History

Home: the Secrets at Rest row says who makes the stored-secrets key as SecretsAtRest.md at the tag v6.3.4 (51e2dbda0) does, "Who makes it": an elevated step, never the service, and an upgrade gets none by itself; the key is then exported and imported on every other node that shares the database. The row said "a stored-secrets key the installation makes, exports and carries to every node", which reads as though every installation made the key, and exported and carried it, by itself. GitLab issue #25.

Christopher Holloway committed Sep 27, 2026

Seven features 6.3.4 added have a page of their own, each a copy of its repository document as the tag v6.3.4 (51e2dbda0) has it, headed by the Source of truth note the other copies carry (GitLab issue #25): The SNMP Agent (Snmp.md), Event Scripts (EventScripts.md: the JavaScript engine of the Linux builds, and the contract for all three languages), Secure Defaults (SecureDefaults.md), The Service Account (ServiceAccount.md), Secrets at Rest (SecretsAtRest.md), Database TLS (DatabaseTls.md) and The Update Feed (UpdateFeed.md). A link to a document the wiki copies became a wiki link - Command Line, Third-Party Binaries, Warm Standby, High Availability Runbook, Upgrading Guide and The Service Account, the last two to their sections - and every other became a link to the document at v6.3.4. Each note says where the tag has moved on from its document. The installer smoke test SecureDefaults.md expects on a branch is in the tree at the tag, and does not yet make the checks it lists. ServiceAccountName and ServiceAccountPassword, which ServiceAccount.md calls no longer read, are still loaded by the settings loader (IniFileSettings.cpp:457-458) and used by nothing. The site that UpdateFeed.md's opening note calls not yet deployed has served the feed over HTTPS since 26 September 2026, and at 05:31 UTC on 27 September answered /releases/latest and /releases.json with 6.3.4 and /download/hMailServer-x64.exe with a 302 to 6.3.4's installer. The sidebar and the landing page list each page in its group: Database TLS, Secure Defaults, The Service Account and Secrets at Rest under Secure it; The SNMP Agent and The Update Feed under Operate it; Event Scripts under Extend it. The landing page counts 72 pages (the 74 files less the sidebar and the footer), the other 71, and twenty-two with a Source of truth note; the guides stay 38, since a copy is a repository document. The Runbooks Digest names the seven among the copies. Monitoring and Health, The COM API and Scripting, Security Hardening, Encryption and Certificates, Migrating the Database Backend and Upgrading hMailServer keep what they say of each feature, and gain a line pointing to its page. Every page was rendered with GitLab's Markdown API in the project's context on 27 September 2026: every wiki link, relative link, anchor and link into the repository, at master and at v6.3.4, resolves, and nothing on the new pages is HTML that could be stripped. The one finding, a link to Sigstore's cosign on GitHub from Installing hMailServer, is that project's own page and predates this change.

Christopher Holloway committed Sep 27, 2026

APIs-Reference: the security.txt row and the code-only note cite WebServicesServer.cpp by function at the tag v6.3.4 (51e2dbda0) - the route at 716-717, HandleSecurityTxt_ at 1245, the constants at 85-89, HandleWellKnownDavRedirect_ at 1521, HandleAppleProfile_ at 2058 - where they gave lines of the page's original base commit (891-895, 1154-1243, 50-54; 891-918, 1245-1347, 1658-1802). GitLab issue #26.

