RPT and DMARC report sending are inert until their From address is set, with each completed day discarded unsent. Eleven screenshots are named as wanted, with what each should show. The existing images are from a 6.2.10-era build and the pages say so where it matters.

chrisholloway5 committed Sep 8, 2026

Every page read against the tree on 8 September 2026: the release and schema stamps (6.2.27, schema 6031, 2,124 tests), the routes, keys and pages that were missing, the listener paragraphs that were false, and the unreleased work labelled as such An audit of all 51 pages against master produced about 360 findings on 43 of them, applied here. The largest: the APIs reference lacked 47 routes and described the listeners as single-threaded HTTP/1.0 (they run on the Boost.Asio HTTP/1.1 server); the settings reference lacked the fourteen Update* keys and IMAPCompressionEnabled and counted 195 keys instead of 236; every "current release" stamp said 6.2.24; Changes Since 6.2.10 ended three releases and one schema step early; Architecture said the optional listeners were deliberately not Boost.Asio and built their own SSL contexts (neither is true); the upgrading pages still warned of a silent-upgrade hang fixed in 6.2.23; the Control Panel pages knew nothing of the seventeen languages, the Updates card or the stalled-mail page; and two pages did not render (a header inside a code block, CR and TAB bytes in file names). Anything in the tree but not in v6.2.27 - the live update, the self-service portal and /api/v1/me, the HttpServer listeners, IMAP COMPRESS=DEFLATE, the seventeen-language Control Panel, the Control Deck views - is documented and marked "in the tree after 6.2.27, not yet released". The Control Panel screenshots are still from a 6.2.10 build and the pages now say so.

chrisholloway5 committed Sep 8, 2026

The hMailServer 6.2.24 wiki: the corrected manual, the runbooks, and the references generated from the code

chrisholloway5 committed Sep 4, 2026