v2.4.3

A patch release of the 2.4 stable line. Upgrade promptly if you use a passdb nologin field: before 2.4.3 an account disabled that way still logged in (#2229, see Security). It also brings the JMAP write path, OAuth2 parity work, and a set of fixes for rolling a backend without losing its users.

Before you upgrade

These change what an existing configuration or rollout does. Read them first.

• Submission names itself submission (#2240, #2241). It used to send smtp to the auth service, the name Postfix uses. Auth logs, the policy server and the auth cache key now see submission for our Submission and smtp for Postfix. A SQL rule on %s (#2238) that meant our Submission must test submission. During the rollout from 2.4.2, Submission logins fail wherever an old and a new component meet, either way round, for the length of the backend StatefulSet rollout (minutes); IMAP, POP3, ManageSieve and JMAP are not affected.
• fts-flatcurve is a reserved folder name on mdbox and sdbox (#2254). It joins the default mailbox_list_reserved_segments; a folder of that name can no longer be created there. It is the full-text index directory a store converted from the reference keeps inside a mailbox; it is never listed.
• Pull the new image onto the backend nodes before helm upgrade, and keep room for one more backend pod. A backend pod is stopped before its replacement is created; the image pull is downtime for that pod's users unless the image is already on the node. See DEPLOYMENT, "Upgrading the backend StatefulSet".

Security

• A passdb nologin was ignored (#2229). The auth service sends a passdb's fields as key=value; the client only recognised a bare nologin, so an account disabled through the passdb logged in over IMAP, POP3, Submission and JMAP Basic. Fixed.

New

• JMAP write path (#2214–#2221). Email/set (create, update keywords and mailboxes, destroy), Email/import, blob upload, Mailbox/set; every mutation runs through one storage-side layer that keeps FTS, quota and conversation records in step. The smoketest round-trips through a JMAP client library.
• JMAP Bearer through the auth service (#2230). JMAP tokens take the same oauth2_* settings, OAuth2 passdb, penalties, policy and nologin as the other protocols.
• OAuth2 parity (#2242, #2251). The password grant (oauth2_grant_url) for plaintext logins, operator-provided local keys (oauth2_local_keys), forced introspection (oauth2_force_introspection), a per-entry CA (oauth2_tls_ca), and a rate limit on JWKS refreshes for unknown key ids (oauth2_jwks_unknown_kid_interval_seconds). Of the 29-row compatibility matrix (#2231), 22 rows were checked live against Keycloak on the stand, row 4 once against Google tokeninfo (#2252), rows 2–3 on a test server, rows 10 and 14 skipped with the reason recorded; the rest are covered by tests.
• SQL query variables (#2238). %s (protocol), %r (client address) and %l (local address) in passdb and userdb queries, so one account can be refused one protocol and keep the others.

Fixed

• Backend rollout and failover (#2255, #2259, #2260, #2262, #2263). A removed backend's users and domains are dropped on every director and move to a live backend on their next login; a removed backend can no longer come back from a peer's handshake, a snapshot, a late heartbeat or a gossiped placement. The login's re-route keeps a share of its deadline. A session token opens one session and survives a backend that died before its greeting, so the retry succeeds. A stopping backend refuses new sessions. VERIFY and CONSUME are bounded at 5 s and redial on a silent connection. The login log names why a session was kicked.
• File index (#2265). A fold could write log records into the cached base image every handle of a folder reads.
• Converted mdbox stores (#2253, #2254). A map whose base is gone is read from its log chain from the start of the history; a store without it is refused rather than read short. The reference's FTS index directory inside a mailbox is no longer listed or written into.
• mdbox (#2234, #2236). The map lock is held from the file choice through the map append; the storage rebuild repoints map records to their bytes and remaps folder records by GUID.
• OAuth2 introspection mode auth is a GET (#2246), as in the reference. An IdP that refused a POST there used to fail every introspection.
• Auth (#2247–#2250). Temporary failures reach the client as unavailable, with the protocol's response code; a refused bearer token is not tried against SQL; ManageSieve offers OAUTHBEARER/XOAUTH2; JWKS key rotation is not blocked by an unknown key id.
• FTS (#2257). A message expunged while indexed no longer flags its folder for a heal.
• IMAP (#2222). $ resolves in FETCH, STORE, COPY, MOVE and UID EXPUNGE. POP3 (#2213). Deletion runs the FTS and quota hooks. JMAP (#2223). Email/changes is judged per Email.

Operations

• SECURITY.md names the supported versions; no bounty program (#2204).
• Module updates and all four fork pins (#2202).
• The README, the Docker Hub overview and the Helm chart link yarilomail.org; the chart carries keywords for every protocol (#2205, #2206).