Christopher Holloway committed Sep 27, 2026

The wiki is brought up to the published release: 6.3.4 is the signed tag v6.3.4 at 51e2dbda0, published on GitLab on 27 September 2026 (02:37:56 UTC), not 8adce850a of 26 September, where the tag was first made and whose release gate failed. Every page that named 8adce850a as the tag or the release names 51e2dbda0, and every page that dated the release 26 September dates it 27 September: the footer, the sidebar, the page headers, the landing page's Current release, the release timeline's row and picture, section 4e's heading. Each fact those pages took from 8adce850a was checked at 51e2dbda0: the commits between the two change 42 files, whose only documents are CHANGELOG.md, BrandLogos.md, OpenPGP.md and SecretsAtRest.md, none of which a page copies, and which include none of Constants.h, Version.h, formMain.cs, the create scripts, IniFileSettings.cpp, SettingsDefaults.h, the IDL, the Control Panel or .gitlab/allowed_signers, so every file and line cited at the tag holds. Where a page said it read the tag on 26 September, it says it read 8adce850a and that what it read is the same at the tag. The suite has 3,811 [Test] attributes at the tag, not 3,809 (the fixes add two tests); twelve places say so. Changes Since 6.2.10 gains, in batch 40, what the release gate found and the eleven fixes: three change tests alone; of the other eight, three fix what 6.3.3 did too - a relay that refused the OAuth2 login got the server's token into the bounce and the logs (open since 6.2.22-pre1), a rule's forward, copy, reply or notice and an account's forwarding could wait a minute in the queue, and IMAP LIST and LSUB took a literal's length for the pattern - and five fix code new in 6.3.4 (sealed mail and an unnamed part, a closed key's FETCH refusal logged as a critical error, the help desk's password reset read as bytes, the logo and key-directory holds, an alert's encoded Subject over 76 characters). The gate table and the timeline give the re-run on 51e2dbda0 as the logs have it: 2,349 on the first bench (2,252 passed, 0 failed, 97 skipped) and 1,462 on the second (1,446 passed, 0 failed, 16 skipped), the 71 live-update tests elevated, all passed, and the Linux suite on the packaged binary, 2,013 tests, 1,562 passed, 0 failed, 451 skipped (results/b40full3 on linix); the database upgrade gates, the security scans, the fuzzers and the installer smoke test, 65 of 65. The JScript flaw is CVE-2026-100741 (CVSS 3.1 9.8), and the project's issue #43 is public: Security Hardening 17.11, the scripting page, the changes, the capabilities and the API reference name them. The project's download links work (the site has served HTTPS since 26 September; on 27 September they led to 6.3.4's files), so Installing on Linux and Running in a Container no longer say they work once it does. The copies of SECURITY.md and CONTRIBUTING.md give the day GitLab published the release, and the security policy's copy counts the 455 findings .gitlab/security-exceptions.yml accepts at the tag - the 169 of the SAST triage and the 286 that held the release scan - where the repository document still says 169; each header says where the copy differs. Three places said no pipeline had run on the fixed tree; one has, the schedule of 27 September 2026 on master 6bc09509d, which ran the update feed's pages and package-repos jobs alone, and they say so.

Christopher Holloway committed Sep 27, 2026

Home: the Control Deck does not lack the eight properties DeckParity.md lists as missing. The census finds 458 of the 466 properties the desktop program writes; the eight it misses, an account's directory fields, are written by PUT /api/v1/accounts/{address}/directory (RestApiDirectory.cpp at the tag v6.3.4, 8adce850a) and edited on the directory card of the Deck's account editor (WebAdmin/index.html), under names the census does not match, as APIs Reference already says.

Christopher Holloway committed Sep 26, 2026

What the check of 2e1d40e against the tag v6.3.4 (8adce850a) found, put right. Changes Since 6.2.10, section 4e, named the seven High findings of GitLab's SAST as .gitlab/security-exceptions.yml at the tag does not: the seven are the crash-dump helper's dbghelp.dll, the Control Panel's elevated restart, DBSetupQuick handing DBUpdater the password on its command line (two), the backup index parser (two) and a MIME parser test that compared pointers into two arrays; the MySQL client's DLL search, the installer's command line and the %FILE% scanner path were found beside them. The audit item said an app password could change the account's keys; it could replace the own S/MIME key and publish an OpenPGP key, and a support session could change any of them or switch zero access off (CHANGELOG 6.3.4). Release Process: the note at step 9 said no pipeline had run the scans on the project's own runners; the first pipeline, on master 40c7d3e0c, ran dependency-scan, static-analysis and semgrep, which failed as they may without failing the pipeline, and semgrep-sast came in batch40. The note at step 12 said a tree lands on master by fast-forward with no merge request; that is so up to 6.3.4, and from the first landing after it a batch lands through an approved merge request (ContinuousIntegration.md, "Landing on master"). Installing hMailServer: the administrator password "may hold any character" and HM_ADMIN_PASSWORD "takes any character" were wider than the tag, which refuses a password holding U+0000 and whose /adminpassword switch drops a double quote; they now say what the variable carries. Control Panel Reference: the tag adds no page, text or index entry but rewrites one text, the one that explains ProtectStoredSecretsWithDPAPI, in every catalogue. Settings Reference: no passkey is taken while a relying party is set without PasskeyAllowedOrigins, not "until then". Regression Test Environment: the header says this copy gives the [Test] count where the document says roughly 2,000.

