From 556f02ce636e11e898ed5608b3b130ce4e7c6ba6 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 21 Feb 2022 13:05:44 +0100
Subject: Tests: TLS ciphers/protocols: Downgrade security level to 0.

This is required to test TLS version <1.2 on systems with higher
security levels, see SSL_CTX_set_security_level(3ssl).  Addapted from a
patch from <xnox> for Unbuntu.
---
 tests/tls-protocols/openssl.cnf | 2 +-
 tests/tls-protocols/remote.conf | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)
 mode change 120000 => 100644 tests/tls-protocols/remote.conf

(limited to 'tests')

diff --git a/tests/tls-protocols/openssl.cnf b/tests/tls-protocols/openssl.cnf
index 980097d..3d9769d 100644
--- a/tests/tls-protocols/openssl.cnf
+++ b/tests/tls-protocols/openssl.cnf
@@ -11,4 +11,4 @@ system_default = system_default_sect
 
 [system_default_sect]
 MinProtocol = None
-CipherString = DEFAULT
+CipherString = DEFAULT@SECLEVEL=0
diff --git a/tests/tls-protocols/remote.conf b/tests/tls-protocols/remote.conf
deleted file mode 120000
index 6029749..0000000
--- a/tests/tls-protocols/remote.conf
+++ /dev/null
@@ -1 +0,0 @@
-../tls/remote.conf
\ No newline at end of file
diff --git a/tests/tls-protocols/remote.conf b/tests/tls-protocols/remote.conf
new file mode 100644
index 0000000..96b3713
--- /dev/null
+++ b/tests/tls-protocols/remote.conf
@@ -0,0 +1,4 @@
+!include conf.d/imapd.conf
+!include conf.d/ssl.conf
+ssl_min_protocol = TLSv1
+ssl_cipher_list = DEFAULT@SECLEVEL=0
-- 
cgit v1.2.3


From 6bfc13635af817bb16b4fe5ef5a42619573c51fc Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 21 Feb 2022 13:52:52 +0100
Subject: Tests: Dovecot: Bump min protocol level to TLSv1.2.

And use security level 2 for ssl_cipher_list.  As of dovecot 2.3.18
ssl_min_protocol defaults to TLSv1.2.
---
 tests/config/dovecot/ssl.conf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'tests')

diff --git a/tests/config/dovecot/ssl.conf b/tests/config/dovecot/ssl.conf
index 3fd99d5..1f3a698 100644
--- a/tests/config/dovecot/ssl.conf
+++ b/tests/config/dovecot/ssl.conf
@@ -2,4 +2,5 @@ ssl = required
 ssl_cert = <dovecot.rsa.crt
 ssl_key = <dovecot.rsa.key
 ssl_dh = <dhparams.pem
-ssl_min_protocol = TLSv1
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = DEFAULT@SECLEVEL=2
-- 
cgit v1.2.3


From eeed44617b8b2bf4c941f6de334a9006804615fb Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 23 Feb 2022 00:35:41 +0100
Subject: Don't assume Net::IMAP::InterIMAP is always in @INC.

And make the installation path configurable at `make` time.  Moreover,
adjust the 'test' target so the site directory and interimap/pullimap
path are configurable with INTERIMAP_I and INTERIMAP_PATH respectively.
That way one can run `tests/run foo` to check the source, `make test` to
check what's been built, and we also have the possibility to check the
installed program e.g. for autopkgtests.
---
 Makefile                    | 22 +++++++++++++++-------
 benchmark/run               |  5 +++--
 doc/development.md          |  8 ++++----
 interimap                   |  1 +
 pullimap                    |  1 +
 tests/db-exclusive-lock/t   |  4 ++--
 tests/db-no-create--watch/t |  2 +-
 tests/run                   | 15 ++++++++++++---
 8 files changed, 39 insertions(+), 19 deletions(-)

(limited to 'tests')

diff --git a/Makefile b/Makefile
index e25546d..83281dd 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,7 @@ prefix ?= /usr/local
 exec_prefix ?= $(prefix)
 bindir ?= $(exec_prefix)/bin
 libdir ?= $(exec_prefix)/lib
+sitelib ?= $(libdir)/site_perl
 datarootdir ?= $(prefix)/share
 mandir ?= $(datarootdir)/man
 man1dir ?= $(mandir)/man1
@@ -11,15 +12,22 @@ man1dir ?= $(mandir)/man1
 CSS ?= /usr/share/javascript/bootstrap4/css/bootstrap.css
 HTML_TEMPLATE ?= $(srcdir)/doc/template.html
 
+PROGRAMS = $(addprefix $(builddir)/,interimap pullimap)
 HTML_FILES = $(patsubst $(srcdir)/doc/%.md,$(builddir)/doc/%.html,$(wildcard $(srcdir)/doc/*.md))
 MANUAL_FILES = $(patsubst $(srcdir)/doc/%.md,$(builddir)/doc/%,$(wildcard $(srcdir)/doc/*.[1-9].md))
 SERVICE_FILES = $(patsubst $(srcdir)/%.service,$(builddir)/%.service,$(wildcard $(srcdir)/*.service))
 
-all: manual $(SERVICE_FILES)
+all: manual $(PROGRAMS) $(SERVICE_FILES)
 
 manual: $(MANUAL_FILES)
 html: $(HTML_FILES)
 
