---
title: "hMailServer 6.2.28: the server can verify and apply its own updates"
url: https://www.hmailserver.co.uk/topic/28178/hmailserver-6.2.28-the-server-can-verify-and-apply-its-own-updates
author: "Progressiverobot"
published: 2026-09-08T07:30:02.000Z
updated: 2026-09-08T07:30:02.000Z
category: "Announcements & releases"
tags: ["release","upgrade","webmail","imap","api"]
site: hMailServer Community Forum
---

# hMailServer 6.2.28: the server can verify and apply its own updates

6.2.28 is the first release that can update itself. A scheduled task reads this project's release feed and the Status page reports what it found; fetching an installer and applying it are two further, equally opt-in steps. The upgrade to 6.2.28 itself is manual.

**What the upgrade involved**

No schema change: 6031, as 6.2.27. The installer's database upgrade has nothing to do on a 6.2.27 database.

Everything this release adds is off by default. `UpdateCheckEnabled`, `RestApiPort` (which the portal and the Control Deck need), `IMAPCompressionEnabled` and `HttpProxy` are all opt-in. A server upgraded without touching its settings behaves exactly as 6.2.27 did.

Known and unfixed: the Control Deck reads but does not write, and holds the administrator password in sessionStorage while it is open. The regression suite runs on Windows only.

**What is in it**

- **Updates.** `UpdateCheckEnabled=0` is the default and nothing happens until it is set: no request, no identifier, no counts. Turned on, the feed is read every `UpdateCheckHours` (24 by default). An installer is verified against its Sigstore bundle before it runs: the certificate chains to Fulcio, the identity and issuer are this project's release workflow, and the entry is in the public transparency log. These releases are not Authenticode-signed, so `UpdateRequireAuthenticode=1` refuses every one of them, and the Sigstore check cannot be turned off. `hMailServer.Updater.exe` stops the service, waits `UpdateServiceWaitSeconds` (180) for it to come back, and reinstalls the previous version if it does not.
- **Webmail.** `/portal` on the REST listener, with `/api/v1/me` behind it. It answers to the account's own credentials only: no administrator password, no API key. Read, send, search, attachments, the account's own quarantine, Sieve script and password change.
- **A real HTTP server.** The REST API and web services move off a single-threaded HTTP/1.0 loop onto HttpServer: HTTP/1.1 on Boost.Asio with keep-alive, chunked bodies, and header and body deadlines.
- **IMAP COMPRESS=DEFLATE (RFC 4978).** Advertised until compression is on and refused afterwards, as the RFC requires. STARTTLS is refused once a session is compressed.
- **`HttpProxy=host:port`** sends every web request the server makes as a client through a forward proxy. CONNECT for https, with the same certificate verification as a direct connection. No proxy credentials.
- **Fixed (GitHub issue 156).** A masked password in the Control Panel was typed backwards from the second character: 12345678 became 18765432. It hit IME commits and some keyboard layouts.

[Full release notes, checksums and signatures](https://www.progressiverobot.com/hmailserver-downloads/)