The first release run stopped at govulncheck: go.mod named 1.26.5, so
the workflow built with it, and 1.26.5 carries four standard-library
vulnerabilities the tool reaches (net/url GO-2026-6218, crypto/tls
GO-2026-6090, encoding/asn1 GO-2026-5972, net/http GO-2026-5026), all
fixed in 1.26.6. 1.26.8 is the current patch release; govulncheck is
clean on it, and it is also the minimum for building from source.
scripts/build-release.sh builds reproducible linux/amd64 and linux/arm64
archives with SHA256SUMS; the release workflow runs it on a v* tag after
vet, tests and govulncheck, and publishes the release. The README now
covers what the tool is, what it does step by step, why each decision is
made, how to deploy and run a mail host, the security model, and
troubleshooting. -h exits 0.
deploy stands up Stalwart 0.16, ihasmail and (for a mail host) Caddy as a
compose project: completes Stalwart's bootstrap over x:Bootstrap, links
ihasmail over the private network, requests certificates for both Caddy
(TLS-ALPN-01) and Stalwart (HTTP-01 through Caddy), makes the auto-ban safe
behind the proxy, and proves the link by signing in through the webmail.
--local gives a loopback-only pair. certs retries Stalwart's certificate;
destroy removes a deployment.
e2e/public.sh runs the whole mail-host path against Pebble with no
internet involved.
jcoffey-dev