Christopher Holloway committed Sep 26, 2026

The wiki is brought up to the release itself, the signed tag v6.3.4 at 8adce850a: what it said of 6.3.4 had been read from master 92b8f9f63, which the tag's last batch, batch40, follows. Schema 6104, not 6103: 6.3.4 is sixty-four steps from 6.3.3's 6040, the last, 6103 to 6104, adding hm_fetchaccounts.faorigin (Constants.h:1224, formMain.cs:314 and the three create scripts at the tag); every header, table, count and diagram that gave 6103 as 6.3.4's schema says 6104, the upgrade table's step counts are each one more, the step tables gain the 6104 row, and where 6103 means the secrets-at-rest step it stays. No page calls 92b8f9f63 the release or the tree 6.3.4 was cut from any more: a page checked against it says so and that the tag adds a last batch, and a page that copies a repository document the tag leaves as it was says the document is the same at the tag. The copies of repository documents batch40 changes are brought up to the tag, hunk by hunk from the version each copy had reached, their own additions kept: Security Policy (the SSH-signed sums of a release made by hand and the two commands that check a download, an SBOM for every compiled file, a release held by its security scans, secrets refused before they are pushed; its note no longer says the document calls 6.3.3 the latest), Release Process (A release made by hand, the security gate, the SBOM jobs), Upgrading Guide (the installer's HM_ADMIN_PASSWORD, the named lock on MySQL and MariaDB, the probe that stops an upgrade on too old a server at 6041 and the repair of a half-done one), Contributing, Governance (rebuilt on the tag's document, which gives the GitLab roles the owner set on 26 September 2026; the map and the note on code-signing material kept), Assurance Case, Regulatory Scope, Third-Party Binaries, Fuzzing, Migrating the Database Backend and Regression Test Environment. The installer's password handling as the tag has it: the password page is skipped for HM_ADMIN_PASSWORD as for /adminpassword, the database step hands the password (or the live update's token, as token:<hex>) to DBSetupQuick and DBSetup in HM_ADMIN_PASSWORD and DBSetupQuick to DBUpdater the same way, never on a command line, the switch table has the variable, and the unattended upgrade takes either (Installing hMailServer, Upgrading hMailServer 18.4a). How to verify a download: 6.3.4's hmailserver-6.3.4-SHA256SUMS.txt and its .sig, checked with ssh-keygen -Y verify against .gitlab/allowed_signers and sha256sum -c, as SECURITY.md at the tag gives them, and each installer's and package's own SBOM (Installing hMailServer 4.1, Installing on Linux, Upgrading hMailServer 18.4 and 18.4c, home, Release Process, Project Handbook, Troubleshooting, Glossary, Assurance Case, Regulatory Scope). The /download/ links no longer wait on issue #30: the feed's site has had its certificate since 26 September 2026. Changes Since 6.2.10 gains batch 40 in section 4e (the audit before the release, GitLab's SAST and the release gate, the installer's password, the SBOMs and signed sums, the stable download links, the release chain and landing through merge requests, what the first pipeline found, Windows on ARM compiled), items 47 to 51 in section 5 (reserved domain names, a one-time code taken once, the outbound relay's OAuth2 token over TLS only, the fetchers and schema 6104, a pre-6.3.4 hash of a password above U+00FF refused), SQLOLEDB in item 38, the 6041 probe in item 36, and the installer's own PBKDF2 in item 39. Also what the tag makes false elsewhere: the suite has 3,809 [Test] attributes, not 3,698; hmailserver/docs holds 105 documents; Windows on ARM compiles and has never run, where it was "not built"; IMAP offers STARTTLS only before sign-in and TLS and COMPRESS=DEFLATE only after sign-in (Capabilities and Configuration); a parent-domain passkey relying party needs passkey_allowed_origins (Sign-in and Identity); the Settings Reference counts 193 hm_settings rows with PasskeyAllowedOrigins and WebPushLoopbackHttpForTests; and the Linux suite's CI job first ran in the pipeline of 26 September 2026 rather than never.

Christopher Holloway committed Sep 26, 2026

Home: how to follow releases. GitLab serves the releases as an Atom feed, https://gitlab.com/Progressiverobot/hmailserver/-/releases.atom (200, application/atom+xml on 26 September 2026), and a signed-in user can have an email for each one from the bell on the project page, Custom, New release. No page said so; the README gains the same line under "Where things are".

Christopher Holloway committed Sep 26, 2026

What the check of the batch40 wiki pass found, put right. The group signer was described from e3df8b5e6, before 396c01d4d moved the rule to the match: a certificate that names hmailserver/hmailserver, or its repository, is refused without the project's id whatever UpdateSigningIdentity, UpdateSigningIssuer and UpdateSourceRepository say, `-` included. Security Policy lacked SECURITY.md's "whatever its update settings say"; the Settings Reference said `-` switches the repository check off with no exception and cited the older lines, now SigstoreVerifier.cpp at 396c01d4d; and the Settings Reference, Upgrading and the 6.3.4 changes now carry UpdateFeed.md's warning that a server from 6.2.28 to 6.3.3, which checks no id, is never to have the three settings pointed at the group's path and is upgraded by hand after the move. From ci-hyg, which is now committed: Contributing says the two machines take no job for a push that changes only Markdown at the root or under .gitlab/, and its header no longer says the repository document names the renovate schedule by a variable; Security Policy replaces "Nothing scans pushes to GitLab yet" with the secret_detection job and the one scan of the whole history. Governance said Christopher Holloway alone holds the project's administration, where GitLab listed all three members - Progressiverobot, zainulabidin1990 and chrisholloway5 - as Owner on 26 September 2026 (GET projects/86730559/members/all); it says so, and that lowering those roles is the owner's decision.

