hMailServer

遵循以下最佳实践的项目将能够自愿的自我认证，并显示他们已经实现了核心基础设施计划（OpenSSF）徽章。

没有一套可以保证软件永远不会有缺陷或漏洞的做法；如果规范或假设是错误的，即使合适的方法也可能失败。也没有哪些做法可以保证一个项目能够维持健康和运作良好的开发者社区。但是，遵循最佳做法可以帮助改善项目的成果。例如，一些做法可以在发布之前进行多人评估，这可以帮助您找到其他难以找到的技术漏洞，并帮助建立信任，并希望不同公司的开发人员之间进行重复的交互。要获得徽章，必须满足所有“必须”和“禁止”的条款，满足所有“应该”条款或有合适的理由，和所有“建议”条款必须满足或未满足（至少希望考虑）。欢迎通过 GitHub网站创建问题或提出请求进行反馈。另外还有一个一般讨论邮件列表。

如果这是您的项目，请在项目页面上显示您的基准徽章状态！基准徽章状态如下所示： 项目14949的基准徽章等级为in_progress 以下是如何嵌入基准徽章：
您可以通过将其嵌入到Markdown文件中来显示您的基准徽章状态：
[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14949/baseline)](https://www.bestpractices.dev/projects/14949)
或者将其嵌入到HTML中：
<a href="https://www.bestpractices.dev/projects/14949"><img src="https://www.bestpractices.dev/projects/14949/baseline"></a>


这些是基准等级2的标准。 这些是标准版本 v2026.08.28。

Baseline Series: 基准等级1 基准等级2 基准等级3

        

 基本

  • 常规

    请注意，其他项目可能使用相同的名称。

    hMailServer is a free, open-source mail server for Windows and Linux, implementing SMTP, IMAP and POP3, with webmail, a REST API and a Control Panel. It is a maintained fork of Martin Knafve's hMailServer, brought up to date with a current toolchain, current cryptography, and the transport-security and authentication standards expected of a mail server in 2026.

    请使用 SPDX许可证表达格式;例子包括“Apache-2.0”，“BSD-2-Clause”，“BSD-3-Clause”，“GPL-2.0+”，“LGPL-3.0 +”，“MIT”和“(BSD-2-Clause OR Ruby)”。
    如果有多种语言，请将它们列为逗号分隔值（可选空格），并将它们从最多到最少使用。如果有长列表，请至少列出前三个最常见的列表。如果没有语言（例如，这是仅文档或仅测试项目），请使用单个字符“ - ”。请使用每种语言的常规大小写，例如“JavaScript”。
    通用平台枚举（CPE）是用于信息技术系统，软件和软件包的结构化命名方案。在报告漏洞时，它可用于多个系统和数据库。

    This entry replaces https://www.bestpractices.dev/en/projects/14187, which was made through a GitHub login. GitHub suspended the project account on 18 September 2026, so that entry can no longer be edited. The project has lived on GitLab since 22 September 2026: https://gitlab.com/Progressiverobot/hmailserver. Every answer here was checked again against the project on 26 September 2026.

 控制 16/19 ●

  • 控制


    足够获得徽章！

    当执行CI/CD任务且未指定权限时，CI/CD系统必须将任务的权限默认为管道中授予的最低权限。 [OSPS-AC-04.01]
    配置项目的设置，默认情况下为新管道分配最低可用权限，仅在特定任务需要时才授予额外权限。

    A GitLab CI job that declares nothing gets only its own CI_JOB_TOKEN, which works on a limited set of API endpoints. The project refuses job-token pushes to the repository, and its inbound job-token allowlist holds only the project itself. A job gets no OIDC ID token unless it declares one. The five project CI/CD variables are Azure identifiers, not secrets, and all are protected. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/.gitlab-ci.yml


    足够获得徽章！

    当创建正式发布时，该发布必须分配一个唯一的版本标识符。 [OSPS-BR-02.01]
    为项目生成的每个发布分配一个唯一的版本标识符，遵循一致的命名约定或编号方案。示例包括SemVer、CalVer或git提交id。

    Every release has a unique SemVer tag (v6.3.0 to v6.3.3 on GitLab, with earlier releases re-published under their original tags). Tags are annotated and SSH-signed from v6.2.23-alpha2 on, and the v* tag pattern is protected. See https://gitlab.com/Progressiverobot/hmailserver/-/releases


