hMailServer

The 6.2.x line is the maintained line and is updated frequently. An upgrade path from every earlier hMailServer version is preserved: the database upgrade chain is continuous, and installing over an existing deployment keeps configuration and mail intact, which is stated on the README front page and exercised by the installer smoke workflow. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/installer-smoke.yml

GitHub Issues is used as the defect tracker. See https://github.com/Progressiverobot/hmailserver/issues

No vulnerability reports have been resolved in the last 12 months in this fork, so there is no reporter to credit. The security policy commits in advance to crediting reporters by name unless they ask not to be named. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/SECURITY.md

SECURITY.md documents the full response process: private reporting through GitHub Security Advisories, with a no-detail fallback issue if the reporter cannot use advisories; acknowledgement within 5 working days; initial assessment within 10; a fix within 90 days of acknowledgement; coordinated disclosure at 90 days; and publication of the advisory with a CVE requested through GitHub when the fix ships. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/SECURITY.md

The .editorconfig file defines the style for the primary languages, C++ (.h and .cpp) and C# (.cs), as space indentation at width 3, and is applied automatically by Visual Studio and the .NET SDK. The contribution guide adds the project-specific rules that contributions must follow: parameterised SQL exclusively, the IniFileSettings pattern for new server-wide options, and the COM API as the single management seam. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/CONTRIBUTING.md

The selected coding style is declared in .editorconfig (C++ and C#: space indentation, width 3) and is enforced automatically: the Coding style workflow runs editorconfig-checker — a FLOSS tool — against the tree on every push and pull request to master, so a style violation fails CI. Exceptions live in the repository where they are visible and reviewable, not in local settings. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/style.yml

This is not a make-based or autotools build, so CC, CFLAGS, CXX, CXXFLAGS and LDFLAGS have no meaning in it. The native server is an MSBuild/Visual Studio solution and honours the equivalent MSBuild mechanisms, namely Configuration, Platform, PlatformToolset and per-project property groups, which build.ps1 passes through. See https://github.com/Progressiverobot/hmailserver/blob/master/build/build.ps1

Debugging information is generated and preserved rather than stripped: the native projects set DebugInformationFormat to ProgramDatabase and GenerateDebugInformation to true, so a .pdb is produced alongside the binary for Release configurations, which is what makes the minidump handler useful in the field. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/hMailServer/hMailServer.vcxproj

There is no recursive build. The native server is a single MSBuild solution in which project-to-project references express the dependency graph, and MSBuild resolves build order from that graph rather than by descending directories. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/hMailServer/hMailServer.sln

The native server is compiled and linked with /Brepro (MSVC's reproducible-PE mode: the header timestamp and other nondeterministic fields are replaced by hashes of the content) and /d1trimfile so the checkout path is not embedded (hmailserver/source/Server/hMailServer/hMailServer.vcxproj); the .NET tools are SDK-style projects, which are deterministic by default. Two clean Release builds of the same tree on the same machine produce a byte-identical hMailServer.exe: first proven 22 August 2026 and recorded in Roadmap.md ('build_repeatable / build_reproducible'), and re-verified on 11 September 2026 with the current toolchain (MSVC 14.51.36231): identical SHA-256 from two clean builds. https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/hMailServer/hMailServer.vcxproj

The software installs and uninstalls by the standard Windows convention: a single-file installer, hMailServer-x.y.z-x64.exe, built with Inno Setup, which registers an entry in Apps and Features for uninstall and supports unattended installation. The installer is smoke-tested in CI on every relevant change. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/installer-smoke.yml

The installer follows Windows conventions for install location: it defaults to the standard Program Files location, lets the operator choose a different directory at install time, and unattended installs accept the same directory selection through the standard Inno Setup command-line switches, which the README documents. See https://github.com/Progressiverobot/hmailserver/blob/master/README.md

The contribution guide and README give the complete developer setup: Visual Studio 2026 with platform toolset v145, the external libraries (OpenSSL 4.0.x, Boost 1.91, PostgreSQL 18 libpq) located through the hMailServerLibs environment variable, the two solutions to open, and the helper scripts in build/ (build.ps1, build-tests.ps1, run-tests.ps1) that build the product and its tests. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/CONTRIBUTING.md