Christopher Holloway committed Sep 26, 2026

Fuzzing and Contributing: the fuzz and Renovate schedules are chosen by their description, not a variable. The project refuses pipeline variables and GitLab counts a schedule's as pipeline variables, so a schedule carrying HM_PIPELINE=fuzz or RUN_RENOVATE=1 would not be saved, and a pipeline on master cannot be started by hand with one either; batch40's CI branch (ci-hyg) selects linux-fuzz and renovate by CI_PIPELINE_SCHEDULE_DESCRIPTION, `fuzz` and `renovate`. Contributing also said a v* tag's release job is a placeholder; the release jobs for 6.3.5 onwards are written and have not run. The repository's CONTRIBUTING.md still says both, and the header says this copy differs there.

Christopher Holloway committed Sep 26, 2026

Glossary: the Sigstore entry names the group path the live update trusts beside the project's present one, as the update pages do since the last commit: a 6.3.4 server trusts the GitLab pipeline at Progressiverobot/hmailserver and at hmailserver/hmailserver, the group the project is to move to, where the certificate must carry the project's id.

Christopher Holloway committed Sep 26, 2026

The wiki is brought up to the tree batch40 will contain: the branches ns-verifier, gl-project, gov, ci-hyg and tf, read from the repository on 26 September 2026. The copies of repository documents take the changes batch40 makes to them - CONTRIBUTING, SECURITY, RELEASE, GOVERNANCE, ASSURANCE-CASE, Fuzzing, RegulatoryScope, ThirdPartyBinaries and RegressionEnvironment - each header saying so. The seven links into /-/blob/master/.github/ point at .gitlab/allowed_signers, .gitlab/hmailserver.openvex.json, or name the GitHub workflow as being in the git history at v6.3.3, since .github/ is gone from the tree; the verify-tag commands read .gitlab/allowed_signers. What the sweep made false is put right: the PKGBUILD builds from the tag on GitLab; the Compose file and the chart name registry.gitlab.com/progressiverobot/hmailserver, a registry that is switched on and holds no image yet; OpenSSL's release archive comes from Debian's archive against its pinned hash; linuxdeploy is no longer downloaded; the build-inputs-1 files come from the package registry; the manifests name the installer's file there. The live update's third signer, the group hmailserver the project is to move to, with the project's id required, is on the update and security pages, the Settings Reference and the changes for 6.3.4, with the three GitLab settings that keep a server to the present path. Governance names Zain Ul Abidin as zainulabidin1990 on GitLab and gives the owner's rule that release tags are created by the Progressiverobot account alone. The /download/ links at updates.progressiverobot.com are given beside the permalinks, labelled as working once that site serves HTTPS (issue #30; it still failed at 05:16). Contributing gains a section of its own on the issue and merge-request templates, the Service Desk, the two boards and the labels as they are on GitLab.

Christopher Holloway committed Sep 26, 2026

The Project Handbook's link to Release Process was broken across two lines, [[Release at the end of one and Process]] at the start of the next, and GitLab rendered it as a link to a page called Release, a newline and Process, which does not exist. The link is on one line now. Every page was rendered with GitLab's Markdown API in the project's context on 26 September 2026: this was the one link that did not resolve. Every other wiki link, relative link, image, table and #anchor resolves, the 145 Mermaid diagrams parse with Mermaid 10 and 11, and no HTML is stripped.

Christopher Holloway committed Sep 26, 2026

What the check of the merged wiki found, put right. The landing page counted 61 pages, 34 guides and 'the other 60', and listed none of the four pages written for 6.3.4: it counts 65, 38 and 64, and Message Storage, Compliance and eDiscovery, Rooms and Equipment and Mail In to a Webhook have their rows where the sidebar groups them. Twelve sentences named the next release as 6.3.5; each now says the releases after 6.3.4, since nothing after 6.3.4 has a number yet. Installing on Linux said the AppImages began in 6.3.2, where the GitLab releases of 6.3.0 and 6.3.1 carry both of them. Capabilities and Configuration gave 23 per-account tables as today's count, where AccountStores.cpp declares 62 in 6.3.4, 24 carried and 38 exceptions; the old figures stay, labelled with 3233b0cc4. The Settings Reference counted 26 bootstrap keys, where build/ini-settings-baseline.txt has 29. And Stopping Spam said the quarantine digest needs its domain's switch and hour, when an account may hold a value of its own for both (EffectiveSetting.cpp, QuarantineDigestTask.cpp).

Christopher Holloway committed Sep 26, 2026

The wiki is brought up to the tree 6.3.4 is cut from, 92b8f9f63, from three branches written on disjoint pages and each checked against the code: the reference pages, the figures and the release notes (wiki634-refs); the operator pages and the eighteen copies of repository documents (wiki634-ops); and the feature pages, with four new ones for compliance and eDiscovery, message storage, rooms and equipment, and mail in to a webhook (wiki634-features). What the wiki called the tree after 6.3.3, not yet released, is 6.3.4's, the latest release, published on 26 September 2026 at schema 6103.

