- Install .debs via apt-get install instead of dpkg+fix-broken
- Package hashes are now keyed by (arch, codename, pkg):
- download.delta.chat uploads now go to dovecot/{distro}/{version}/
- GitHub release packages get a _{distro}.deb suffix to allow for
combined releases.
Tests:
- updated to support this and add a test to check for the unsupported
release version case
- fix make_host to accept extra args from Command fact
- assert single apt-get install command
Deploy filtermail.mtail program along delivered_mail.mtail, fetched from
upstream; for this, refactor download_executable to accept mode, so we
can use it to upload non-binaries.
refactor: make hashes (for uniformity) and mtail version (for use by
mtail deployer) module constants.
Additionally, gate both mtail programs on mtail_address being set.
turns out Python has the nice https://pypi.org/project/lupa/
that allows us to quite easily test dovecot LUA parts
without figuring out errors on deploy.
The previous blurb still called Madmail an experimental Maddy fork.
That applied to v1. v2 is a Rust rewrite that ships SMTP, IMAP,
encryption enforcement, and real-time services in a single binary.
- The hardcoded root@relaydomain address was unusued/unrooted
and no one knew about it, it was used nowhere.
Better to use privacy_mail which operators can set
which might eventually be shown in the UI's relay list.
- remove generic useless mail_server_comment string.
Clients receive these values as IMAP METADATA /shared/admin and
/shared/comment only for internal debugging/info purposes.
It looks like the reason it exists in the default configuration
is an example for <https://www.postfix.org/FILTER_README.html>
Using this filter requires configuration such as
"-o content_filter=filter:dummy" and we don't have it.
Default behavior is processing headers
that are actually part of the message body.
This is unlikely to be needed
as headers such as Received are not added into MIME parts,
but may result in broken DKIM signatures
if the body is modified.
## 0.7.1 - 2026-06-09
### Bug Fixes
- Switch ratelimiter to MonotonicClock
- *(smtp-server)* Correct error when EOF while reading DATA
- *(resolver)* Disable negative caching
- Ignore CNAME records when resolving TXT records
### Features
- Switch to aws-lc-rs cryptography provider
### Miscellaneous Tasks
- Add filtermail.mtail so filtermail failures can be monitored
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
Previously used colors caused
diagrams to be unreadable in
light mode.
Removing styling completely,
as this was redundant anyway.
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
The original crypt library was last supported in Python 3.12, so it's
not needed until Python 3.13 is default (Trixie)
> The crypt_r module is a renamed copy of the crypt module as it was present in Python 3.12 before it was removed.
Adds a detailed diagram describing
all paths a message can take,
that takes into account postfix services.
Additionally, adds OpenDKIM to dependency
diagram.
Fixes: #771
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
Co-authored-by: missytake <missytake@systemli.org>
This will remove all headers possible during LMTP delivery, except:
- From: required or core does not process the message correctly.
Also required for cleartext compatibility.
- Message-Id: required for clients to know which messages have been
downloaded
- Chat-Is-Post-Message: is required for our attachment previews
- Content-Type: required
- For Cleartext compability: To, CC, In-Reply-To, References, Subject,
and Date
- For Chatmail future expansion, allow Chat-*
- Permit the entire Secure-Join* namespace
Co-authored-by: holger krekel <holger@merlinux.eu>
## 0.7.0 - 2026-05-26
### Bug Fixes
- Do not crash if accepting new connection fails
### Documentation
- *(readme)* Remove docs for options removed in da9a116
### Features
- [**breaking**] Remove passthrough options that allowed unencrypted mail to pass
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
With "default" (like it was for SMTP) or not set (like it was for IMAP),
both TLS and STARTTLS are tried.
Trying STARTTLS against TLS port is going to timeout
because in STARTTLS server talks first,
but when connected to TLS port the server
waits for TLS client hello and does not send anything.
Should not actually matter in tests which connect successfully
on the first try because implicit TLS is tried first.
j4n
holger krekel
adbenitezandholger krekel
KamyarATandholger krekel
missytakeandGitHub
link2xt
W0rmsyandGitHub
Jagoda Estera ŚlązakandGitHub
HocuriandGitHub
Jagoda Ślązakandmissytake
feldandGitHub
Mark Felder