+$(PROGRAMS): $(builddir)/%: $(srcdir)/%
+	@mkdir -vp $(dir $@)
+	perl -Te "print \"\$$_\\0\" foreach @INC;" | grep -Fxzq -e "$(sitelib)" && prefix="#" || prefix=""; \
+	sed -r "0,/^(use\\s+\lib\\s+)([\"'])[^\"']*\\2\\s*;/ s||$$prefix\\1\"$(sitelib)\";|" <"$<" >"$@"
+	chmod --reference="$<" -- "$@"
+
 # upper case the headers and remove the links
 $(MANUAL_FILES): $(builddir)/doc/%: $(srcdir)/doc/%.md
 	@mkdir -vp $(dir $@)
@@ -31,7 +39,7 @@ $(SERVICE_FILES): $(builddir)/%.service: $(srcdir)/%.service
 
 test:
 	$(srcdir)/tests/certs/generate
-	$(srcdir)/tests/run-all
+	INTERIMAP_I=$(srcdir)/lib INTERIMAP_PATH=$(builddir) $(srcdir)/tests/run-all
 
 release:
 	@if ! git -C $(srcdir) diff --quiet HEAD -- Changelog interimap pullimap lib/Net/IMAP/InterIMAP.pm; then \
@@ -70,9 +78,9 @@ INSTALL ?= install
 INSTALL_PROGRAM ?= $(INSTALL)
 INSTALL_DATA ?= $(INSTALL) -m0644
 
-install: all
-	$(INSTALL_PROGRAM) -vDt $(DESTDIR)$(bindir) $(srcdir)/interimap $(srcdir)/pullimap
-	$(INSTALL_DATA) -vDT $(srcdir)/lib/Net/IMAP/InterIMAP.pm $(DESTDIR)$(datarootdir)/perl5/Net/IMAP/InterIMAP.pm
+install: $(PROGRAMS) $(SERVICE_FILES)
+	$(INSTALL_PROGRAM) -vDt $(DESTDIR)$(bindir) $(builddir)/interimap $(builddir)/pullimap
+	$(INSTALL_DATA) -vDT $(srcdir)/lib/Net/IMAP/InterIMAP.pm $(DESTDIR)$(sitelib)/Net/IMAP/InterIMAP.pm
 	-$(INSTALL_DATA) -vDt $(DESTDIR)$(man1dir) $(builddir)/doc/interimap.1 $(builddir)/doc/pullimap.1
 	$(INSTALL_DATA) -vDt $(DESTDIR)$(datarootdir)/doc/pullimap $(srcdir)/pullimap.sample
 	$(INSTALL_DATA) -vDt $(DESTDIR)$(datarootdir)/doc/interimap $(srcdir)/interimap.sample \
@@ -82,11 +90,11 @@ install: all
 uninstall:
 	rm -vf -- $(DESTDIR)$(bindir)/interimap $(DESTDIR)$(man1dir)/interimap.1 $(DESTDIR)$(libdir)/systemd/user/interimap*.service
 	rm -vf -- $(DESTDIR)$(bindir)/pullimap $(DESTDIR)$(man1dir)/pullimap.1 $(DESTDIR)$(libdir)/systemd/user/pullimap*.service
-	rm -vf -- $(DESTDIR)$(datarootdir)/perl5/Net/IMAP/InterIMAP.pm
+	rm -vf -- $(DESTDIR)$(sitelib)/Net/IMAP/InterIMAP.pm
 	rm -rvf -- $(DESTDIR)$(datarootdir)/doc/interimap $(DESTDIR)$(datarootdir)/doc/pullimap
 
 clean:
-	rm -vf -- $(MANUAL_FILES) $(HTML_FILES) $(SERVICE_FILES)
+	rm -vf -- $(PROGRAMS) $(MANUAL_FILES) $(HTML_FILES) $(SERVICE_FILES)
 	-rmdir -vp --ignore-fail-on-non-empty -- $(builddir)/doc
 
 .PHONY: all manual html doc test release install uninstall clean
diff --git a/benchmark/run b/benchmark/run
index 4a83c68..650270a 100755
--- a/benchmark/run
+++ b/benchmark/run
@@ -198,9 +198,10 @@ cat >"$ROOTDIR/dev/shm/nobody/.offlineimaprc" <<-EOF
 EOF
 
 # install interimap's development version
-install -oroot -groot -m0755 -Dt "/$ROOTDIR/usr/bin" \
+install -oroot -groot -m0755 -Dt "$ROOTDIR/usr/bin" \
     ./interimap ./benchmark/random_maildir.pl
-install -oroot -groot -Dm0644 \
+sed -ri "0,/^(use\\s+\lib\\s+)([\"'])[^\"']*\\2\\s*;/ s||#&|" -- "$ROOTDIR/usr/bin/interimap"
+install -oroot -groot -m0644 -DT \
     ./lib/Net/IMAP/InterIMAP.pm "$ROOTDIR/usr/share/perl5/Net/IMAP/InterIMAP.pm"
 
 # create a random mail store at mdbox:~/mail.back
diff --git a/doc/development.md b/doc/development.md
index f4578b9..530c52b 100644
--- a/doc/development.md
+++ b/doc/development.md
@@ -136,7 +136,7 @@ and `remote` accounts.
 
 Run [`interimap`(1)] without `--watch` in order to create the database.
 
-    $ env -i PATH="$PATH" perl -I./lib -T ./interimap --config="$BASEDIR/interimap.conf"
+    $ env -i PATH="$PATH" perl -T ./interimap --config="$BASEDIR/interimap.conf"
     Creating new schema in database file …/interimap.db
     database: Created mailbox INBOX
     […]
@@ -144,7 +144,7 @@ Run [`interimap`(1)] without `--watch` in order to create the database.
 You can now run [`interimap`(1)] with `--watch` set, here to one second
 to observe synchronization steps early.
 