Christopher Holloway committed Sep 26, 2026

What the check of the wiki's 6.3.4 pages found, read against 92b8f9f63: the compiled-in security.txt Policy URL has named SECURITY.md on GitLab since commit 9660893f1, so the APIs Reference no longer says it points at GitHub and that moving it is not done; the Runbooks Digest no longer says .github/SECURITY.md exists. No job on the project's own runners had run when 6.3.4 was made, and the fuzz job waits for the owner's schedule, so the home page, the gate table, the CI entry and the capabilities page say the Linux suite and the fuzzing are defined there and were run by hand, and the old nightly-fuzzing entry says it stopped with the GitHub account. DeckParity's census reads 586 routes, 258 of them writes, in 6.3.4, not 553 and 243. Roles cover 27 permissions, not 24. A backup carries an account's own stores, not everything an account has: passkeys, shares, recoverable and expiring mail, IMAP annotations and the out-of-office memory stay out, as AccountStores.cpp says. --decompress goes with --compress-store; the PST reader reports codes 7550 to 7553, and the administrator copies the file in; a spam trap bans the connecting address and blocks the envelope sender; a shaping wait spares retries only while the message is within its retry schedule; the quarantine digest is off until a domain or an account turns it on. /Register no longer uses ServiceAccountName and ServiceAccountPassword, which are still read rather than retired, and under the virtual account an administrator downloads the installer from the release page and checks its Authenticode signature rather than running the copy the server downloaded. Settings Reference section 17 counts its server-written rows as seven, and three labels that still said 'in the tree' say 6.3.4. The one piped wiki link whose text differed from its page becomes a plain Markdown link.

Christopher Holloway committed Sep 26, 2026

The reference pages, the figures and the release notes now describe 6.3.4, the latest release, published on 26 September 2026 at schema 6103, read from 92b8f9f63, the tree it was cut from. What the pages called the tree after 6.3.3, not yet released, is in 6.3.4 and is labelled so, and what landed after master 540347500 is added as 6.3.4's. Changes Since 6.2.10 gains 6.3.4 as a release: its row in the timeline and the picture, its gate size (3,698 tests), the seven schema steps 6097 to 6103 with what each script does, the four steps that deserve planning (6101 on hm_messages and 6102, which rebuilds every MySQL and MariaDB table, beside 6025 and 6030), the upgrading note, section 4e retitled as New in 6.3.4 with a new part for batches 34 to 39 - eDiscovery, storage compression and de-duplication, mailbox encryption at rest, mail in to a webhook, rooms and equipment, utf8mb4, secrets at rest, the JScript escaping fix, event scripts on Linux in QuickJS, PST import and its reader process, SNMP, secure defaults and the service account, database TLS, object storage, the update feed off GitHub and the Updates folders, address erasure, the scan fixes and 7-Zip 26.03, the IMAP fixes, the webmail at 100,000 messages, the load generator, Windows on ARM and the CI on the project's own runners, each with its schema step, its commits and its repository document - and eleven more behaviour changes without a switch (items 36 to 46). Windows on ARM, the published numbers and the webmail's timings are said to be written, empty and unmeasured, as they are. The landing page and the footer stamp 6.3.4 as the latest release; the figures are recounted from 92b8f9f63: 65 Control Panel pages, 441 OpenAPI paths and 621 operations, 40 Deck views and DeckParity.md's 458 of 466, 3,698 [Test] attributes. The download line says 6.3.4 has x86-64 packages only and points the AArch64 packages and the AppImage at 6.3.3's release, and the PKGBUILD's GitHub source is named for what it is. The APIs Reference and The REST API gain the 24 paths added after 540347500 (nine for eDiscovery, seven for the inbound webhooks, four for mailbox encryption at rest, the booking policy, the store's two and the webmail's bulk action) and the routes that answer differently; The COM API and Scripting gains Settings.MessageStoreCompression, MessageStoreDedupMinKB, MessageStoreStatus and Account.Kind, what a COM change to a shared configuration object now does (a copy, in effect at Save(), commit 15cfff25d), the JScript escaping fix of 5a3de9001 and what an administrator with a JScript EventHandlers.js must do (a rule's Run function name a plain identifier), and event scripts on Linux in JavaScript, with what a handler cannot reach. Settings Overview and Settings Reference gain the 27 hm_settings rows of 6.3.4 (191 in all), [Database] TlsMode and TlsCaFile, [Security] StoredSecretsKey and the sealed secrets, and ServiceAccountName no longer used by /Register. Ports Reference gains the SNMP agent, the secure defaults a new installation's listeners get, and the outbound connections 6.3.4 adds. Upgrading hMailServer gains 18.4c: every server installs 6.3.4 by hand, since it carries no Sigstore bundle; the UpdateFeedUrl line for 6.2.28 to 6.3.3; the slow steps and what 6102 needs; what an upgrade keeps. Capabilities and Configuration, the Glossary (eDiscovery and legal hold, object store, sealed secret, stored-secrets key and the rest) and the Runbooks Digest (the nineteen new documents) are brought up to the same tree.

