hMailServer

An upgrade path is provided from every earlier hMailServer version. Installing over an existing deployment keeps the configuration and the mail, and the database upgrade chain is continuous: hmailserver/source/DBScripts, applied by the installer and by DBUpdater. SECURITY.md states that the 6.3 line is supported and that the answer for older versions is this in-place upgrade. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md

GitLab issues is the project's issue tracker, with labels for area, type and workflow state: https://gitlab.com/Progressiverobot/hmailserver/-/issues

The vulnerabilities resolved in the last 12 months (among them the REST settings routes in 6.3.3, the COM access checks in 6.2.10 and the JScript escaping flaw in 6.3.4) were all found by the project's own review or analysis, and none came from an outside report, so no reporter is uncredited; SECURITY.md commits to crediting reporters in the release notes unless they ask not to be named. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CHANGELOG.md

SECURITY.md documents the response: private report by confidential issue or Service Desk email, acknowledgement within 5 working days, assessment within 10, a fix with a regression test within 90 days, coordinated disclosure at 90 days, credit in the release notes, and a CVE ID requested through GitLab, which is a CNA. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md

CONTRIBUTING.md (Code style and licence headers) sets the rules contributions must follow. .editorconfig requires spaces with three to an indent in C++ and C#, a final newline and no trailing whitespace. C++ builds at warning level 3 with /WX, and dotnet format formats C#. SQL is parameterised only, a new setting goes in the database, and every source file carries the licence header. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#code-style-and-licence-headers

The style is declared in .editorconfig, and the editorconfig job of .gitlab-ci.yml runs editorconfig-checker (FLOSS) over every text file, with a negative control. No GitLab pipeline has run that job yet. Until 18 September 2026, GitHub's style workflow ran the same check on every push. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/.gitlab-ci.yml

The Linux build is CMake, which takes CC, CXX, CFLAGS, CXXFLAGS and LDFLAGS from the environment and passes them to the compiler and linker. CMakeLists.txt only appends its own options (add_compile_options) and never replaces CMAKE_C_FLAGS or CMAKE_CXX_FLAGS; build/ci/linux-build.sh chooses the compiler through CC and CXX. The Windows MSBuild build has no such variables and takes Configuration, Platform and PlatformToolset instead. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/CMakeLists.txt

The Windows projects set DebugInformationFormat ProgramDatabase and GenerateDebugInformation true, so every Release build writes a .pdb beside the binary. The CMake build honours CMAKE_BUILD_TYPE (Debug, RelWithDebInfo) and -g in CXXFLAGS, and cmake --install does not strip. The .deb and .rpm that CPack makes are stripped (CPACK_STRIP_FILES). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/hMailServer/hMailServer.vcxproj

No build is recursive. On Windows, one MSBuild solution (hMailServer.sln) resolves build order from the project references. On Linux, one CMakeLists.txt with no add_subdirectory builds the core library, the server and its test programs from a single dependency graph. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/CMakeLists.txt

The Windows server compiles and links with /Brepro, /d1trimfile and /pdbaltpath, with OPENSSL_NO_FILENAMES defined. Two clean Release builds of the same tree on one machine gave a byte-identical hMailServer.exe (first on 22 August 2026, recorded in Roadmap.md), and RELEASE.md step 8 requires that check for every release. The Linux build uses -ffile-prefix-map and SOURCE_DATE_EPOCH. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/RELEASE.md

On Windows, one Inno Setup installer (hMailServer-x.y.z-x64.exe) installs, upgrades in place and uninstalls from Apps and Features, and supports unattended install. On Linux, a .deb and an .rpm install and remove with the system package manager. The installer smoke test (install, upgrade, uninstall) is run by hand on a throwaway Windows Server 2025 VM, first on 25 September 2026, not in CI. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/README.md#installing

The Windows installer defaults to Program Files and honours Inno Setup's standard /DIR= switch (documented in the README's Unattended install table). The Linux install is CMake's install() with GNUInstallDirs, so it honours DESTDIR, and the .deb and .rpm are built through it. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/README.md#unattended-install

CONTRIBUTING.md lists every prerequisite with its pinned version and one command per component: scripts that download and build the external libraries with checked hashes, build.ps1, build-tools.ps1, build-tests.ps1, and the CMake/Ninja commands with the Debian/Ubuntu package list for Linux. The CI image build/ci/linux.Dockerfile is a ready-made Linux build and test environment. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#prerequisites

Dependencies are listed in machine-readable form: the .NET projects' committed NuGet lock files (packages.lock.json), the native libraries' pinned versions in the project files, and every vendored or fetched binary with its version, origin and SHA-256 in hmailserver/docs/third-party-binaries.json. SPDX and CycloneDX SBOMs were attached to the releases up to 6.3.3. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/third-party-binaries.json