-    $ env -i PATH="$PATH" perl -I./lib -T ./interimap --config="$BASEDIR/interimap.conf" \
+    $ env -i PATH="$PATH" perl -T ./interimap --config="$BASEDIR/interimap.conf" \
 		--watch=1 --debug
 
 Use instructions from the [previous section][Mail storage access]
@@ -168,12 +168,12 @@ Create a [`pullimap`(1)] configuration file with as section `[foo]`.
 
 Run [`pullimap`(1)] without `--idle` in order to create the state file.
 
-    $ env -i PATH="$PATH" perl -I./lib -T ./pullimap --config="$BASEDIR/pullimap.conf" \
+    $ env -i PATH="$PATH" perl -T ./pullimap --config="$BASEDIR/pullimap.conf" \
 		--no-delivery foo
 
 You can now run [`pullimap`(1)] with `--idle` set.
 
-    $ env -i PATH="$PATH" perl -I./lib -T ./pullimap --config="$BASEDIR/pullimap.conf" \
+    $ env -i PATH="$PATH" perl -T ./pullimap --config="$BASEDIR/pullimap.conf" \
 		--no-delivery --idle --debug foo
 
 Use instructions from the [previous section][Mail storage access]
diff --git a/interimap b/interimap
index 7525f9f..9ba5d06 100755
--- a/interimap
+++ b/interimap
@@ -32,6 +32,7 @@ use DBD::SQLite::Constants ':file_open';
 use Fcntl qw/F_GETFD F_SETFD FD_CLOEXEC/;
 use List::Util 'first';
 
+use lib "./lib";
 use Net::IMAP::InterIMAP 0.5.6 qw/xdg_basedir read_config compact_set/;
 
 # Clean up PATH
diff --git a/pullimap b/pullimap
index 6abd787..c225a2b 100755
--- a/pullimap
+++ b/pullimap
@@ -31,6 +31,7 @@ use Getopt::Long qw/:config posix_default no_ignore_case gnu_getopt auto_version
 use List::Util 'first';
 use Socket qw/PF_INET PF_INET6 SOCK_STREAM IPPROTO_TCP/;
 
+use lib "./lib";
 use Net::IMAP::InterIMAP 0.5.6 qw/xdg_basedir read_config compact_set/;
 
 # Clean up PATH
diff --git a/tests/db-exclusive-lock/t b/tests/db-exclusive-lock/t
index c2df4b5..7cbe550 100644
--- a/tests/db-exclusive-lock/t
+++ b/tests/db-exclusive-lock/t
@@ -10,7 +10,7 @@ sleep .5
 # subsequent runs fail as we can't acquire the exclusive lock
 ! interimap || error
 
-grep -Fx "DBD::SQLite::db do failed: database is locked at ./interimap line 176." <"$STDERR" \
-    || error "Is \$DBH->do(\"PRAGMA locking_mode = EXCLUSIVE\"); at line 176?"
+grep -Ex "DBD::SQLite::db do failed: database is locked at (\S+/)?interimap line 177\." <"$STDERR" \
+    || error "Is \$DBH->do(\"PRAGMA locking_mode = EXCLUSIVE\"); at line 177?"
 
 # vim: set filetype=sh :
diff --git a/tests/db-no-create--watch/t b/tests/db-no-create--watch/t
index a8ea07e..7ac3d31 100644
--- a/tests/db-no-create--watch/t
+++ b/tests/db-no-create--watch/t
@@ -1,6 +1,6 @@
 ! interimap --watch=60 || error
 
-grep -Ex "DBI connect\(.*\) failed: unable to open database file at \./interimap line 172\." <"$STDERR" || error
+grep -Ex "DBI connect\(.*\) failed: unable to open database file at (\S+/)?interimap line 173\." <"$STDERR" || error
 test \! -e "$XDG_DATA_HOME/interimap/remote.db" || error
 
 # vim: set filetype=sh :
diff --git a/tests/run b/tests/run
index 1eaad54..230ca83 100755
--- a/tests/run
+++ b/tests/run
@@ -38,6 +38,12 @@ fi
 # cleanup environment
 unset OPENSSL_CONF SSL_CERT_FILE SSL_CERT_DIR
 
+if [ -z "${INTERIMAP_PATH+x}" ]; then
+    INTERIMAP_PATH="./"
+elif [ -n "$INTERIMAP_PATH" ]; then
+    INTERIMAP_PATH="${INTERIMAP_PATH%/}/"
+fi
+
 ROOTDIR="$(mktemp --tmpdir="${TMPDIR:-/dev/shm}" --directory "$1.XXXXXXXXXX")"
 declare -a DOVECOT_SERVER=()
 trap cleanup EXIT INT TERM
@@ -206,14 +212,17 @@ prepare
 interimap() { _interimap_cmd "interimap" "$@"; }
 pullimap()  { _interimap_cmd "pullimap"  "$@"; }
 _interimap_cmd() {
-    declare -a ENVIRON=()
+    declare -a ENVIRON=() args=()
     local script="$1" rv=0
     shift
     environ_set "local"
     [ -z "${OPENSSL_CONF+x}" ]  || ENVIRON+=( OPENSSL_CONF="$OPENSSL_CONF" )
     [ -z "${SSL_CERT_FILE+x}" ] || ENVIRON+=( SSL_CERT_FILE="$SSL_CERT_FILE" )
     [ -z "${SSL_CERT_DIR+x}" ]  || ENVIRON+=( SSL_CERT_DIR="$SSL_CERT_DIR" )
-    env -i "${ENVIRON[@]}" perl -I./lib -T "./$script" "$@" 2>"$STDERR" || rv=$?
+    [ -z "${INTERIMAP_I:+x}" ] || args+=( perl -I"$INTERIMAP_I" -T )
+    args+=( "$INTERIMAP_PATH$script" "$@" )
+    #printf "I: Running \`%s\`\\n" "${args[*]}" >&3
+    env -i "${ENVIRON[@]}" "${args[@]}" 2>"$STDERR" || rv=$?
     cat <"$STDERR" >&2
     return $rv
 }
@@ -449,7 +458,7 @@ passed() {
 # Run test in a sub-shell
 declare -a ENVIRON=()
 environ_set "local"
-export TMPDIR TESTDIR STDERR "${ENVIRON[@]}"
+export TMPDIR TESTDIR INTERIMAP_PATH INTERIMAP_I STDERR "${ENVIRON[@]}"
 export -f environ_set doveadm interimap interimap_init pullimap _interimap_cmd
 export -f sqlite3 sample_message deliver ptree_abort step_start step_done passed
 export -f check_mailbox_status check_mailbox_status_values check_mailbox_status2
-- 
cgit v1.2.3


