hMailServer

遵循以下最佳实践的项目将能够自愿的自我认证，并显示他们已经实现了核心基础设施计划（OpenSSF）徽章。

没有一套可以保证软件永远不会有缺陷或漏洞的做法；如果规范或假设是错误的，即使合适的方法也可能失败。也没有哪些做法可以保证一个项目能够维持健康和运作良好的开发者社区。但是，遵循最佳做法可以帮助改善项目的成果。例如，一些做法可以在发布之前进行多人评估，这可以帮助您找到其他难以找到的技术漏洞，并帮助建立信任，并希望不同公司的开发人员之间进行重复的交互。要获得徽章，必须满足所有“必须”和“禁止”的条款，满足所有“应该”条款或有合适的理由，和所有“建议”条款必须满足或未满足（至少希望考虑）。欢迎通过 GitHub网站创建问题或提出请求进行反馈。另外还有一个一般讨论邮件列表。

如果这是您的项目，请在项目页面上显示您的基准徽章状态！基准徽章状态如下所示： 项目14949的基准徽章等级为in_progress 以下是如何嵌入基准徽章：
您可以通过将其嵌入到Markdown文件中来显示您的基准徽章状态：
[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14949/baseline)](https://www.bestpractices.dev/projects/14949)
或者将其嵌入到HTML中：
<a href="https://www.bestpractices.dev/projects/14949"><img src="https://www.bestpractices.dev/projects/14949/baseline"></a>


这些是基准等级1的标准。 这些是标准版本 v2026.08.28。

Baseline Series: 基准等级1 基准等级2 基准等级3

        

 基本

  • 常规

    请注意，其他项目可能使用相同的名称。

    hMailServer is a free, open-source mail server for Windows and Linux, implementing SMTP, IMAP and POP3, with webmail, a REST API and a Control Panel. It is a maintained fork of Martin Knafve's hMailServer, brought up to date with a current toolchain, current cryptography, and the transport-security and authentication standards expected of a mail server in 2026.

    请使用 SPDX许可证表达格式;例子包括“Apache-2.0”，“BSD-2-Clause”，“BSD-3-Clause”，“GPL-2.0+”，“LGPL-3.0 +”，“MIT”和“(BSD-2-Clause OR Ruby)”。
    如果有多种语言，请将它们列为逗号分隔值（可选空格），并将它们从最多到最少使用。如果有长列表，请至少列出前三个最常见的列表。如果没有语言（例如，这是仅文档或仅测试项目），请使用单个字符“ - ”。请使用每种语言的常规大小写，例如“JavaScript”。
    通用平台枚举（CPE）是用于信息技术系统，软件和软件包的结构化命名方案。在报告漏洞时，它可用于多个系统和数据库。

    This entry replaces https://www.bestpractices.dev/en/projects/14187, which was made through a GitHub login. GitHub suspended the project account on 18 September 2026, so that entry can no longer be edited. The project has lived on GitLab since 22 September 2026: https://gitlab.com/Progressiverobot/hmailserver. Every answer here was checked again against the project on 26 September 2026.

 控制 22/24 ●

  • 控制


    足够获得徽章！

    当用户尝试读取或修改项目权威存储库中的敏感资源时，系统必须要求用户完成多因素认证过程。 [OSPS-AC-01.01]
    为项目的版本控制系统强制执行多因素认证，要求协作者在访问敏感数据或修改存储库设置时提供第二种形式的认证。通行密钥对于此控制是可接受的。

    Only the Owner account, Progressiverobot, can change project settings, CI/CD variables, protected branches and tags, or push master and v* tags, and it signs in with two-factor authentication. The two other members, zainulabidin1990 and chrisholloway5 (Developer), can read confidential issues, where security reports arrive, and also sign in with two-factor authentication. The project is in a personal namespace, so GitLab has no setting that enforces this for them. See https://gitlab.com/Progressiverobot/hmailserver/-/project_members


    足够获得徽章！

    当添加新的协作者时，版本控制系统必须要求手动分配权限，或默认将协作者权限限制为可用的最低权限。 [OSPS-AC-02.01]
    大多数公共版本控制系统都是这样配置的。确保项目的版本控制系统在添加协作者时始终默认分配最低可用权限,仅在必要时授予额外权限。

