SieveManager

Source code is available at https://codeberg.org/odkr/sievemgr (primary) and https://notabug.org/odkr/sievemgr (secondary), both of which support the Git version control system and are publicly readable.

SieveManager follows the Git Flow branching model. Interim versions can be found in the devel branch, pre-release versions in the respective release branches.

Git is used.

SieveManager follows the Git Flow branching model. Each release has its own branch. Finalized releases are tagged v<version> (e.g., v0.7.4) in the main branch.

A human-readable change log is available at https://odkr.codeberg.page/sievemgr/changelog.

Bugs can be reported using an issue tracker on GitHub and by email.

Bugs can be reported using an issue tracker on GitHub. Bugs reported by email are posted on the issue tracker.

The issue tracker on GitHub includes an archive.

How vulnerabilities should be reported is detailed on https://odkr.codeberg.page/sievemgr/security.

People are asked to encrypt reports with GnuPG on https://odkr.codeberg.page/sievemgr/security.

The test suite can be invoked by python3 -munittest discover, which is standard.

See https://odkr.codeberg.page/sievemgr/contrib.

Technically true, there have been no major changes since the test suite and the test policy were added. The test suite still has a lot of catching up to do though.

Contributors are asked to write tests for their contributions on https://odkr.codeberg.page/sievemgr/contrib.

SieveManager is analysed with:

• Bandit
• DLint
• Flake8
• MyPy
• PyLint
• Pyright
• Ruff
• vermin
• vulture

Code with unaddressed warnings is neither committed, nor pushed, nor released. Git hooks and Make prerequisites are used to ensure this.

SieveManager secures connections with TLS by default and uses prefers secure password authentication mechanisms (SCRAM) over less secure ones if the server supports them.

TLS key lengths and hash iterations and SCRAM has iterations are beyond the control of SieveManager. SCRAM nonces are 144 bit.

Connections are secured with TLS v1.2+ by default and ManageSieve servers should reject attempts to authenticate using plaintext passwords over an insecure connection. SieveManager does support CRAM-MD5 and SCRAM-SHA-1 authentication, but CRAM-MD5 must be enabled by the user and is marked as obsolete in the documentation, and SCRAM-SHA-1 is mandated by RFC 5804 and only used if neither SCRAM-SHA-2 nor SCRAM-SHA-3 is supported by the server. Disabling TLS or OCSP is warned against in the documentation.

Support for SCRAM-SHA-1 is mandated by RFC 5804. But connections are secured with TLS by default, so the use of SHA-1 should not be problematic. Also, SCRAM-SHA-1 is only used if the server supports neither SCRAM-SHA-2 nor SCRAM-SHA-3, and SCRAM-SHA-1 is still preferable to plaintext authentication.

SieveManager is a client and leaves the choice of the cipher suite to the server.

SieveManager is distributed via Codeberg and the Python Package Index, both of which support HTTPS. Users may also download a GnuPG-signed tarball from Codeberg.

Linters and static code analysis tools are automatically run before each release.

Bandit and Dlint include such rules.

No vulnerabilities have been discovered so far. Code that contains vulnerabilities that can be discovered by static code analysis should be caught by the project's Git hooks and Make prerequisites before it is pushed to a repository, let alone released.

Git hooks are used to run MyPy and Bandit on each commit. Dlint is run on each push.

Python is a memory-safe language.