From 09d85b13359aabb377aeea489cd1f9c9bd1b1d63 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 23 Feb 2022 21:42:46 +0100
Subject: Fix minor space damage.

---
 tests/tls-rsa+ecdsa/t | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tests')

diff --git a/tests/tls-rsa+ecdsa/t b/tests/tls-rsa+ecdsa/t
index c9f5b96..fd2b1be 100644
--- a/tests/tls-rsa+ecdsa/t
+++ b/tests/tls-rsa+ecdsa/t
@@ -28,7 +28,7 @@ interimap_init
 check_mailbox_status "INBOX"
 
 interimap --debug || error
-# which peer certificate is used is up to libssl 
+# which peer certificate is used is up to libssl
 grep -Fx -e "remote: Peer certificate fingerprint: sha256\$$X509_SHA256" \
          -e "remote: Peer certificate fingerprint: sha256\$$X509_ALT_SHA256" \
          <"$STDERR" || error
-- 
cgit v1.2.3


From 2447861913835637bbf49d96728ce9ac6ab0ae22 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 23 Feb 2022 22:30:45 +0100
Subject: interimap, pullimap: Ensure DB and statefiles are created with mode
 0600.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It wasn't the case for interimap(1), see https://bugs.debian.org/608604 …
Fortunately we create $XDG_DATA_HOME/interimap with a secure mode, but
there is no reason to have the DB world-readable.  Since we can't rely
on SQLITE_OPEN_CREATE for secure mode we use sysopen(,,O_CREAT,0600).
---
 interimap                   | 10 +++++++---
 tests/db-exclusive-lock/t   |  4 ++--
 tests/db-no-create--watch/t |  2 +-
 tests/pullimap/t            |  7 +++++++
 tests/run                   |  5 ++++-
 5 files changed, 21 insertions(+), 7 deletions(-)

(limited to 'tests')

diff --git a/interimap b/interimap
index 9ba5d06..d4ff3fc 100755
--- a/interimap
+++ b/interimap
@@ -29,7 +29,7 @@ use Getopt::Long qw/:config posix_default no_ignore_case gnu_compat
                             bundling auto_version/;
 use DBI ':sql_types';
 use DBD::SQLite::Constants ':file_open';
-use Fcntl qw/F_GETFD F_SETFD FD_CLOEXEC/;
+use Fcntl qw/O_WRONLY O_CREAT O_EXCL F_GETFD F_SETFD FD_CLOEXEC/;
 use List::Util 'first';
 
 use lib "./lib";
@@ -160,6 +160,12 @@ $SIG{TERM} = sub { cleanup(); exit 0; };
 # Open (and maybe create) the database
 
 {
+    # don't auto-create in long-lived mode
+    unless ($CONFIG{watch} or -e $DBFILE) {
+        sysopen(my $fh, $DBFILE, O_WRONLY | O_CREAT | O_EXCL, 0600) or die "Can't create $DBFILE: $!";
+        close $fh or warn "close: $!";
+    }
+
     my $dbi_data_source = "dbi:SQLite:dbname=".$DBFILE;
     my %dbi_attrs = (
         AutoCommit => 0,
@@ -167,8 +173,6 @@ $SIG{TERM} = sub { cleanup(); exit 0; };
         sqlite_use_immediate_transaction => 1,
         sqlite_open_flags => SQLITE_OPEN_READWRITE
     );
-    # don't auto-create in long-lived mode
-    $dbi_attrs{sqlite_open_flags} |= SQLITE_OPEN_CREATE unless defined $CONFIG{watch};
 
     $DBH = DBI::->connect($dbi_data_source, undef, undef, \%dbi_attrs);
     $DBH->sqlite_busy_timeout(250);
diff --git a/tests/db-exclusive-lock/t b/tests/db-exclusive-lock/t
index 7cbe550..837d21b 100644
--- a/tests/db-exclusive-lock/t
+++ b/tests/db-exclusive-lock/t
@@ -10,7 +10,7 @@ sleep .5
 # subsequent runs fail as we can't acquire the exclusive lock
 ! interimap || error
 
-grep -Ex "DBD::SQLite::db do failed: database is locked at (\S+/)?interimap line 177\." <"$STDERR" \
-    || error "Is \$DBH->do(\"PRAGMA locking_mode = EXCLUSIVE\"); at line 177?"
+grep -Ex "DBD::SQLite::db do failed: database is locked at (\S+/)?interimap line 181\." <"$STDERR" \
+    || error "Is \$DBH->do(\"PRAGMA locking_mode = EXCLUSIVE\"); at line 181?"
 