    GitLab never grants project access by itself: a member is added only by an Owner or Maintainer inviting them with an explicitly chosen role, and access requests are turned off for this project. Today there are three members: Progressiverobot (Owner) and zainulabidin1990 and chrisholloway5 (Developer). See https://gitlab.com/Progressiverobot/hmailserver/-/project_members


    不足以获得徽章。

    当尝试直接提交到项目的主分支时,强制机制必须阻止该更改的应用。 [OSPS-AC-03.01]
    如果VCS是集中式的,请在项目的VCS中对主分支设置分支保护。或者,使用去中心化方法,如Linux内核的方法,即先在另一个仓库中提出更改,将更改合并到主仓库需要特定的单独操作。

    master is a protected branch: force pushes are refused and only the Maintainer role or above may push or merge. Only the Owner account, Progressiverobot, holds that role, so every other account is refused a direct commit. But the maintainer lands changes by pushing master directly (a fast-forward after the full regression gate), and nothing prevents a direct commit from that account. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#merge-requests


    足够获得徽章！

    当尝试删除项目的主分支时,版本控制系统必须将此视为敏感活动,并要求明确确认意图。 [OSPS-AC-03.02]
    在项目的版本控制系统中对主分支设置分支保护以防止删除。

    master is the default branch, and GitLab refuses to delete the default branch. master is also protected: a git push cannot delete it, and only the Maintainer role or above can unprotect it, which only the Owner account holds. See https://gitlab.com/Progressiverobot/hmailserver/-/branches


    足够获得徽章！

    当CI/CD管道处理不受信任的元数据时，必须在这些参数用于管道之前对其进行清理和验证。 [OSPS-BR-01.01]
    CI/CD 流水线应对所有来自不可信来源的元数据输入进行清理（引用、转义或在期望值时退出）。这包括分支名称、提交消息、标签、拉取请求标题和作者信息等数据。

    The only CI job that handles metadata from outside the project is sign-off, which runs on a merge request from a fork. It reads commit authors, subjects and trailers into quoted shell variables, compares them as data and only prints them. Branch and tag names are compared in rules: and passed to scripts only as environment variables, never written into a command (SECURITY.md, "Branch and tag names in the pipelines"). See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/.gitlab-ci.yml


    足够获得徽章！

    当 CI/CD 流水线对不可信代码快照进行操作时，它必须阻止访问特权 CI/CD 凭据和资产。 [OSPS-BR-01.03]
    CI/CD 流水线应将不可信代码快照与特权凭据和资产隔离。特别是，项目应谨慎确保在协作者审查之前构建或执行代码的工作流无法访问 CI/CD 凭据。

    The project's two runners, linix and bench150, are registered ref_protected and locked, and do not run untagged jobs. The jobs that use them run only for protected refs (master, batch*, v*), never for a merge request. A merge request from a fork runs its pipeline in the fork, or on GitLab's shared runners when a maintainer runs it here, and either way sees no protected variable. No job on master declares an ID token; in the next batch only the release jobs for protected v* tags do. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ContinuousIntegration.md


    足够获得徽章！

    当项目将URI列为官方项目渠道时,该URI必须仅通过加密渠道交付。 [OSPS-BR-03.01]
    配置项目的网站和版本控制系统使用SSH或HTTPS等加密渠道进行数据传输。确保项目文档中引用的所有工具和域名只能通过加密渠道访问。

    The project's channels are HTTPS only: the GitLab project, issues, wiki and releases, the update feed https://updates.progressiverobot.com and https://www.progressiverobot.com. The forums SUPPORT.md names are also HTTPS only: https://www.hmailserver.com/forum/ on master, and https://www.hmailserver.co.uk/ from the next batch. Each of those four sites redirects plain HTTP to HTTPS (checked 26 September 2026), and Git is served over HTTPS and SSH only. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SUPPORT.md


    足够获得徽章！

    当项目将某个URI列为官方分发渠道时，该渠道必须使用经过加密身份验证的通道进行保护，以防止中间人攻击。 [OSPS-BR-03.02]
    项目分发的构件应通过能够确保完整性和真实性的渠道进行分发。使用HTTPS进行下载、签名发布或通过受信任的软件包管理器分发，都是防止中间人攻击的可接受方法。

    Releases are distributed only over HTTPS, from GitLab's release pages and package registry (https://gitlab.com/Progressiverobot/hmailserver/-/releases) and the HTTPS update feed. Assets are also signed: Sigstore bundles for every asset up to 6.3.3, and Authenticode on the Windows installer from 6.3.1.