The dependency-scan job in .gitlab-ci.yml (Trivy over the lock files and the CI image, OSV over the vendored libraries) was run by hand on the project's runner on 25 September 2026. What it found (zlib 1.3.1's CVE-2026-27171, and a 7-Zip 19.00 that OSV cannot match) was fixed the same day by moving to zlib 1.3.2 and 7-Zip 26.03; a finding that does not affect the project is dismissed with its reason in the VEX document. The job has not yet run in a GitLab pipeline; Renovate (renovate.json) waits for the owner's token and schedule, and Dependabot ran on GitHub until 18 September 2026. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ContinuousIntegration.md#security-scanning

Reused components are named and pinned where they can be updated: the .NET packages in committed NuGet lock files restored with --locked-mode, OpenSSL, Boost and libpq by version and source hash in the libraries/ build scripts, and every third-party binary by SHA-256 in hmailserver/docs/third-party-binaries.json, inventoried in ThirdPartyBinaries.md. Renovate (renovate.json) is configured to propose updates but waits for the owner's token and schedule. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ThirdPartyBinaries.md

The fork is built on current interfaces: Visual Studio 2026 (toolset v145), OpenSSL 4.0.x, Boost 1.92 and .NET 10 for the Control Panel and tools. The README's technology table records these versions, along with the plan to move OpenSSL to the next LTS. Deprecated protocol behaviour is kept only where a mail server must interoperate, and then behind a setting. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/README.md

Every code change reaches master only after the maintainer's full regression gate has passed on the tree that lands: the whole Windows regression suite (NUnit), split across two machines, and the whole Linux suite, each reporting the tests that passed and failed (CONTRIBUTING.md, Merge requests); documentation-only commits may follow a gated tree. GitHub Actions ran the automated suites on every push until 18 September 2026; the GitLab CI that replaces them is defined in .gitlab-ci.yml but has not yet run a full pipeline. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ContinuousIntegration.md

A bug is fixed with a regression test that fails against the build before the fix, as SECURITY.md and SUPPORT.md state. Examples: the 6.3.4 JScript escaping fix is pinned in RegressionTests/API/Events.cs, and the CVE-2023-51764 smuggling rule in SMTP/BareLineFeedEndOfData.cs. The automated NUnit suite has 495 C# files. Every change lands only after the maintainer runs the whole Windows suite, split across two machines, and the whole Linux suite. https://gitlab.com/Progressiverobot/hmailserver/-/tree/master/hmailserver/test/RegressionTests

The native server's coverage was measured once, on 15 September 2026: 73.48% of its lines (67,790 of 92,260 under hmailserver/source/Server) over the whole Windows regression suite, with OpenCppCoverage 0.9.9. That is below 80%. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/ASSURANCE-CASE.md

The policy is written in CONTRIBUTING.md: 'Add or update regression tests for a change of behaviour', and 'A fix ships with a test that fails against the build before it'; the merge-request template's checklist repeats it for new behaviour. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#merge-requests

The instructions for change proposals, CONTRIBUTING.md's 'Merge requests' section, say to add or update regression tests for a change of behaviour, and the merge-request template's checklist asks that new behaviour be covered by a regression test. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#merge-requests

The Windows build holds the server's own code to MSVC /W3 with /WX (vendored zlib alone is compiled at /W1), and the .NET projects are built with -warnaserror; moving a codebase of this age to /W4 would need mass suppression, and the Linux build adds no warning flags of its own. Beyond compiler warnings, cppcheck and clang-tidy (bugprone, cert, clang-analyzer and concurrency checks) were run over the sources on 25 September 2026 and their findings committed as a baseline, against which the CI job reports any new finding (allow_failure until the baseline is triaged). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#code-style-and-licence-headers

The server fails safe: a new installation is given a certificate, STARTTLS on every listener and TLS required for authentication from other hosts before it first listens. TLS peers are verified by default, and unsafe password-hash schemes are refused. Mediation is complete: all management goes through one API seam (COM, with REST on top), and SQL is parameterised by rule. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/SecureDefaults.md

The defaults do not depend on seriously weak algorithms. The default cipher list excludes DES, 3DES, MD5, export and null ciphers and lists ECDHE with AES-GCM first; TLS 1.3 is AEAD only; and the AEAD-ONLY preset removes the remaining CBC and SHA-1 HMAC suites. DKIM signs with SHA-256 by default and treats rsa-sha1 signatures as failing (RFC 8301) unless DkimAcceptSha1 is set. Passwords are hashed with PBKDF2 by default. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/AntiSpam/DKIM/DKIM.cpp

Algorithms are settings, not constants. Password hashing is PBKDF2 (the default), Argon2id or scrypt through PreferredHashAlgorithm, with a minimum accepted scheme. The TLS 1.2 cipher list (SslCipherList, with an AEAD-ONLY preset), the TLS 1.3 suites (TlsCipherSuites13) and the key-exchange groups (TlsKeyExchangeGroups) are all configurable, and DKIM signs with RSA-SHA256 or Ed25519. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/Application/IniFileSettings.cpp

TLS certificates and private keys, and DKIM private keys, are separate PEM files referenced by path from the configuration, and can be replaced without recompiling. Account passwords are stored only as hashes; credentials the server uses to sign in elsewhere (route relays, external accounts) are settings in the database, protected at rest, and changed without recompiling. No credential is compiled into the program. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/TCPIP/SslContextInitializer.cpp