 # vim: set filetype=sh :
diff --git a/tests/db-no-create--watch/t b/tests/db-no-create--watch/t
index 7ac3d31..37fc6cb 100644
--- a/tests/db-no-create--watch/t
+++ b/tests/db-no-create--watch/t
@@ -1,6 +1,6 @@
 ! interimap --watch=60 || error
 
-grep -Ex "DBI connect\(.*\) failed: unable to open database file at (\S+/)?interimap line 173\." <"$STDERR" || error
+grep -Ex "DBI connect\(.*\) failed: unable to open database file at (\S+/)?interimap line 177\." <"$STDERR" || error
 test \! -e "$XDG_DATA_HOME/interimap/remote.db" || error
 
 # vim: set filetype=sh :
diff --git a/tests/pullimap/t b/tests/pullimap/t
index 0dfe634..7998cdc 100644
--- a/tests/pullimap/t
+++ b/tests/pullimap/t
@@ -6,6 +6,13 @@ step_start "\`pullimap --idle\` refuses to create the state file"
 ! pullimap --idle "remote" || error
 step_done
 
+step_start "\`pullimap\` creates statefile with mode 0600"
+pullimap "remote" || error
+if ! st="$(stat -c"%#a" -- "$XDG_DATA_HOME/pullimap/remote")" || [ "$st" != "0600" ]; then
+    error "$XDG_DATA_HOME/pullimap/remote has mode $st != 0600"
+fi
+step_done
+
 # compare mailboxes (can't compare the RFC 3501 TEXT as the LMTPd inconditionally
 # adds a Return-Path: header -- and also Delivered-To: and Received: to by default)
 list_mails_sha256() {
diff --git a/tests/run b/tests/run
index 230ca83..eed77df 100755
--- a/tests/run
+++ b/tests/run
@@ -228,13 +228,16 @@ _interimap_cmd() {
 }
 interimap_init() {
     local u="${1-remote}"
-    local db="$XDG_DATA_HOME/interimap/$u.db"
+    local db="$XDG_DATA_HOME/interimap/$u.db" st
     local cfg="config${u#remote}"
 
     test \! -e "$db"          || error "Database already exists" 1
     interimap --config "$cfg" || error "Couldn't initialize interimap" 1
     test -f "$db"             || error "Database is still missing" 1
     grep -Fx "Creating new schema in database file $db" <"$STDERR" || error "DB wasn't created" 1
+    if ! st="$(stat -c"%#a" -- "$db")" || [ "$st" != "0600" ]; then
+        error "$db has mode $st != 0600" 1
+    fi
 }
 doveadm() {
     if [ $# -le 2 ] || [ "$1" != "-u" ]; then
-- 
cgit v1.2.3


From 76a005507f284e874eb5a3e4e315bb324fb2a095 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 24 Feb 2022 23:09:14 +0100
Subject: Split interimap and pullimap test suites.

---
 Changelog            |  1 +
 Makefile             | 23 +++++++++++++-----
 tests/interimap.list | 63 +++++++++++++++++++++++++++++++++++++++++++++++++
 tests/list           | 66 ----------------------------------------------------
 tests/pullimap.list  |  2 ++
 tests/run-all        |  3 ++-
 6 files changed, 85 insertions(+), 73 deletions(-)
 create mode 100644 tests/interimap.list
 delete mode 100644 tests/list
 create mode 100644 tests/pullimap.list

(limited to 'tests')

diff --git a/Changelog b/Changelog
index 9549892..cad321b 100644
--- a/Changelog
+++ b/Changelog
@@ -15,6 +15,7 @@ interimap (0.5.7) upstream;
    foo`; what's been built with `INTERIMAP_I=./lib INTERIMAP_PATH=./build
    ./tests/run foo`, and what's installed with `INTERIMAP_I=""
    INTERIMAP_PATH=/usr/bin tests/run foo`.
+ * Split interimap and pullimap test suites.
  + Improve message for missing untagged UIDNEXT responses, which we
    require but are omitted from some servers.
  + tests/tls-protocols: downgrade OpenSSL security level to 0, which is
diff --git a/Makefile b/Makefile
index 7bcda70..1d09ff2 100644
--- a/Makefile
+++ b/Makefile
@@ -40,13 +40,20 @@ $(SERVICE_FILES): $(builddir)/%.service: $(srcdir)/%.service
 	@mkdir -vp $(dir $@)
 	sed "s|@bindir@|$(bindir)|" <"$<" >"$@"
 
-check: $(PROGRAMS)
+testcerts:
 	$(srcdir)/tests/certs/generate
-	INTERIMAP_I=$(srcdir)/lib INTERIMAP_PATH=$(builddir) $(srcdir)/tests/run-all
 