    足够获得徽章！

    当创建正式发布时，该发布必须包含功能和安全修改的描述性日志。 [OSPS-BR-04.01]
    确保所有发布都包含描述性的变更日志。建议确保变更日志是人类可读的，并且包含超出提交消息的详细信息，例如安全影响的描述或与不同用例的相关性。为确保机器可读性，请将内容放在markdown标题下，例如"## Changelog"。

    Every release on GitLab carries human-written notes on functional and security changes (6.3.3's run to about 25 KB), and CHANGELOG.md keeps the same log per version, including the 6.3.4 section. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CHANGELOG.md


    足够获得徽章！

    当构建和发布管道摄取依赖项时，它必须使用标准化工具（如果可用）。 [OSPS-BR-05.01]
    为您的生态系统使用通用工具，例如包管理器或依赖项管理工具，以在构建时摄取依赖项。这可能包括使用依赖项文件、锁文件或清单来指定所需的依赖项，然后由构建系统拉入。

    The .NET projects use NuGet with committed lock files, restored with --locked-mode. The Linux build takes its libraries from the distribution's packages, in a CI image built from build/ci/linux.Dockerfile. OpenSSL, Boost and libpq are built from source archives at pinned versions, each checked against its SHA-256 (libraries/build-*.ps1), and every fetched binary input is pinned by hash in hmailserver/docs/third-party-binaries.json. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md


    足够获得徽章！

    当创建正式发布时，该发布必须进行签名或在包含每个资产加密哈希值的签名清单中进行说明。 [OSPS-BR-06.01]
    在构建时使用加密签名或证明（例如GPG或PGP签名、Sigstore签名、SLSA来源或SLSA VSA）对所有发布的软件资产进行签名。在签名清单或元数据文件中包含每个资产的加密哈希值。

    Every asset of the releases from 6.2.19 to 6.3.3 carries its own keyless Sigstore bundle, and the Windows installer is Authenticode-signed since 6.3.1. From 6.3.4 every release also carries a SHA256SUMS manifest with each asset's SHA-256, signed with the release-tag SSH key listed in the repository's allowed_signers file (ssh-keygen -Y sign; checked with ssh-keygen -Y verify). How to verify each: https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md#verifying-a-release


    足够获得徽章！

    当项目发布版本后，项目文档必须包含项目如何选择、获取和跟踪其依赖项的描述。 [OSPS-DO-06.01]
    建议在可公开查看的资源（如源代码存储库、项目网站或其他渠道）上与项目的技术和设计文档一起发布此信息。

    Several documents describe how dependencies are chosen, obtained and tracked. hmailserver/docs/ThirdPartyBinaries.md records each third-party build input: what it is, where it comes from, how the build fetches and hash-checks it, and why it is needed. SECURITY.md, "Supply chain" and "Dependencies", covers the pinned native libraries, the NuGet lock files, the dependency-scan job (Trivy and OSV) and Renovate (renovate.json). CONTRIBUTING.md lists the prerequisites. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ThirdPartyBinaries.md


    足够获得徽章！

    项目文档必须包含如何构建软件的说明，包括所需的库、框架、SDK 和依赖项。 [OSPS-DO-07.01]
    建议将此信息与项目的贡献者文档一起发布，例如在 CONTRIBUTING.md 或其他开发者任务文档中。也可以使用 Makefile 目标或其他自动化脚本来记录此信息。

    README.md, "Building hMailServer", and CONTRIBUTING.md, "Prerequisites" and "Building", give the toolchain (Visual Studio 2026 / v145, Inno Setup, Perl, Python; clang and CMake on Linux). They say how to build OpenSSL, Boost and libpq, and how to get the hash-checked build inputs, with the build scripts under build/. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#building


    足够获得徽章！

    项目文档必须包含有权访问敏感资源的项目成员列表。 [OSPS-GV-01.01]
    通过项目源代码存储库中的members.md、governance.md、maintainers.md或类似文件等工件记录项目参与者及其角色。这可以简单到在维护者列表中包含姓名或账户句柄，或者根据项目的治理更复杂。

    GOVERNANCE.md, 'Maintainers', names the project's two maintainers and their accounts: Christopher Holloway (Progressiverobot on GitLab, the Owner; chrisholloway5 on GitHub) and Zain Ul Abidin (Zainulabidin90 on GitHub; zainulabidin1990 on GitLab from the next batch). A table shows which duties each holds, and 'Critical assets' lists the credentials. GitLab's member list shows the three accounts and their roles. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/GOVERNANCE.md#maintainers