    不足以获得徽章。

    项目必须防止在版本控制系统中意外存储未加密的敏感数据,例如机密和凭据。 [OSPS-BR-07.01]
    配置.gitignore或等效文件以排除可能包含敏感信息的文件。使用预提交钩子和自动扫描工具来检测和防止在提交中包含敏感数据。

    The repository holds no credential, but nothing on GitLab stops one from being committed today. GitLab's secret push protection needs Ultimate, and .gitignore excludes build output and logs but no secret-file patterns. A secret_detection job (GitLab's template, failing on any finding not listed in .gitleaksignore) comes in the next batch and has not run on GitLab yet. On 26 September 2026 a scan of the whole history with that job's image found no real secret. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md


    足够获得徽章！

    当项目发布版本后,项目文档必须包含所有基本功能的用户指南。 [OSPS-DO-01.01]
    为项目的所有基本功能创建用户指南或文档,说明如何安装、配置和使用项目的功能。如果存在任何已知的危险或破坏性操作,请包含高度可见的警告。

    README.md covers installation (Windows installer, Linux packages, unattended install), administration (Control Panel, REST API), and building, with a configuration reference. The 104 documents under hmailserver/docs cover operation, upgrade, migration and security, and the GitLab wiki (https://gitlab.com/Progressiverobot/hmailserver/-/wikis/home) has 63 pages of user guides. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/README.md


    足够获得徽章！

    当项目发布版本后,项目文档必须包含缺陷报告指南。 [OSPS-DO-02.01]
    建议项目使用其VCS默认问题跟踪器。如果使用外部来源,请确保项目文档和贡献指南清晰且明显地解释如何使用报告系统。建议项目文档还设定缺陷将如何分类和解决的期望。

    SUPPORT.md explains how to report a defect: a GitLab issue with the Bug template, and what to include (the log, the ERROR log, version, platform, database). It says what to expect and sends security problems to SECURITY.md. CONTRIBUTING.md, 'Reporting, asking and proposing', repeats the routes. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SUPPORT.md


    足够获得徽章！

    项目必须具有一种或多种机制，用于就拟议的更改和使用障碍进行公开讨论。 [OSPS-GV-02.01]
    在项目中建立一个或多个公开讨论机制,例如邮件列表、即时消息或问题跟踪器,以促进开放的沟通和反馈。

    The GitLab issue tracker is public. Proposed changes and questions are discussed there, and a Question template adds the question label. Merge requests are open to forks. SUPPORT.md also points usage questions to the hMailServer forum. See https://gitlab.com/Progressiverobot/hmailserver/-/work_items


    足够获得徽章！

    项目文档必须包含对贡献流程的说明，或明确声明不接受公开贡献 [OSPS-GV-03.01]
    创建一个CONTRIBUTING.md或CONTRIBUTING/目录来概述贡献流程，包括提交更改的步骤以及与项目维护者互动的方式。

    CONTRIBUTING.md explains the contribution process: how to report, ask and propose, then build, test, sign off, and open a merge request from a fork against master. It also explains how the maintainer reviews and lands the change. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md


    足够获得徽章！

    源代码的许可证必须符合OSI开源定义或FSF自由软件定义。 [OSPS-LE-02.01]
    向项目的代码仓库添加一个LICENSE文件，其中包含开放源代码促进会（OSI）批准的许可证，或自由软件基金会（FSF）批准的自由许可证。此类许可证的示例包括MIT、BSD 2-Clause、BSD 3-Clause修订版、Apache 2.0、较宽松GNU通用公共许可证（LGPL）和GNU通用公共许可证（GPL）。如果没有其他限制（如专利），发布到公共领域可以满足此控制要求。