-installcheck:
-	$(srcdir)/tests/certs/generate
-	INTERIMAP_I="" INTERIMAP_PATH=$(bindir) $(srcdir)/tests/run-all
+check: check-interimap check-pullimap
+check-interimap: $(builddir)/interimap testcerts
+	INTERIMAP_I=$(srcdir)/lib INTERIMAP_PATH=$(builddir) $(srcdir)/tests/run-all interimap.list
+check-pullimap: $(builddir)/pullimap testcerts
+	INTERIMAP_I=$(srcdir)/lib INTERIMAP_PATH=$(builddir) $(srcdir)/tests/run-all pullimap.list
+
+installcheck: installcheck-interimap installcheck-pullimap
+installcheck-interimap: testcerts
+	INTERIMAP_I="" INTERIMAP_PATH=$(bindir) $(srcdir)/tests/run-all interimap.list
+installcheck-pullimap: testcerts
+	INTERIMAP_I="" INTERIMAP_PATH=$(bindir) $(srcdir)/tests/run-all pullimap.list
 
 release:
 	@if ! git -C $(srcdir) diff --quiet HEAD -- Changelog interimap pullimap lib/Net/IMAP/InterIMAP.pm; then \
@@ -103,4 +110,8 @@ clean:
 	rm -vf -- $(srcdir)/tests/certs/*.key $(srcdir)/tests/certs/*.crt $(srcdir)/tests/certs/*.pem
 	-rmdir -vp --ignore-fail-on-non-empty -- $(builddir)/doc
 
-.PHONY: all all-nodoc manual html doc check release install install-nodoc installcheck uninstall clean
+.PHONY: all all-nodoc manual html doc release testcerts \
+	check check-interimap check-pullimap \
+	install install-nodoc \
+	installcheck installcheck-interimap installcheck-pullimap \
+	uninstall clean
diff --git a/tests/interimap.list b/tests/interimap.list
new file mode 100644
index 0000000..559daed
--- /dev/null
+++ b/tests/interimap.list
@@ -0,0 +1,63 @@
+db-no-create--watch     `interimap --watch` refuses to create the database
+db-exclusive-lock       mutually exclusive DB access
+
+. DB schema upgrade (v0 -> v1)
+    db-upgrade-0-1                              migrate
+    # may happen if the server(s) software or its configuration changed
+    db-upgrade-0-1-delim-mismatch               abort on hierarchy delimiter mismatch
+    # foreign key checking was broken until v0.5
+    db-migration-0-1-foreign-key-violation      abort on foreign key contraint violation
+
+. Mailbox deletion
+    ... delete
+
+. Mailbox renaming
+    rename-exists-db        abort if target exists in the DB
+    rename-exists-local     abort if target exists locally
+    rename-exists-remote    abort if target exists remotely
+    ... rename-simple
+    ... rename-inferiors
+
+# try values beyond the signed integer limit
+largeint  Large UIDVALIDITY/UIDNEXT/HIGHESTMODSEQ values
+
+. Mailbox synchronization
+    ... sync-mailbox-list
+    list-reference      list-reference
+    list-mailbox        list-mailbox = foo "foo bar" "f\\\"o\x21o.*" "f\0o\0o"
+    list-select-opts    list-select-opts = SUBSCRIBED
+    ignore-mailbox      ignore-mailbox = ^virtual(?:\x00|$)
+    delimiter-change    doesn't choke on delimiter change
+
+resume  Resume when aborted
+repair  --repair
+
+. Authentication
+    auth-sasl-plain         AUTHENTICATE (SASL PLAIN)
+    auth-sasl-plain-no-ir   AUTHENTICATE (SASL PLAIN, no SASL-IR)
+    auth-login              LOGIN
+    auth-logindisabled      LOGINDISABLED
+    auth-noplaintext        abort when STARTTLS is not offered
+    preauth-plaintext       abort on MiTM via PREAUTH greeting
+
+compress    COMPRESS=DEFLATE
+condstore   CONDSTORE
+split-set   Split large sets to avoid extra-long command lines
+
+. SSL/TLS
+    starttls-logindisabled  LOGINDISABLED STARTTLS
+    starttls                STARTTLS
+    starttls-injection      STARTTLS response injection
+    tls                     SSL/TLS handshake
+    ... tls-verify-peer
+    tls-pin-fingerprint     pubkey fingerprint pinning
+    tls-rsa+ecdsa           pubkey fingerprint pinning for dual-cert RSA+ECDSA
+    tls-sni                 TLS servername extension (SNI)
+    tls-protocols           force TLS protocol versions
+    tls-ciphers             force TLS cipher list/suites
+
+. Live synchronization (60s)
+    sync-live            local/remote simulation
+    sync-live-crippled   local/remote simulation (crippled remote)
+    sync-live-tls        local/remote simulation (TLS remote)
+    sync-live-multi      local/remote1+remote2+remote3 simulation (3 local namespaces)
diff --git a/tests/list b/tests/list
deleted file mode 100644
index d1058ba..0000000
--- a/tests/list
+++ /dev/null
@@ -1,66 +0,0 @@
-db-no-create--watch     `interimap --watch` refuses to create the database
-db-exclusive-lock       mutually exclusive DB access
-
-. DB schema upgrade (v0 -> v1)
-    db-upgrade-0-1                              migrate
-    # may happen if the server(s) software or its configuration changed
-    db-upgrade-0-1-delim-mismatch               abort on hierarchy delimiter mismatch
-    # foreign key checking was broken until v0.5
-    db-migration-0-1-foreign-key-violation      abort on foreign key contraint violation
-
-. Mailbox deletion
-    ... delete
-
-. Mailbox renaming
-    rename-exists-db        abort if target exists in the DB
-    rename-exists-local     abort if target exists locally
-    rename-exists-remote    abort if target exists remotely
-    ... rename-simple
-    ... rename-inferiors
-
-# try values beyond the signed integer limit
-largeint  Large UIDVALIDITY/UIDNEXT/HIGHESTMODSEQ values
-
-. Mailbox synchronization
-    ... sync-mailbox-list
-    list-reference      list-reference
-    list-mailbox        list-mailbox = foo "foo bar" "f\\\"o\x21o.*" "f\0o\0o"
-    list-select-opts    list-select-opts = SUBSCRIBED
-    ignore-mailbox      ignore-mailbox = ^virtual(?:\x00|$)
-    delimiter-change    doesn't choke on delimiter change
-
-resume  Resume when aborted
-repair  --repair
-
-. Authentication
-    auth-sasl-plain         AUTHENTICATE (SASL PLAIN)
-    auth-sasl-plain-no-ir   AUTHENTICATE (SASL PLAIN, no SASL-IR)
-    auth-login              LOGIN
-    auth-logindisabled      LOGINDISABLED
-    auth-noplaintext        abort when STARTTLS is not offered
-    preauth-plaintext       abort on MiTM via PREAUTH greeting
-
-compress    COMPRESS=DEFLATE
-condstore   CONDSTORE
-split-set   Split large sets to avoid extra-long command lines
-
-. SSL/TLS
-    starttls-logindisabled  LOGINDISABLED STARTTLS
-    starttls                STARTTLS
-    starttls-injection      STARTTLS response injection
-    tls                     SSL/TLS handshake
-    ... tls-verify-peer
-    tls-pin-fingerprint     pubkey fingerprint pinning
-    tls-rsa+ecdsa           pubkey fingerprint pinning for dual-cert RSA+ECDSA
-    tls-sni                 TLS servername extension (SNI)
-    tls-protocols           force TLS protocol versions
-    tls-ciphers             force TLS cipher list/suites
-
-. Live synchronization (60s)
-    sync-live            local/remote simulation
-    sync-live-crippled   local/remote simulation (crippled remote)
-    sync-live-tls        local/remote simulation (TLS remote)
-    sync-live-multi      local/remote1+remote2+remote3 simulation (3 local namespaces)
-
-. pullimap
-    ... pullimap
diff --git a/tests/pullimap.list b/tests/pullimap.list
new file mode 100644
index 0000000..f4304b9
--- /dev/null
+++ b/tests/pullimap.list
@@ -0,0 +1,2 @@
+. pullimap
+    ... pullimap
diff --git a/tests/run-all b/tests/run-all
index d13f689..79e62d1 100755
--- a/tests/run-all
+++ b/tests/run-all
@@ -24,6 +24,7 @@ export PATH
 