SMTP, IMAP and POP3 support STARTTLS and implicit TLS. A new installation gets a certificate, offers STARTTLS on 25, 587, 110 and 143, and requires TLS for authentication from the Internet (SecureDefaults.md); a database that is upgraded or attached keeps its previous settings. The REST API (bound to 127.0.0.1) and the web-services listeners are off by default. The SNMP agent is off by default and speaks SNMPv3 authPriv, with v2c a separate opt-in. Outbound delivery supports DANE, MTA-STS and per-domain TLS policy. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/SecureDefaults.md

TLS 1.2 and 1.3 are the versions a new database enables (SslVersions 24). SSLv2 and SSLv3 cannot be enabled, and TLS 1.0 and 1.1 only by an explicit setting. The regression suite runs TLS 1.2 and 1.3 handshakes (RegressionTests/SSL/SslTlsVersionTests.cs). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/TCPIP/SslContextInitializer.cpp

Outbound TLS verifies certificates by default: a new database sets VerifyRemoteSslCertificate to 1. TCPConnection.cpp then sets verify_peer and verify_fail_if_no_peer_cert and installs a callback that checks the chain and the expected host name, with DANE-EE matching where TLSA records apply and MTA-STS forcing verification. Inbound client-certificate verification can be set per port. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp

The verify mode and callback are set on the socket before the handshake, and a failed verification fails the handshake. So the server, as a client, sends SMTP AUTH credentials or any other private data only over a connection that has already been verified. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/TCPIP/TCPConnection.cpp

Every release published on GitLab is signed, and SECURITY.md documents how to get the public keys and verify each signature: https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md#verifying-a-release. Release tags are SSH-signed with the key listed in the repository's allowed_signers file (also on the maintainer's GitLab account). Every asset of the releases from 6.2.19 to 6.3.3 carries a keyless Sigstore bundle recorded in the public Rekor log. The Windows installer is Authenticode-signed (Progressive Robot Ltd) since 6.3.1. From 6.3.4, the release's SHA256SUMS file, which lists the hash of every asset, is signed with the same SSH key (ssh-keygen -Y sign, verified with ssh-keygen -Y verify against allowed_signers). No private key is on a distribution site: Sigstore signing is keyless, the tag key stays on the maintainer's own machine, and the Authenticode key is held in Azure Artifact Signing.

Every release tag from v6.2.23-alpha2 on is an annotated tag signed with a maintainer's SSH key, and each verifies with git verify-tag against the allow list in the repository (.github/allowed_signers on master today, .gitlab/allowed_signers once the next batch lands); SECURITY.md's 'Verifying a release' gives the command. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md#verifying-a-release

Untrusted protocol input is checked at the boundary: SMTP, IMAP and POP3 commands are parsed against their grammar and anything else is refused. A bare LF before the end-of-data dot is refused (the SMTP smuggling rule, CVE-2023-51764), pinned by SMTP/BareLineFeedEndOfData.cs. SQL is parameterised by rule, and the MIME parser is fuzzed (fuzz/). https://gitlab.com/Progressiverobot/hmailserver/-/tree/master/fuzz

The Windows server is built with the MSVC hardening defaults left on (/GS, DEP, ASLR) and with Control Flow Guard (/guard:cf) in every configuration of hMailServer.vcxproj. The web pages it serves send Content-Security-Policy and X-Frame-Options: DENY, and unsafe password-hash schemes are refused for new secrets. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/hMailServer/hMailServer.vcxproj

ASSURANCE-CASE.md states the security requirements as seven claims (C1-C7). It covers the threat model (actors A1-A6, assets, attack surfaces) and the trust boundaries B1-B6 with a diagram, argues that secure design principles are applied, maps the countermeasures for common weaknesses to CWE classes (injection, memory corruption, smuggling, credential storage, randomness, certificate validation, resource exhaustion, supply chain), and gives evidence per claim and the residual risks. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/ASSURANCE-CASE.md

clang-tidy runs the cert-, bugprone- and clang-analyzer-* check families (build/ci/clang-tidy.yaml), which look for common C and C++ weaknesses such as memory errors, unchecked conversions and unsafe functions, and Semgrep runs its open rule packs for C#, Python, JavaScript and shell, which include security rules. Until 18 September 2026 CodeQL's security queries also ran on GitHub. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/build/ci/clang-tidy.yaml

The C++ MIME parser is fuzzed with libFuzzer under AddressSanitizer before every minor release (RELEASE.md step 8c; fuzz/, docs/Fuzzing.md). Before each release, the whole regression suite also runs on the assertion build, with a crash oracle that fails a test on any swallowed access violation. The nightly fuzz job (linux-fuzz) and an ASan/UBSan job over snmp-tests (linux-sanitize) are defined in .gitlab-ci.yml but have not yet run on GitLab; nightly fuzzing ran on GitHub until 18 September 2026. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/Fuzzing.md