    足够获得徽章！

    项目文档必须包含对项目成员角色和职责的描述 [OSPS-GV-01.02]
    通过项目源代码存储库中的members.md、governance.md、maintainers.md或类似文件等工件记录项目参与者及其角色。

    GOVERNANCE.md describes the Maintainer, Contributor and Reporter roles and each one's responsibilities (accepting changes, releasing, security response, direction, infrastructure). It also has a table of which maintainer holds which duty today. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/GOVERNANCE.md#roles-and-responsibilities


    足够获得徽章！

    项目文档必须包含面向代码贡献者的指南，其中包含可接受贡献的要求。 [OSPS-GV-03.02]
    扩展项目文档中的CONTRIBUTING.md或CONTRIBUTING/的内容，以概述可接受的贡献要求，包括编码标准、测试要求和代码贡献者的提交指南。建议将该指南作为贡献者和批准者的真实来源。

    CONTRIBUTING.md sets the requirements for an acceptable contribution: one logical change, regression tests for behaviour changes, a warning-free build, parameterised SQL only, and settings in the database. It also covers the checkers to run, code style and licence headers, the change checklists (schema, COM, REST, UI), commit rules and DCO sign-off. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md


    不足以获得徽章。

    版本控制系统必须要求所有代码贡献者在每次提交时都声明他们在法律上有权作出相关贡献。 [OSPS-LE-01.01]
    在项目的代码库中包含一个DCO，要求代码贡献者在每次提交时断言他们有合法授权提交相关贡献。使用状态检查以确保完成此断言。CLA也满足此要求。某些版本控制系统（例如GitHub）可能会在平台服务条款中包含此项。

    CONTRIBUTING.md requires a DCO Signed-off-by, naming the commit's author, on every commit of a merge request from a fork. The sign-off job in .gitlab-ci.yml checks it, but no merge request has run it yet. The maintainers' own commits, which are almost all of master, are exempt and carry no sign-off, so not every commit carries the assertion. See https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#sign-off


    不足以获得徽章。

    当向主分支提交时，必须通过或手动绕过提交的任何自动化状态检查。 [OSPS-QA-03.01]
    配置项目的版本控制系统，要求所有自动化状态检查通过或在提交合并到主分支之前需要手动确认。建议不要将任何可选状态检查配置为批准者可能会绕过的通过或失败要求。

    master is protected (only Maintainers push, no force-push) and GitLab's 'pipelines must succeed' setting is on for merge requests, but changes reach master by the maintainer's fast-forward push, which no status check gates: .gitlab-ci.yml defines the checks, but no full pipeline has run on GitLab yet. Every change is landed only after the maintainer's own full regression gate, the whole Windows suite split across two machines plus the whole Linux suite. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ContinuousIntegration.md


    不足以获得徽章。

    在接受提交之前，项目的CI/CD管道必须运行至少一个自动化测试套件，以确保更改符合预期。 [OSPS-QA-06.01]
    应在每次合并到主分支之前运行自动化测试。测试套件应在CI/CD管道中运行，结果应对所有贡献者可见。测试套件应在一致的环境中运行，并应以允许贡献者在本地运行测试的方式运行。测试套件的示例包括单元测试、集成测试和端到端测试。

    No CI/CD pipeline tests a change before it is accepted yet. .gitlab-ci.yml defines the whole Windows suite (windows-gate), the whole Linux suite (linux-suite) and the .NET tests on the project's own runners for master, batch* and v* pipelines, but no pipeline running them has run on GitLab (every push pipeline so far was skipped). Today every change is landed only after the maintainer's own full regression gate: the whole Windows suite split across two machines, plus the whole Linux suite. GitHub Actions ran the CI tests until 18 September 2026. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ContinuousIntegration.md


    足够获得徽章！

    当项目发布版本时，项目文档必须包括设计文档，展示系统中的所有操作和参与者。 [OSPS-SA-01.01]
    在项目文档中包括说明操作和参与者的设计。参与者包括可以影响系统中另一段的任何子系统或实体。确保为新功能或重大更改更新此文档。

    ARCHITECTURE.md is the design document: the server's modules (SMTP, IMAP, POP3, the delivery queue, anti-spam and anti-virus, persistence over four database backends), the COM API as the management seam, the REST, metrics, web-services and ManageSieve listeners, scheduled work, the Linux build and the tests. ASSURANCE-CASE.md adds the actors (A1-A6) and the trust boundaries between them (B1-B6). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/ARCHITECTURE.md