 BASEDIR="$(dirname -- "$0")"
 RUN="$BASEDIR/run"
+list="$1"
 
 failed=0
 
@@ -54,7 +55,7 @@ while IFS="" read -r x; do
     fi
 
     INDENT="$indent" "$RUN" "$t" ${desc+"$desc"} || failed=$(( failed+1 ))
-done <"$BASEDIR/list"
+done <"$BASEDIR/$list"
 
 if [ $failed -eq 0 ]; then
     printf "All tests passed.\\n"
-- 
cgit v1.2.3


From 90d0b00313686a8e6a05e807c24d5c460718ba41 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 24 Feb 2022 23:44:46 +0100
Subject: tests/certs/generate: Redirect known error output to the standard
 output.

That way we can avoid using autopkgtest's 'allow-stderr' restriction.
---
 Changelog            |  2 ++
 tests/certs/generate | 15 ++++++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

(limited to 'tests')

diff --git a/Changelog b/Changelog
index cad321b..72f7331 100644
--- a/Changelog
+++ b/Changelog
@@ -35,6 +35,8 @@ interimap (0.5.7) upstream;
    files.
  - Don't hardcode path to interimap/pullimap in .service files, and
    instead use $(bindir) (expanded at compile time).
+ - tests/certs/generate: redirect known error output to the standard
+   output.
 
  -- Guilhem Moulin <guilhem@fripost.org>  Thu, 24 Feb 2022 01:28:25 +0100
 
diff --git a/tests/certs/generate b/tests/certs/generate
index de379a0..36fce8b 100755
--- a/tests/certs/generate
+++ b/tests/certs/generate
@@ -10,10 +10,15 @@ cd "$BASEDIR"
 
 cadir="$(mktemp --tmpdir --directory)"
 trap 'rm -rf -- "$cadir"' EXIT INT TERM
+genpkey() {
+    local key="$1"
+    shift
+    openssl genpkey -out "$key" "$@" 2>&1
+}
 
 # generate CA (we intentionally throw away the private key and serial
 # file to avoid reuse)
-openssl genpkey -algorithm RSA -out "$cadir/ca.key"
+genpkey "$cadir/ca.key" -algorithm RSA
 openssl req -new -x509 -rand /dev/urandom -subj "/OU=$OU/CN=Fake Root CA" -key "$cadir/ca.key" -out ./ca.crt
 
 SERIAL=1
@@ -31,14 +36,14 @@ new() {
         printf "subjectAltName = %s\\n" "$3" >>"$cadir/new-ext.cnf"
     fi
     openssl x509 -req -in "$cadir/new.csr" -CA ./ca.crt -CAkey "$cadir/ca.key" \
-        -CAserial "$cadir/ca.srl" -CAcreateserial -extfile "$cadir/new-ext.cnf"
+        -CAserial "$cadir/ca.srl" -CAcreateserial -extfile "$cadir/new-ext.cnf" 2>&1
 }
 
-openssl genpkey -algorithm RSA -out ./dovecot.rsa.key
+genpkey ./dovecot.rsa.key -algorithm RSA
 new ./dovecot.rsa.key "localhost" "DNS:localhost,DNS:ip6-localhost,IP:127.0.0.1,IP:::1" >./dovecot.rsa.crt
 
-openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out ./dovecot.ecdsa.key
+genpkey ./dovecot.ecdsa.key -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve
 new ./dovecot.ecdsa.key "localhost" >./dovecot.ecdsa.crt
 
-openssl genpkey -algorithm RSA -out ./dovecot.rsa2.key
+genpkey ./dovecot.rsa2.key -algorithm RSA
 new ./dovecot.rsa2.key "imap.example.net" "DNS:imap.example.net,DNS:localhost" >./dovecot.rsa2.crt
-- 
cgit v1.2.3


From 58c2c80b585fe51dea56ca13776b51f44ad68463 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 24 Feb 2022 23:59:37 +0100
Subject: tests/certs/generate: Use custom openssl.cnf.

