Commit message (Collapse) | Author | Age | Files | ||
---|---|---|---|---|---|
... | |||||
| * | test suite: supply our own OpenSSL configuration file with MinProtocol=None. | Guilhem Moulin | 2020-12-11 | 7 | |
| | | | | | | | | | | | | | | | | So we can test TLSv1 as well, not just TLSv1.2 and later. Also, explicitly set ssl_min_protocol=TLSv1 in the Dovecot configuration file (the default as of 2.3.11.3), hence running TLS tests now require Dovecot 2.3 or later. | ||||
| * | test suite: `mv tests/snippets tests/config` | Guilhem Moulin | 2020-12-11 | 8 | |
| | | |||||
| * | libinterimap: use Net::SSLeay::get_version() to get the protocol version string. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | | | | | | | This avoids maintaing our own map. | ||||
| * | libinterimap: make $OPENSSL_VERSION global. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | |||||
| * | libinterimap: remove default SSL_protocols value. | Guilhem Moulin | 2020-12-11 | 7 | |
| | | | | | | | | | | | | | | | | Namely, use the system default instead of "!SSLv2 !SSLv3 !TLSv1 !TLSv1.1". As of Debian Buster (OpenSSL 1.1.1) this does not make a difference, however using the system default provides better compatibility with future libssl versions. | ||||
| * | Remove incorrect affirmation from 0.5.4 changelog. | Guilhem Moulin | 2020-12-11 | 1 | |
| | | | | | | | | | | The test suite already required OpenSSL ≥1.1.1 as some tests are using TLSv1.3. | ||||
| * | manpages: improve wording. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | |||||
| * | typofix | Guilhem Moulin | 2020-12-11 | 1 | |
| | | |||||
| * | Update copyright years. | Guilhem Moulin | 2020-12-11 | 4 | |
| | | |||||
* | | Prepare new release.debian/0.5.4-1 | Guilhem Moulin | 2020-12-11 | 1 | |
| | | |||||
* | | d/salsa-ci.yml: run .test-reprotest with DEB_BUILD_OPTIONS=nocheck. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | |||||
* | | d/rules: Run test suite with TMPDIR=/var/tmp. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | | | | | | | | | | | Ssome systems (such as salsa's CI runners) mount /dev/shm with the 'noexec' option. /var/tmp is probably safer in that regard since it's what mkinitramfs(8) defaults to. | ||||
* | | Add debian/salsa-ci.yml file. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | |||||
* | | d/control: Point Vcs-* to salsa. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | |||||
* | | Bump minimum libnet-ssleay-perl version from 1.73 to 1.83. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | | | | | | | And alsa openssl to 1.1.1 in Build-Depends. | ||||
* | | Refresh patches and bump version number. | Guilhem Moulin | 2020-12-11 | 3 | |
| | | |||||
* | | Merge tag 'v0.5.4' into debian/latest | Guilhem Moulin | 2020-12-11 | 25 | |
|\| | | | | | | | Release version 0.5.4 | ||||
| * | Prepare new release v0.5.4.v0.5.4 | Guilhem Moulin | 2020-12-11 | 1 | |
| | | |||||
| * | Prepare new release v0.5.4. | Guilhem Moulin | 2020-12-11 | 3 | |
| | | |||||
| * | rename 'debian' branch to 'debian/latest' for DEP-14 compliance. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | |||||
| * | documentation: improve wording. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | |||||
| * | typofix | Guilhem Moulin | 2020-12-11 | 1 | |
| | | |||||
| * | Makefile: new 'release' target. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | | | | | | | Also, change the tag format from upstream/$VERSION to v$VERSION. | ||||
| * | libinterimap: add support for the TLS SNI (Server Name Indication) extension. | Guilhem Moulin | 2020-12-11 | 9 | |
| | | | | | | | | | | | | This is controlled by the new 'SSL_hostname' option. The default value of that option is the value of the 'host' option when it is hostname, and the empty string (which disables SNI) when it is an IP literal. | ||||
| * | typofix | Guilhem Moulin | 2020-12-11 | 1 | |
| | | |||||
| * | libinterimap: make SSL_verify check the hostname as well. | Guilhem Moulin | 2020-12-11 | 9 | |
| | | | | | | | | | | | | | | | | | | | | More precisely, ensure that the certificate Subject Alternative Name (SAN) or Subject CommonName (CN) matches the hostname or IP literal specified by the 'host' option. Previously it was only verifying the chain of trust. This bumps the minimum Net::SSLeay version to 1.83 and OpenSSL version 1.0.2. | ||||