    The source is licensed AGPL-3.0-or-later, which is OSI-approved and FSF-free. The full text is in LICENSE, the source headers carry SPDX-License-Identifier: AGPL-3.0-or-later, and GitLab detects the licence. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/LICENSE


    足够获得徽章！

    已发布软件资产的许可证必须符合OSI开源定义或FSF自由软件定义。 [OSPS-LE-02.02]
    如果已发布软件资产包含不同的许可证，请确保它是开放源代码促进会（OSI）批准的许可证，或自由软件基金会（FSF）批准的自由许可证。此类许可证的示例包括MIT、BSD 2-Clause、BSD 3-Clause修订版、Apache 2.0、较宽松GNU通用公共许可证（LGPL）和GNU通用公共许可证（GPL）。请注意，已发布软件资产的许可证可能与源代码的许可证不同。

    The released assets are the same AGPL-3.0-or-later software. The Windows installer shows the AGPL text at install time (LicenseFile=license.rtf, hmailserver/installation/License.rtf), and the .rpm declares License: AGPL-3.0-or-later. No other licence is applied to releases. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/installation/License.rtf


    足够获得徽章！

    源代码的许可证必须保存在对应存储库的LICENSE文件、COPYING文件、LICENSES/目录或LICENSE/目录中。 [OSPS-LE-03.01]
    将项目源代码的许可证包含在项目的LICENSE文件、COPYING文件、LICENSES/目录或LICENSE/目录中，以便清晰可见地说明许可条款。文件名可以带有扩展名。如果项目有多个存储库，请确保每个存储库都包含许可证文件。

    The licence text is in the LICENSE file at the root of the project's only repository. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/LICENSE


    足够获得徽章！

    已发布软件资产的许可证必须包含在已发布的源代码中，或包含在与相应发布资产一起提供的LICENSE文件、COPYING文件或LICENSE/目录中。 [OSPS-LE-03.02]
    将项目的已发布软件资产许可证包含在已发布的源代码中，或包含在与相应发布资产一起的LICENSE文件、COPYING文件或LICENSE/目录中，以提供许可条款的可见性和清晰性。文件名可以有扩展名。如果项目有多个仓库，请确保每个仓库都包含许可证文件。

    Each GitLab release includes the source archives of its tag, which contain the root LICENSE (AGPL-3.0-or-later), and the Windows installer shows the licence text during setup. See https://gitlab.com/Progressiverobot/hmailserver/-/releases


    足够获得徽章！

    项目的源代码存储库必须在一个静态URL上公开可读。 [OSPS-QA-01.01]
    使用常见的版本控制系统（VCS），如GitHub、GitLab或Bitbucket。确保仓库可公开读取。避免重复或镜像仓库，除非有高度可见的文档说明主要来源。避免频繁更改会影响仓库URL的仓库。确保仓库是公开的。

    The source code is publicly readable at the static URL https://gitlab.com/Progressiverobot/hmailserver (a public GitLab project, default branch master), the project's home since 22 September 2026, as the first lines of README.md say. The former GitHub copy has been unavailable since 18 September 2026. https://gitlab.com/Progressiverobot/hmailserver


    足够获得徽章！

    版本控制系统必须包含所有更改的可公开读取的记录，包括谁进行了更改以及更改的时间。 [OSPS-QA-01.02]
    使用常见的版本控制系统（VCS），如GitHub、GitLab或Bitbucket来维护可公开读取的提交历史记录。避免压缩或重写提交，以免掩盖任何提交的作者。

    The git history on GitLab is publicly readable and records the author, committer and date of every commit: master's 1,425 commits are the whole history carried over from GitHub plus every commit since, kept linear by fast-forward, and force-push is refused on the protected master branch. https://gitlab.com/Progressiverobot/hmailserver/-/commits/master


    足够获得徽章！

    当包管理系统支持时，源代码仓库必须包含一个依赖项列表，该列表涵盖直接的语言依赖项。 [OSPS-QA-02.01]
    这可以采用包管理器或语言依赖文件的形式，列举所有直接依赖项，如package.json、Gemfile或go.mod。