Dependencies are listed in a computer-processable way. An SBOM is generated in CI, with native dependencies merged into it by build/merge-native-dependencies-into-sbom.ps1; .NET dependencies are declared in the project files; and every vendored binary is inventoried with its SHA-256 and origin in hmailserver/docs/third-party-binaries.json. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/sbom.yml

Dependencies are monitored continuously: Dependabot is configured in .github/dependabot.yml, a dependency-review workflow gates pull requests that would introduce known-vulnerable packages, an SBOM is produced per build, and OpenSSF Scorecard runs against the repository. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/dependabot.yml

Reused components are individually identified and updateable. .NET packages are declared per project and updated by Dependabot; native dependencies (OpenSSL, Boost, PostgreSQL libpq, MariaDB Connector/C) are pinned by version in libraries/ and recorded in the SBOM; and every vendored binary carries a SHA-256 and provenance record enforced by the binary-provenance workflow, so a component swap is visible and reviewable rather than silent. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/verify-binary-provenance.yml

The fork exists precisely to avoid obsolete interfaces: it has been moved to a current toolchain (MSVC v145), current OpenSSL 4.0.x, current Boost, and .NET 10 for the Control Panel and tools, along with current transport-security and authentication standards. Deprecated protocol behaviour is retained only where a mail server must interoperate, and then deliberately and behind a setting. See https://github.com/Progressiverobot/hmailserver/blob/master/README.md

GitHub Actions runs an automated suite on every push and pull request to master: the Control Panel test suite with cobertura coverage, a build of the tools solution with warnings as errors, verification that committed generated code still matches its source, and CodeQL analysis. Each run reports success or failure per job and uploads a coverage artifact. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/ci.yml

Fixing a bug means pinning it with a test. The contribution guide requires regression tests for behaviour changes, and the practice is visible in the issue history and release notes: the SMTP-smuggling terminator rule (CVE-2023-51764) is pinned by its own test, and the Postfix data-phase hang, the IMAP partial FETCH defect and the delivery-side scanner timeouts each landed with regression coverage. See https://github.com/Progressiverobot/hmailserver/tree/master/hmailserver/test/RegressionTests

The contribution guide states the policy formally: all changes must keep the regression suite green, and contributors must add or update regression tests for behaviour changes. New functionality is therefore required to arrive with tests in the automated suite. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/CONTRIBUTING.md

The contribution guide documents the requirement to add tests. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/CONTRIBUTING.md

The project is as strict as is practical for this codebase. The native server compiles at MSVC /W3 with TreatWarningAsError (/WX), so there is zero tolerance for any warning that is enabled, and the .NET Control Panel and tools solutions build with -warnaserror. Moving to /W4 on a codebase of this age is not practical without mass suppression, which would weaken the gate rather than strengthen it, so the project instead adds CodeQL analysis on every push and pull request and a libFuzzer harness suite under fuzz/. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/codeql.yml

Secure design principles are applied throughout. Least privilege and privilege separation: administrator-level surfaces are explicitly outside the security boundary and documented as such. Complete mediation: all configuration and management flows through the single COM API seam rather than ad-hoc paths. Fail-safe defaults: unsafe password-hash schemes are refused for new secrets and downgraded to PBKDF2, and TLS peer verification is on by default. Injection is designed out by requiring parameterised SQL exclusively. See https://github.com/Progressiverobot/hmailserver/blob/master/ARCHITECTURE.md

The project avoids known weak algorithms: TLS 1.2/1.3 by default, AEAD-ONLY cipher preset available, and hybrid post-quantum key exchange. See https://github.com/Progressiverobot/hmailserver/blob/master/README.md

Algorithms are selectable rather than hard-coded. Password hashing supports SHA256, PBKDF2 and Argon2id through a configurable PreferredHashAlgorithm plus a configurable minimum acceptable scheme; the TLS cipher list is configurable (SslCipherList); and the TLS key-exchange groups are configurable, defaulting to X25519MLKEM768:SecP256r1MLKEM768:X25519:secp384r1:secp256r1. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/Common/Application/IniFileSettings.cpp

Credentials and keys are held separately from other configuration and are not embedded in the source. TLS certificates and private keys are files on disk referenced by path from the certificate configuration; account password hashes live in the database; and the optional server-wide pepper and other secrets are read from INI settings rather than compiled in. No credential is required to be stored inside the program itself. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/Common/TCPIP/SslContextInitializer.cpp