| * | libinterimap: factor out hostname/IP parsing. | Guilhem Moulin | 2020-12-11 | 4 | |
| | | | | | | | | | | Also, document that enclosing 'host' value in square brackets forces its interpretation as an IP literal (hence skips name resolution). | ||||
| * | test suite: always generate new certificates on `make test`. | Guilhem Moulin | 2020-12-11 | 10 | |
| | | | | | | | | | | In addition, sign test certificates with the same root CA. Hence running `make test` now requires OpenSSL 1.1.1 or later. | ||||
| * | libinterimap: show the matching pinned SPKI in --debug mode. | Guilhem Moulin | 2020-12-11 | 5 | |
| | | |||||
| * | documentation: replace example.org with example.net for consistency. | Guilhem Moulin | 2020-12-10 | 3 | |
| | | |||||
| * | Fix broken URLs. | Guilhem Moulin | 2020-12-09 | 2 | |
| | | |||||
* | | d/gbp.conf: Update debian and upstream branches in compliance with DEP-14. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | |||||
* | | d/gbp.conf: Update upstream tag template. | Guilhem Moulin | 2020-12-11 | 3 | |
| | | |||||
* | | Add d/watch pointing to the upstream repository. | Guilhem Moulin | 2020-12-11 | 3 | |
| | | |||||
* | | Add d/upstream/signing-key.asc, the OpenPGP used to signed upstream tags. | Guilhem Moulin | 2020-12-11 | 2 | |
| | | | | | | | | Forgot to checkout the file in 93be16b3b95089517bdfcec1110296706f14e2c0… | ||||
* | | Prepare new release.debian/0.5.3-1 | Guilhem Moulin | 2020-12-09 | 1 | |
| | | |||||
* | | d/control: Bump Standards-Version to 4.5.1. | Guilhem Moulin | 2020-12-09 | 2 | |
| | | | | | | | | No changes necessary. | ||||
* | | d/control: Add missing epoch number on dovecot-* dependencies. | Guilhem Moulin | 2020-12-09 | 2 | |
| | | |||||
* | | Add d/upstream/signing-key.asc, the OpenPGP used to signed upstream tags. | Guilhem Moulin | 2020-12-09 | 1 | |
| | | |||||
* | | d/control: The test suite now requires Dovecot v2.2.31 or later | Guilhem Moulin | 2020-12-09 | 2 | |
| | | | | | | | | For ssl_alt_cert, see 51df40cf82c67ae828c325a42e28b3155fce9864. | ||||
* | | New upstream release. | Guilhem Moulin | 2020-12-09 | 1 | |
| | | | | | | | | Closes: #968392 | ||||
* | | Refresh patches. | Guilhem Moulin | 2020-12-09 | 2 | |
| | | |||||
* | | Merge tag 'upstream/0.5.3' into debian | Guilhem Moulin | 2020-12-09 | 29 | |
|\| | | | | | | | Upstream version 0.5.3 | ||||
| * | Prepare new release.upstream/0.5.3 | Guilhem Moulin | 2020-12-09 | 3 | |
| | | |||||
| * | New test with a server offering both RSA+ECDSA certificates. | Guilhem Moulin | 2020-12-09 | 7 | |
| | | | | | | | | | | | | | | | | | | | | | | | | This requires dovecot-imapd 2.2.31 or later. Certificate generated with: $ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve \ -out tests/snippets/dovecot/dovecot.ecdsa.key $ openssl req -x509 -days 3650 -subj "/CN=InterIMAP test suite" \ -key tests/snippets/dovecot/dovecot.ecdsa.key \ -out tests/snippets/dovecot/dovecot.ecdsa.crt | ||||
| * | typofix | Guilhem Moulin | 2020-12-09 | 2 | |
| | | |||||
| * | libinterimap: SSL_fingerprint now supports a space-separate list of digests ↵ | Guilhem Moulin | 2020-12-09 | 5 | |
| | | | | | | | | | | | | | | | | | | to pin. And succeeds if, and only if, the peer certificate SPKI matches one of the pinned digest values. Specifying multiple digest values can key useful in key rollover scenarios and/or when the server supports certificates of different types (for instance RSA+ECDSA). | ||||
| * | test suite: use a RSA certificate rather than ECDSA. | Guilhem Moulin | 2020-12-09 | 11 | |
| | | | | | | | | | | | | | | | | | | It's arguably the most common use-case. Generated with $ openssl genpkey -algorithm RSA -out tests/snippets/dovecot/dovecot.rsa.key $ openssl req -x509 -days 3650 -subj "/CN=InterIMAP test suite" \ -key tests/snippets/dovecot/dovecot.rsa.key \ -out tests/snippets/dovecot/dovecot.rsa.crt | ||||
| * | libinterimap: 'debug' forces 'null-stderr' = 0. | Guilhem Moulin | 2020-12-08 | 3 | |
| | | | | | | | | | | | | The standard error is never sent to /dev/null in debug mode. Closes: deb#968392 | ||||
| * | typofix | Guilhem Moulin | 2020-08-04 | 2 | |
| | |