Christopher Holloway committed Sep 26, 2026

What the check of the wiki's 6.3.4 pages found: the backup page counted 60 per-account tables in the AccountStores declaration where it names 62 (24 carried and 38 declared exceptions), and called the booking answers and the booking queue the two exceptions added in 6.3.4 when they are the last two, added with rooms and equipment on 25 September 2026. Several pages said GitLab CI's jobs build, compile, lint, scan or run the suites, when ContinuousIntegration.md records that no GitLab job had run yet when it was written on 25 September 2026; the Linux page, the container page, the regression environment's header, the project handbook, the regulatory scope's Annex I table and the security policy's table now say the jobs are written and not yet run. And the installer page said the secure defaults' failure is shown in a message box on the built-in database's branch only, when the installer shows it on both branches and only logs an exit 5 after DBSetup, a database it attached.

Christopher Holloway committed Sep 26, 2026

What the check of the wiki's 6.3.4 pages found: the Control Deck's Update row named the next release by number, and now says the releases after 6.3.4 are to be signed by the project's GitLab CI once its signing job exists; the Control Panel reference said GitLab CI signs the releases after 6.3.3, which 6.3.4, unsigned, is not; the restart row counted 26 bootstrap keys where build/ini-settings-baseline.txt now has 29, [Database] TlsMode and TlsCaFile and [Security] StoredSecretsKey added; the stored-secrets key is made by the Windows installer alone, and the Linux packages need the verb as an upgrade does; the sandbox's shipped types include shortcuts, disk images and PDFs; the object store's fixture needs a lab store and skips without one, rather than running against the lab as a matter of course; PasswordPepper is the one setting the virtual service account refuses to save; a shaping wait spares a message's retries only until it outlives its retry schedule; and the database connection's new TLS is MySQL's, MariaDB's and SQL Server's, unverified unless TlsMode asks, PostgreSQL's being unchanged.

Christopher Holloway committed Sep 26, 2026

The operator pages describe 6.3.4, the release of 26 September 2026 at schema 6103, as the installer script, the Linux unit and the repository documents at master 92b8f9f63 have it. What they labelled as in the tree after 6.3.3 and not yet released is labelled as 6.3.4's, and what landed after 540347500 is added where an operator meets it. Installing hMailServer walks the installer as it now runs: the server profile and service account pages, a new installation's service on NT SERVICE\hMailServer granted its folders by /GrantServiceAccess and moved only once that succeeds, the administrator password written as PBKDF2 by the server rather than as MD5 by the installer, the secure defaults (a self-signed certificate, STARTTLS on the four seeded listeners, TLS required for authentication on the Internet range) and the stored-secrets key made for a database the installation created, and an upgrade that keeps its account, listeners and ranges. It says 6.3.4 carries an Authenticode signature and no Sigstore bundle, so no server's live update installs it and every server is upgraded by hand, how to check the signature, and which feed and signers a server trusts. Installing on Linux says 6.3.4 carries the x86-64 .deb and .rpm only and links the AArch64 packages and the AppImages to 6.3.3's release, where the latest-release links would break; it adds the unit's first start securing a new installation, the stored-secrets key, database TLS and --check-database, event scripts in QuickJS, SNMP, and the new server verbs. Running in a Container adds HM_DB_TLS_MODE and HM_DB_TLS_CA, the key the container's --create-database makes and how to export it, and that the secure defaults are applied there only by hand; Before You Install gains the service account, the secure defaults, database TLS, MySQL's utf8mb4 floor and where the exported key is kept. Security Hardening rewrites the least-privilege section for the installer's account and the retired ServiceAccountName, and adds secrets at rest, the JScript escaping fix (every release from 6.0.0 to 6.3.3, what it exposed and what closes it) and the database connection, with checklist rows for each. Monitoring and Health adds the SNMP agent, off and answering nobody until a manager is listed, with no COM property or Control Panel page. Backup and Restore adds the restore that lists an archive and refuses an unsafe one whole (HM7540), 7-Zip 26.03, the stored-secrets key that no backup carries, messages in an object store, and the account stores counted at 6.3.4. Encryption and Certificates adds what a new installation starts with, the database's TLS modes, certificates for IP addresses on Linux and what the server keeps encrypted at rest, mailbox encryption at rest off on every account. Troubleshooting gains the rows an operator of 6.3.4 will meet: the sign-in refused before STARTTLS, the self-signed certificate, the unverifiable 6.3.4 offered to a live update, and HM7460, HM7463, HM7494, HM7495, HM7530, HM7531 and HM7540.

