aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFiles
* interimap, pullimap: Ensure DB and statefiles are created with mode 0600.Guilhem Moulin2022-02-235
| | | | | | | It wasn't the case for interimap(1), see https://bugs.debian.org/608604 … Fortunately we create $XDG_DATA_HOME/interimap with a secure mode, but there is no reason to have the DB world-readable. Since we can't rely on SQLITE_OPEN_CREATE for secure mode we use sysopen(,,O_CREAT,0600).
* Document how to install without root privileges.Guilhem Moulin2022-02-232
| | | | | And make location for systemd user unit files configurable with systemd_userunitdir=.
* Fix minor space damage.Guilhem Moulin2022-02-231
|
* Makefile: Add target 'install-nodoc'.Guilhem Moulin2022-02-231
|
* Makefile: Replace shell test with $(if ,,).Guilhem Moulin2022-02-231
|
* Fix/improve doc/build.md.Guilhem Moulin2022-02-232
| | | | | | Update instructions/documentation obsolete since a1c089b997ebf705a9023b4f0f97327e5bd2814e and 733ed91162b02cd0fa5d7d1c443c780d3d4405e9.
* `make clean`: Also remove test keys and certificates.Guilhem Moulin2022-02-231
|
* Makefile: Add target 'installcheck' for post-install tests.Guilhem Moulin2022-02-231
|
* Makefile: Rename 'test' target to 'check'.Guilhem Moulin2022-02-232
| | | | Per convention, cf. https://www.gnu.org/prep/standards/html_node/Standard-Targets.html .
* Makefile: Add target 'all-nodoc'.Guilhem Moulin2022-02-231
| | | | This is useful for Debian packages built under ‘nodoc’ profile.
* Don't assume Net::IMAP::InterIMAP is always in @INC.Guilhem Moulin2022-02-238
| | | | | | | | | And make the installation path configurable at `make` time. Moreover, adjust the 'test' target so the site directory and interimap/pullimap path are configurable with INTERIMAP_I and INTERIMAP_PATH respectively. That way one can run `tests/run foo` to check the source, `make test` to check what's been built, and we also have the possibility to check the installed program e.g. for autopkgtests.
* Add https://guilhem.org/interimap/ documentation to .service files.Guilhem Moulin2022-02-233
|
* Don't hardcode $(bindir) in .service files.Guilhem Moulin2022-02-234
|
* Makefile: Honor builddir=.Guilhem Moulin2022-02-232
| | | | | Defaulting to ‘build’. Also, remove BUILD_DOCDIR= (replaced with ‘$(builddir)/doc’).
* Makefile: Ignore errors when installing manual pages.Guilhem Moulin2022-02-231
| | | | Per https://www.gnu.org/prep/standards/html_node/Standard-Targets.html#Standard-Targets .
* Makefile: Improve DESTDIR= handling.Guilhem Moulin2022-02-231
| | | | Per https://www.gnu.org/prep/standards/html_node/DESTDIR.html .
* Makefile: Honor INSTALL_PROGRAM and INSTALL_DATA.Guilhem Moulin2022-02-221
| | | | Cf. https://www.gnu.org/prep/standards/html_node/Command-Variables.html .
* Makefile: Honor srcdir=.Guilhem Moulin2022-02-221
| | | | Cf. https://www.gnu.org/prep/standards/html_node/Directory-Variables.html .
* Tests: Dovecot: Bump min protocol level to TLSv1.2.Guilhem Moulin2022-02-211
| | | | | And use security level 2 for ssl_cipher_list. As of dovecot 2.3.18 ssl_min_protocol defaults to TLSv1.2.
* Tests: TLS ciphers/protocols: Downgrade security level to 0.Guilhem Moulin2022-02-212
| | | | | | This is required to test TLS version <1.2 on systems with higher security levels, see SSL_CTX_set_security_level(3ssl). Addapted from a patch from <xnox> for Unbuntu.
* Improve message for unknown untagged UIDNEXT response.Guilhem Moulin2021-02-221
| | | | | | | | | | | | | | | | | Per RFC3501 §6.3.1 and §6.3.2 ‘UIDNEXT’ must be returned in an OK untagged response. See also Appendix B#34. However §6.3.1 suggests that it's in fact optional: “If this is missing, the client can not make any assumptions about the next unique identifier value.” A correction was proposed in Errata ID 3445 https://www.rfc-editor.org/errata/eid3445 , and rejected on the ground that clients SHOULD support the implement default behavior for missing data. We heavily rely on the ‘UIDNEXT’ presence and won't implement a workaround for its absence; instead we panic() with a more informative message.
* Prepare new release v0.5.6.v0.5.6Guilhem Moulin2021-01-014
|
* doc/template.html: remove type attribute from <style/> element.Guilhem Moulin2021-01-012
|
* Bump required Net::SSLeay version to 1.86_06.Guilhem Moulin2021-01-013
| | | | | | | | | | | That's when get_version() was introduced. Unfortunately the manual doesn't mention it, but 1.85 is lacking the function, see https://github.com/radiator-software/p5-net-ssleay/blob/1.88/Changes#L216 https://github.com/radiator-software/p5-net-ssleay/commit/ae33bb5405dadde973bc25a0c5e3941d5c83f8b1 Compatibility with Net::SSLeay 1.83 can be restored by reverting this commit and 35f4ecefa9c9ff55acfdb337b215e3d13345c86d.
