hMailServer 6.2.28: the server can verify and apply its own updates
-
6.2.28 is the first release that can update itself. A scheduled task reads this project's release feed and the Status page reports what it found; fetching an installer and applying it are two further, equally opt-in steps. The upgrade to 6.2.28 itself is manual.
What the upgrade involved
No schema change: 6031, as 6.2.27. The installer's database upgrade has nothing to do on a 6.2.27 database.
Everything this release adds is off by default.
UpdateCheckEnabled,RestApiPort(which the portal and the Control Deck need),IMAPCompressionEnabledandHttpProxyare all opt-in. A server upgraded without touching its settings behaves exactly as 6.2.27 did.Known and unfixed: the Control Deck reads but does not write, and holds the administrator password in sessionStorage while it is open. The regression suite runs on Windows only.
What is in it
- Updates.
UpdateCheckEnabled=0is the default and nothing happens until it is set: no request, no identifier, no counts. Turned on, the feed is read everyUpdateCheckHours(24 by default). An installer is verified against its Sigstore bundle before it runs: the certificate chains to Fulcio, the identity and issuer are this project's release workflow, and the entry is in the public transparency log. These releases are not Authenticode-signed, soUpdateRequireAuthenticode=1refuses every one of them, and the Sigstore check cannot be turned off.hMailServer.Updater.exestops the service, waitsUpdateServiceWaitSeconds(180) for it to come back, and reinstalls the previous version if it does not. - Webmail.
/portalon the REST listener, with/api/v1/mebehind it. It answers to the account's own credentials only: no administrator password, no API key. Read, send, search, attachments, the account's own quarantine, Sieve script and password change. - A real HTTP server. The REST API and web services move off a single-threaded HTTP/1.0 loop onto HttpServer: HTTP/1.1 on Boost.Asio with keep-alive, chunked bodies, and header and body deadlines.
- IMAP COMPRESS=DEFLATE (RFC 4978). Advertised until compression is on and refused afterwards, as the RFC requires. STARTTLS is refused once a session is compressed.
HttpProxy=host:portsends every web request the server makes as a client through a forward proxy. CONNECT for https, with the same certificate verification as a direct connection. No proxy credentials.- Fixed (#156). A masked password in the Control Panel was typed backwards from the second character: 12345678 became 18765432. It hit IME commits and some keyboard layouts.
- Updates.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login