    Every .NET project with a PackageReference has a committed NuGet lock file (packages.lock.json), and three legacy test tools list theirs in packages.config; the Python tooling's requirements are pinned with hashes (build/requirements-dev.txt). The C++ server has no package manager: OpenSSL, Boost and libpq are pinned by version and source-archive hash in the libraries/build-*.ps1 scripts, and every binary build input is listed in hmailserver/docs/third-party-binaries.json (checked by SHA-256, by version for the MSVC runtime, and for presence for two of Windows' own type libraries). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ThirdPartyBinaries.md


    足够获得徽章！

    拥有多个存储库的项目必须记录属于该项目的代码库列表。 [OSPS-QA-04.01]
    记录由项目生成并编译到发布版本中的任何附加子项目代码仓库。此文档应包括相应代码库的状态和意图。

    hMailServer is a single-repository project: the C++ server, the .NET tools, the Control Deck and webmail, the tests, fuzz harnesses, installer, packaging and documentation are all built into releases from https://gitlab.com/Progressiverobot/hmailserver alone. The wiki belongs to the same GitLab project and is compiled into nothing.


    足够获得徽章！

    版本控制系统不得包含生成的可执行工件。 [OSPS-QA-05.01]
    删除项目版本控制系统中生成的可执行工件。建议在任何情况下，如果生成的可执行工件对测试等过程至关重要，应该在构建时生成，或单独存储并在特定的、有详细文档记录的管道步骤中获取。

    No generated executable is in version control. The one there was, the COM interop wrapper Interop.hMailServer.dll, has been generated at build time by build/generate-com-wrapper.ps1 since 11 September 2026. None of master's 6,983 tracked files has a PE, ELF or Mach-O header (checked 26 September 2026); the CI's Binary-Artifacts check (build/ci/repo-hygiene.py) tests the same. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Tools/Interop/README.md


    足够获得徽章！

    版本控制系统不得包含不可审查的二进制工件。 [OSPS-QA-05.02]
    不要将任何无法审查的二进制工件添加到项目的版本控制系统中。这包括可执行应用程序二进制文件、库文件和类似的工件。这不包括资产，如图形图像、声音或音乐文件以及通常以二进制格式存储的类似内容。

    Since 11 September 2026 the repository holds no executable or library binary: the forty third-party DLLs, MSIs and EXEs were removed, and the build fetches or gathers each one it still needs, checked against hmailserver/docs/third-party-binaries.json (SHA-256 for the fetched ones, version for the MSVC runtime, presence for two of Windows' own type libraries). What remains binary is images (icons, the Fat Cow icon archive, installer bitmaps), licence texts (RTF) and test fixtures (PST files, certificates, OpenPGP samples, fuzz regression inputs). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ThirdPartyBinaries.md


    足够获得徽章！

    项目文档必须包含安全联系人信息。 [OSPS-VM-02.01]
    创建一个security.md（或类似名称）文件，其中包含项目的安全联系人。

    SECURITY.md at the repository root gives the security contacts: a confidential GitLab issue (Security template) or email to the project's Service Desk address, contact-project+progressiverobot-hmailserver-86730559-issue-@incoming.gitlab.com, both reaching the maintainers, whom GOVERNANCE.md names. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md



您可以使用工具和AI系统通过简单的URL提交变更建议，例如 https://www.bestpractices.dev/zh-CN/projects/14949/choose/edit?osps_ac_01_01_status=Met&osps_ac_01_01_justification=GitHub+enforced。请参阅我们的自动化提案系统，了解具体操作方法。 该数据可在社区数据许可协议 – 许可性，版本 2.0 (CDLA-Permissive-2.0)下获取。这意味着数据接收方可以共享数据，无论是否经过修改，只要数据接收方在共享数据时提供本协议文本。请注明christopher holloway和OpenSSF最佳实践徽章贡献者。

项目徽章条目拥有者： christopher holloway.
最后更新于 2026-09-26 05:28:20 UTC, 最后更新于 2026-09-26 06:16:51 UTC。 最后在 2026-09-26 05:45:21 UTC 获得通过徽章。