Christopher Holloway committed Sep 26, 2026

The feature pages now describe 6.3.4, the latest release (26 September 2026, schema 6103), built from the tree at 92b8f9f63. What they labelled as in the tree after 6.3.3 and not yet released is in 6.3.4 and says "since 6.3.4"; dates inside the release become the version; the sidebar names 6.3.4 as the latest release. What landed after 540347500 is added where a reader meets it. Connecting a Mail Client gains what 6.3.4 changed in IMAP's answers after Dovecot's imaptest (NO where BAD was wrong, \Seen on every BODY[section] without PEEK, APPEND stored byte for byte, a command pipelined behind APPEND answered, SORT and THREAD as the RFCs say, \Recent counted), what a new installation asks of a password (STARTTLS offered, TLS required for authentication from the Internet range, a self-signed certificate), rooms in CalDAV's room finder, and that a mailbox encrypted at rest takes its own password only. The Webmail gains a folder of a hundred thousand messages - one page copied, Oldest, a bounded search that goes on, select-all handed to the server - labelled built and not yet measured. Migration gains PST import: the import directory that is empty as shipped, what comes in and what is refused, and the reader in a child process, which is crash containment and not a sandbox. The Control Panel pages gain the Discovery page (65 pages), the Message store tab, the Windows service account card and what the virtual account refuses; the Control Deck page gains the Discovery and Inbound webhooks views (40), the twelve checklist items, the census of 466, 458 and 586 routes, and the update feed as it stands: 6.3.4 carries no Sigstore bundle and is installed by hand. The remaining pages gain the webhook route that outranks aliases and lists, a legal hold beside rules and Sieve, the Run function name rule, the three new permissions and the administrator password rehashed at sign-in. Four new pages give features with no wiki home one: Compliance and eDiscovery (cases, searches, holds, exports, and the erasure a hold outranks), Message Storage (compression and attachments held once, mailbox encryption at rest, object storage on S3 and Azure Blob, each off by default), Rooms and Equipment, and Mail In to a Webhook. Each is in the sidebar in its natural place, and every sidebar entry resolves to a page.

Christopher Holloway committed Sep 26, 2026

Three copies say, at the top, where the repository document they copy is behind the release: the contributing guide and the security policy still call 6.3.3 the latest release, and the assurance case points at the changelog's Unreleased section for the coverage figure, which is now under 6.3.4. The copied text is left as the repository has it.

Christopher Holloway committed Sep 26, 2026

The eighteen pages that copy repository documents are copied again from master 92b8f9f63, the 6.3.4 release, so they say what the repository says on the day 6.3.4 is published. Each was brought forward from the version it was last copied from, 540347500, hunk by hunk, and the wiki's own additions were kept where they are still true. What the documents gained: the stored-secrets key in the command line, the high-availability runbook and the warm standby, which now say that it is made once, exported and imported on the other node, and what a node without it does (HM7495); the service account, the COM rule that a change to an item of a shared collection is written onto a copy until Save(), and MySQL's utf8mb4 step in the upgrading guide; database TLS and utf8mb4 in the backend migration; the fuzz job moved from GitHub Actions to GitLab CI's linux-fuzz; the Windows and Linux suites on GitLab CI in the regression environment; the security policy's scans on the project's own runner and its questionnaire pointer; the contributing guide's CI checks; MessageStore and QuickJS in the architecture; a pre-release tag's suffix and the pinned .NET runtime in the release checklist; the update verifier's two signers in the assurance case. Third-Party Binaries follows a rewritten document: the tree commits no executable binary, and the sections this copy had added about where the forty committed binaries lived and their dispositions described the tree before 11 September 2026, so they are gone. Regulatory Scope's note loses four of the five things it called out of date, which the repository has corrected, and its own Annex I table now says the installer has been Authenticode-signed since 6.3.1, that 6.3.x is the supported line, and what a new installation's secure defaults are. The wiki's labels that said "in the tree after 6.3.3, not yet released" now say what is new in 6.3.4, and each header names 92b8f9f63. Where the repository text itself is now stale - the release checklist's and Regulatory Scope's statements that no release can be cut while the chain is on GitHub, the contributing guide and the security policy naming 6.3.3 as the latest release, the assurance case pointing at the changelog's Unreleased section - the copy keeps the repository's words and the header says so where a reader would be misled; 6.3.4 was built and Authenticode-signed by hand and carries no Sigstore bundle.

Christopher Holloway committed Sep 26, 2026

The operator pages that name GitHub because the code or the packaging still does now say, beside each such fact, that moving it off GitHub is planned roadmap work and not yet done, as the reference pages already do. Installing hMailServer says that only GitHub Actions can issue the signing identity the update verifier pins, so no later release can carry it, and that the package-manager manifests and their workflow are to move; Installing on Linux says it of the PKGBUILD, whose source is git+ its url and whose url is still github.com/Progressiverobot/hmailserver at master 540347500, of the default release feed, and of the image on ghcr.io; Running in a Container of the image and of the ghcr.io names in the Compose file and the chart (docker-compose.yml and values.yaml at master); the Control Panel Reference of the default feed and the About view's compiled-in GitHub link (AboutView.cs); and Troubleshooting, Upgrading hMailServer and the Control Deck's Update view of the default feed (UpdateChecker.cpp's STABLE_FEED and PRERELEASE_FEED).

Christopher Holloway committed Sep 24, 2026

The Control Deck's Update view is where a reader meets the release feed, and the page did not say that the default feed is GitHub's API, which has answered 404 since 18 September 2026; the row now says so, and that the check fails until UpdateFeedUrl names another feed, pointing to Upgrading hMailServer 18.7.