To avoid depending on the system default.
---
 Changelog               | 2 ++
 tests/certs/generate    | 3 +++
 tests/certs/openssl.cnf | 4 ++++
 3 files changed, 9 insertions(+)
 create mode 100644 tests/certs/openssl.cnf

(limited to 'tests')

diff --git a/Changelog b/Changelog
index 72f7331..1365749 100644
--- a/Changelog
+++ b/Changelog
@@ -37,6 +37,8 @@ interimap (0.5.7) upstream;
    instead use $(bindir) (expanded at compile time).
  - tests/certs/generate: redirect known error output to the standard
    output.
+ - tests/certs/generate: use custom openssl.cnf to avoid depending on
+   the system default.
 
  -- Guilhem Moulin <guilhem@fripost.org>  Thu, 24 Feb 2022 01:28:25 +0100
 
diff --git a/tests/certs/generate b/tests/certs/generate
index 36fce8b..8e9c451 100755
--- a/tests/certs/generate
+++ b/tests/certs/generate
@@ -8,6 +8,9 @@ BASEDIR="$(dirname -- "$0")"
 OU="InterIMAP test suite"
 cd "$BASEDIR"
 
+OPENSSL_CONF="./openssl.cnf"
+export OPENSSL_CONF
+
 cadir="$(mktemp --tmpdir --directory)"
 trap 'rm -rf -- "$cadir"' EXIT INT TERM
 genpkey() {
diff --git a/tests/certs/openssl.cnf b/tests/certs/openssl.cnf
new file mode 100644
index 0000000..b1af7b8
--- /dev/null
+++ b/tests/certs/openssl.cnf
@@ -0,0 +1,4 @@
+[ req ]
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
-- 
cgit v1.2.3


From 0ed97cf6a2d7783b59ea9855a99e6a95816961ae Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Fri, 25 Feb 2022 00:23:32 +0100
Subject: tests/pullimap: Allow easy exclusion of --idle'ing tests.

---
 Changelog        |  1 +
 tests/pullimap/t | 42 ++++++++++++++++++++++--------------------
 2 files changed, 23 insertions(+), 20 deletions(-)

(limited to 'tests')

diff --git a/Changelog b/Changelog
index 1365749..10db1a0 100644
--- a/Changelog
+++ b/Changelog
@@ -39,6 +39,7 @@ interimap (0.5.7) upstream;
    output.
  - tests/certs/generate: use custom openssl.cnf to avoid depending on
    the system default.
+ - tests/pullimap: allow easy exclusion of --idle'ing tests.
 
  -- Guilhem Moulin <guilhem@fripost.org>  Thu, 24 Feb 2022 01:28:25 +0100
 
diff --git a/tests/pullimap/t b/tests/pullimap/t
index 7998cdc..58a19ca 100644
--- a/tests/pullimap/t
+++ b/tests/pullimap/t
@@ -111,29 +111,31 @@ doveadm -u "remote" search mailbox "$MAILBOX" unseen >"$TMPDIR/unseen"
 step_done
 
 
-step_start "--idle (${TIMEOUT}s)"
-
-pullimap --idle "remote" & PID=$!
-trap "ptree_abort $PID" EXIT INT TERM
-
-timer=$(( $(date +%s) + TIMEOUT ))
-while [ $(date +%s) -le $timer ]; do
-    n="$(shuf -n1 -i1-5)"
-    for (( i=0; i < n; i++)); do
-        sample_message | deliver -u "remote"  -- -m "$MAILBOX"
+if [ $TIMEOUT -gt 0 ]; then
+    step_start "--idle (${TIMEOUT}s)"
+
+    pullimap --idle "remote" & PID=$!
+    trap "ptree_abort $PID" EXIT INT TERM
+
+    timer=$(( $(date +%s) + TIMEOUT ))
+    while [ $(date +%s) -le $timer ]; do
+        n="$(shuf -n1 -i1-5)"
+        for (( i=0; i < n; i++)); do
+            sample_message | deliver -u "remote"  -- -m "$MAILBOX"
+        done
+
+        s=$(shuf -n1 -i1-1500)
+        [ $s -ge 1000 ] && s="$(printf "1.%03d" $((s-1000)))" || s="$(printf "0.%03d" $s)"
+        sleep "$s"
     done
 
-    s=$(shuf -n1 -i1-1500)
-    [ $s -ge 1000 ] && s="$(printf "1.%03d" $((s-1000)))" || s="$(printf "0.%03d" $s)"
-    sleep "$s"
-done
-
-sleep 5
-ptree_abort $PID
-trap - EXIT INT TERM
+    sleep 5
+    ptree_abort $PID
+    trap - EXIT INT TERM
 
-check
-step_done
+    check
+    step_done
+fi
 
 
 step_start "Purging"
-- 
cgit v1.2.3