* Prepare new release v0.5.5.v0.5.5Guilhem Moulin2020-12-264
|
* typofixGuilhem Moulin2020-12-171
|
* libinterimap: new option SSL_ciphersuites to set the TLSv1.3 ciphersuites.Guilhem Moulin2020-12-179
| | | | | Also, clarify that SSL_cipherlist only applies to TLSv1.2 and below. See SSL_CTX_set_cipher_list(3ssl).
* manuals: Clarify that known TLS protocol versions depend on the OpenSSL ↵Guilhem Moulin2020-12-173
| | | | version used.
* test suite: use stock OpenSSL config except for tests/tls-protocols.Guilhem Moulin2020-12-174
| | | | | It's best to use a stock (clean) environment when possible. We only need to test TLS protocol version <1.2 for tests/tls-protocols.
* typofixGuilhem Moulin2020-12-132
|
* Remove obsolete Changelog entry.Guilhem Moulin2020-12-131
|
* manual: improve wording.Guilhem Moulin2020-12-132
|
* libinterimap: _start_ssl() now fails immediately with OpenSSL <1.1.0.Guilhem Moulin2020-12-132
| | | | | | | It could in principle still work with earlier versions if the new settings SSL_protocol_{min,max} are not used, however it's cumbersome to do individual checks for specific settings, let alone maintain test coverage with multiple OpenSSL versions.
* libinterimap: use default locations for trusted CA certificates when neither ↵Guilhem Moulin2020-12-138
| | | | | | | | | | | CAfile nor CApath are set. In particular, OpenSSL's default locations can be overridden by the SSL_CERT_FILE resp. SSL_CERT_DIR environment variables, see SSL_CTX_load_verify_locations(3ssl). This bumps the minimum OpenSSL version to 1.1.0 (when SSL_verify is used).
* test suite: ensure we haven't started speaking IMAP when the SSL/TLS ↵Guilhem Moulin2020-12-134
| | | | | | handshake is aborted. (Unless STARTTLS is used to upgrade the connection.)
* typofixGuilhem Moulin2020-12-132
|
* Explicitly set SSL_verify=1 (default) only once.Guilhem Moulin2020-12-131
|
* Make error messages more uniform and consistent.Guilhem Moulin2020-12-135
|
* Fix broken URLs.Guilhem Moulin2020-12-131
|
* README: Reflow with tw=78.Guilhem Moulin2020-12-121
|
* README: suggest ControlPath=$XDG_RUNTIME_DIR/ssh-imap-%C for the SSH transportGuilhem Moulin2020-12-122
| | | | | | | Not a good idea to use a world-writable directory, see ssh_config(5)… Note that variable expansion is only available in OpenSSH 8.4 and later, cf. https://bugzilla.mindrot.org/show_bug.cgi?id=3140 .
* README: use 'restrict' option in authorized_keys(5) snippet.Guilhem Moulin2020-12-122
| | | | | | | | | | | | | This is shorter and more future-proof. Quoting the manual: restrict Enable all restrictions, i.e. disable port, agent and X11 forwarding, as well as disabling PTY allocation and execution of ~/.ssh/rc. If any future restriction capabilities are added to authorized_keys files they will be included in this set. Note that this won't work with Jessie's OpenSSH server.
* gitignore: Exclude aspell(1)'s backup copies.Guilhem Moulin2020-12-121
|
* typofix, spellingGuilhem Moulin2020-12-127
|
* `make release`: also bump libinterimap version and pin it in 'use' declarations.Guilhem Moulin2020-12-112
| | | | | Also, make use the tag doesn't exist, and fail early if we can't detect the version.
* documentation: simplify SSL options in the sample configuration files.Guilhem Moulin2020-12-113
|
* libinterimap: deprecate SSL_protocols and introduce SSL_protocol_{min,max}.Guilhem Moulin2020-12-116
| | | | | | | | Using the libssl interface simplifies our protocol black/whitelist greatly; this only allows simple min/max bounds, but holes are arguably not very useful here. Using the new settings bumps the required libssl version to 1.1.0.
* test suite: supply our own OpenSSL configuration file with MinProtocol=None.Guilhem Moulin2020-12-117
| | | | | | | | So we can test TLSv1 as well, not just TLSv1.2 and later. Also, explicitly set ssl_min_protocol=TLSv1 in the Dovecot configuration file (the default as of 2.3.11.3), hence running TLS tests now require Dovecot 2.3 or later.
* test suite: `mv tests/snippets tests/config`Guilhem Moulin2020-12-118
|
* libinterimap: use Net::SSLeay::get_version() to get the protocol version string.Guilhem Moulin2020-12-112
| | | | This avoids maintaing our own map.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 01:07:38 +0000