Christopher Holloway committed Sep 24, 2026

What the adversarial check of the wiki's catch-up found, put right. The REST API's route counts left out the settings groups: RestApiSettings.cpp writes /api/v1/settings and its named groups into the OpenAPI document from its group tables, so no path literal shows them, and the document names 146 paths and 219 operations in 6.3.3 and 417 and 588 at master 540347500, not the 137 and 202 and 404 and 563 the literals alone give; the landing page, The REST API, the APIs Reference and Capabilities and Configuration now say so. The landing page counted 53 pages and listed none of the eight new ones: it counts 61, lists all eight where the sidebar has them, says fifteen pages carry a Source of truth note rather than eight, and names the eight among the guides. A documentation error was said to become an issue with the documentation label, which neither the Default template nor a visitor can set; the sidebar, the footer and the landing page ask for an issue naming the page. Regulatory Scope's table linked Changes Since 6.2.10 as [[Page|Page]], which GitLab splits at the pipe. Capabilities and Configuration placed the 6.3.3 version stamp at 3233b0cc4; it is still 6.3.3 build 42 at 540347500. The Webmail counted Greek, Korean and European Portuguese among what the tree adds, when 6.3.3's twenty already had them; Connecting a Mail Client listed S/MIME in the page as new, which it has been since 6.3.2, where the new thing is a domain's S/MIME authority; Changes Since 6.2.10's collection sweep read 87 calls, six fixed and 84 others, which is three loops and three members; the COM page said every class now carries ISupportErrorInfo, where the checker holds every class that raises an error. And the wiki's own pages stop saying that GitHub's CI runs: Encryption for People's GnuPG proof, the Linux builds on the ARM runner and with both compilers, the translation-unit census, the Compose file and the chart, the settings-index generator, the ini-coverage checker, the account-stores checker and the C++ CodeQL job ran there until 18 September 2026 and are run by hand, or not at all, since. The APIs Reference's server states gain 5, Draining.

Christopher Holloway committed Sep 24, 2026

Fuzzing and Third-Party Binaries each say, where the section describing a GitHub workflow begins, that the workflow has not run since 18 September 2026, so a reader who lands on that section does not take the nightly fuzzing job or the binary provenance check for something that runs. Fuzzing names what still runs, the release checklist's timed run on the release source (step 8c), as SECURITY.md at master 540347500 does; Third-Party Binaries points to its header note, which says get-installer-binaries.ps1 checks the fetched files against the JSON.

Christopher Holloway committed Sep 24, 2026

The Project Handbook's disclosure line says what SECURITY.md says: GitLab is a CVE Numbering Authority for public projects hosted on GitLab.com, not for every project there.

Christopher Holloway committed Sep 24, 2026

The record pages stop saying that GitHub's checks run. Changes Since 6.2.10 gains one note that a check said to run in style.yml, in CI or elsewhere under .github/workflows/ ran there when the change landed and is run by hand now, and the entries that still read as current - the C++ server compiled on a GitHub-hosted runner, CodeQL on pull requests and weekly, the checker "run by style.yml" - are put in the past tense; the contributing guide it names is the root CONTRIBUTING.md, which was .github/CONTRIBUTING.md until 24 September. The Runbooks Digest gets the banner the Project Handbook has: its .github/ paths are the tree of 4 and 8 September, the three community files are at the root, and the workflows do not run on GitLab. Capabilities and Configuration says the same of the workflow list and the two checkers it places in CI. The copied Regulatory Scope and Third-Party Binaries keep their repository text and say in their header notes what it overstates: the source and releases are on GitLab, the provenance check, CodeQL and Scorecard do not run for now, the update feed and the release-workflow identity are GitHub's and moving them is planned roadmap work, and the build-inputs-1 release is unreachable while GitHub is, with get-installer-binaries.ps1 checking the fetched files against the JSON by hand.

Christopher Holloway committed Sep 24, 2026

The reference pages that name GitHub because the code still does now say, beside each such fact, that GitHub is unavailable and that moving it off GitHub is planned roadmap work, not yet done. The update check's default feed is api.github.com and has answered 404 since 18 September 2026 (Settings Reference, Settings Overview, The REST API, APIs Reference); the three signing-trust defaults name GitHub's release workflow and token service, which only GitHub Actions can issue, so no release after 6.3.3 can carry that identity (Settings Reference, Settings Overview, the Glossary's Sigstore row); and the Policy URL compiled into the served security.txt is a GitHub address (APIs Reference). Each was checked against master 540347500: UpdateChecker.cpp's STABLE_FEED and PRERELEASE_FEED, SigstoreVerifier.cpp's three constants and WebServicesServer.cpp's policy URL are still GitHub's. The Glossary's CodeQL row is put in the past tense and says nothing runs it on GitLab yet.

Christopher Holloway committed Sep 24, 2026