    足够获得徽章！

    当项目发布版本时，项目文档必须包括对已发布软件资产的所有外部软件接口的描述。 [OSPS-SA-02.01]
    记录已发布软件资产的所有软件接口（API），解释用户如何与软件交互以及期望或产生什么数据。确保为新功能或重大更改更新此文档。

    README.md's Capabilities and Administration sections describe every external interface: SMTP, IMAP and POP3 with their extensions, ManageSieve, CardDAV and CalDAV, the REST API (which serves its own OpenAPI document at /api/v1/openapi.json), the Control Deck and webmail, Prometheus /metrics and health probes, OTLP export, SNMP and the COM API, with a document per feature under hmailserver/docs. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/README.md


    足够获得徽章！

    当项目发布版本时，项目必须执行安全评估，以了解软件中可能发生的最可能和最具影响力的潜在安全问题。 [OSPS-SA-03.01]
    执行安全评估可以告知项目成员和下游消费者，项目了解软件中可能出现的问题。了解可能实现的威胁有助于项目管理和应对风险。此信息对下游消费者很有用，可以证明项目的安全敏锐度和实践。确保为新功能或重大更改更新此文档。

    ASSURANCE-CASE.md is the project's security assessment: security claims C1-C7 argued with evidence, the threat model and trust boundaries, a CWE-by-CWE argument of how common weaknesses are countered, and the residual risk, with a status note on which checks ran on GitHub and what replaces them on GitLab. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/ASSURANCE-CASE.md


    足够获得徽章！

    项目文档必须包含协调漏洞披露（CVD）政策，并明确响应的时间框架。 [OSPS-VM-01.01]
    在目录根目录创建一个SECURITY.md文件，概述项目的协调漏洞披露政策。包括报告漏洞的方法。设定项目将如何响应和处理报告问题的期望。

    SECURITY.md is the coordinated vulnerability disclosure policy: report privately by confidential GitLab issue or Service Desk email; acknowledgement within 5 working days, initial assessment within 10, a fix within 90 days of acknowledgement, and publication when the fix ships or at 90 days, whichever comes first. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md


    足够获得徽章！

    项目文档必须提供一种方式，让贡献者能够直接向项目内的安全联系人私下报告漏洞。 [OSPS-VM-03.01]
    为安全研究人员提供一种方式，以私下向项目报告漏洞。这可能是专用电子邮件地址、Web表单、VCS专用工具、安全联系人的电子邮件地址或其他方法。

    SECURITY.md gives two private routes straight to the maintainers: a confidential GitLab issue with the Security template, visible only to the reporter and the project's members, or email to the Service Desk address contact-project+progressiverobot-hmailserver-86730559-issue-@incoming.gitlab.com, which GitLab files as a confidential issue, so no account is needed. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md#reporting-a-vulnerability


    足够获得徽章！

    项目文档必须公开发布已发现漏洞的相关数据。 [OSPS-VM-04.01]
    在可预测的公共渠道（例如CVE条目、博客文章或其他媒体）中提供有关已知漏洞的信息。在可能的情况下，此信息应包括受影响的版本、消费者如何确定他们是否容易受到攻击以及缓解或修复的说明。

    SECURITY.md: when a fix ships, the release notes describe the vulnerability, the confidential issue is made public, and a CVE ID requested through GitLab (a CNA) is quoted. The first vulnerability found in this fork, the JScript event-script injection fixed in 6.3.4, is described in CHANGELOG.md on master with the affected versions (6.0.0 to 6.3.3), the configurations exposed and the fix. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CHANGELOG.md



您可以使用工具和AI系统通过简单的URL提交变更建议，例如 https://www.bestpractices.dev/zh-CN/projects/14949/choose/edit?osps_ac_01_01_status=Met&osps_ac_01_01_justification=GitHub+enforced。请参阅我们的自动化提案系统，了解具体操作方法。 该数据可在社区数据许可协议 – 许可性，版本 2.0 (CDLA-Permissive-2.0)下获取。这意味着数据接收方可以共享数据，无论是否经过修改，只要数据接收方在共享数据时提供本协议文本。请注明christopher holloway和OpenSSF最佳实践徽章贡献者。

项目徽章条目拥有者： christopher holloway.
最后更新于 2026-09-26 05:28:20 UTC, 最后更新于 2026-09-26 06:16:51 UTC。 最后在 2026-09-26 05:45:21 UTC 获得通过徽章。