All network communications support secure protocols. SMTP, IMAP and POP3 are each offered with STARTTLS and with implicit TLS, the REST API and web-services listeners run over HTTPS, and the server implements the transport-security standards expected of a modern MTA, including DANE, MTA-STS and per-route TLS policy. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/SMTP/TlsPolicy.cpp

TLS 1.2 and TLS 1.3 are both supported and are the versions offered by default; older protocol versions are individually controlled through the SSL_OP_NO_* options and the obsolete ones are disabled. Release validation exercises TLS 1.2 and 1.3 handshakes end to end against the exact binary being shipped. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/Common/TCPIP/SslContextInitializer.cpp

Certificate verification is performed by default. Outbound TLS sets verify_peer together with verify_fail_if_no_peer_cert and installs a verification callback that checks the certificate chain and the expected remote hostname, with a DANE verifier used where a TLSA record applies. Client-certificate verification is available for inbound connections. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp

Verification happens during the TLS handshake, before any application data is sent, so credentials are never transmitted over an unverified connection. The verify mode and verification callback are installed on the SSL socket prior to the handshake, and a verification failure fails the handshake rather than downgrading, so SMTP AUTH, IMAP and POP3 credentials cannot be sent to an unverified peer. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp

Every asset attached to a release is cryptographically signed with Sigstore cosign in keyless mode, and the signature bundle is verified by the workflow before it is uploaded alongside the file. The command users run to verify a download is documented with the signing process: cosign verify-blob --bundle hMailServer-x.y.z-x64.exe.cosign.bundle. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/sign-release.yml

Every release tag from v6.2.23-alpha2 on is an annotated tag signed with a maintainer's SSH key; the public keys are in .github/allowed_signers in the repository and the signing workflow refuses to sign the assets of a release whose tag is unsigned or lightweight. Verify with: git -c gpg.ssh.allowedSignersFile=.github/allowed_signers verify-tag v6.3.1 (https://github.com/Progressiverobot/hmailserver/blob/master/.github/SECURITY.md, 'Supply chain').

The server is a network-facing protocol implementation and validates untrusted input at the boundary. SMTP, IMAP and POP3 command parsing accepts only the grammar each command defines and rejects the rest; line-terminator handling is deliberately restrictive, with the bare-LF SMTP-smuggling rule (CVE-2023-51764) enforced and pinned by its own test; SQL is exclusively parameterised by project rule, so message and header content is never concatenated into a query; and inputs are additionally exercised by a libFuzzer harness suite under fuzz/. See https://github.com/Progressiverobot/hmailserver/tree/master/fuzz

The native binaries are built with the MSVC hardening defaults left in place rather than disabled: /GS buffer security checks, DEP (/NXCOMPAT) and ASLR (/DYNAMICBASE) are all active for the x64 Release configuration. Control Flow Guard is not currently enabled and is a candidate for a future build change. Beyond compiler hardening, the server refuses unsafe password-hash schemes for new secrets and verifies TLS peers by default. See https://github.com/Progressiverobot/hmailserver/blob/master/hmailserver/source/Server/hMailServer/hMailServer.vcxproj

ASSURANCE-CASE.md provides the assurance case: the security requirements as seven explicit claims (C1-C7); a threat model with actors A1-A6, assets and the principal attack surfaces; the trust boundaries B1-B6 with a diagram; the argument that secure design principles are applied (single management seam, complete mediation, fail-safe defaults, least privilege with a declared administrative boundary, defence in depth, separation of secrets, crypto agility); the argument that common implementation weaknesses are countered, mapped to CWE classes with the specific mechanisms; an evidence table per claim; and a plainly-stated residual-risk list. See https://github.com/Progressiverobot/hmailserver/blob/master/ASSURANCE-CASE.md

CodeQL checks for common vulnerabilities including buffer overflows, use-after-free, and SQL injection. See https://github.com/Progressiverobot/hmailserver/blob/master/.github/workflows/codeql.yml

The regression test suite covers unsafe operations including TLS handshakes, authentication, and protocol parsing. See https://github.com/Progressiverobot/hmailserver/blob/master/README.md