Merge upstream v0.16.26 #196

Merged

jcoffey-dev merged 3 commits from merge/upstream-v0.16.26 into main

2026-10-12 15:19:01 +00:00

jcoffey-dev commented

2026-10-12 14:52:40 +00:00

Owner

Brings in upstream v0.16.26 as a stripped snapshot (1fd32c5, branch
import/upstream-v0.16.26; fast-forward upstream to it after this
lands). Closes #194. No release is planned yet.

v0.16.26:

sd_notify: the server tells systemd when it's ready and when it's
stopping. The unit template is now Type=notify; the prod units are
still Type=simple, where the notification is a no-op.
x86-64-v2 baseline: .cargo/config.toml builds glibc x86_64 with
target-cpu=x86-64-v2, and the binary checks the CPU at startup.
All three nodes qualify (checked: SSE3/SSSE3/SSE4.1/SSE4.2/POPCNT/
CMPXCHG16B/LAHF). The changed rustflags make the next CI build cold.
hickory from upstream's patched branch (DNSSEC fixes), vendored here,
see below.
Fixes: RocksDB blob GC rewriting every blob on each compaction of the
blobs column family; milter end-of-headers not sent with
SMFIP_NOHDRS without SMFIP_NOEOH (stalled transaction); OIDC building
the account from email without the userinfo endpoint when the
username claim is missing; Mailbox/set moving under a parent with a
same-named child, and rejecting case-only renames; EmailSubmission
onSuccessUpdateEmail/onSuccessDestroyEmail naming an existing
submission acting on the wrong Email; VacationResponse/set with only
isEnabled activating an empty script.

Strip: clean; same Enterprise footprint as v0.16.25; no new third-party
code; privacy catalog complete; build check clean.

Hickory: upstream patches hickory-proto/-net/-resolver to
github.com/stalwartlabs/hickory-dns (branch stalwart/0.26). Instead of
fetching from there at build time, vendor/hickory-dns holds the three
crates as cargo package makes them at the commit upstream pins
(f8b92b17), unmodified, MIT OR Apache-2.0; see its VENDORED.md. That
branch is hickory's own release/0.26 plus nine DNSSEC commits.
Cargo.lock has no hickory entry with a source line.

With it, hickory alone gets both answers 0.26.3 called bogus in
production right: the delegation below google.com (aspmx.l.google.com)
and the signed CNAME to a name without a TLSA record
(_25._tcp.mail.usefulinsight.com, through Hetzner's resolver over an
SSH tunnel, which still serves the signed CNAME). #72's recheck stays
as the fallback. 8a4f1fe: the ignored google test asserted that the
recheck path ran, so it failed once hickory got it right; it now
asserts the answer comes out insecure either way.

Merge:

Cargo.toml: the patch section keeps sieve-rs and points hickory at
vendor/.
Cargo.lock: upstream's, re-resolved against inbuxa's manifests; the
only versions that differ from upstream's are inbuxa itself and the
vendored hickory.
crates/main: inbuxa's name and AGPL-only license, 0.16.26; the
startup CPU message says inbuxa (notice added). sd_notify Stopping is
sent before the task locks are released.
.github/workflows/ci.yml: inbuxa's. Dockerfile.build (unused by
inbuxa's pipelines): upstream's new build stages with inbuxa's
package and runtime stages.
.dockerignore, .gitignore, manager/mod.rs: both sides.

Checked locally: every fork check (name, notice, context, privacy,
expr-schema, tool tests); cargo build -p inbuxa and cargo test --workspace --no-run; workspace unit tests (625 passed, smtp's with
test_mode); both ignored DNSSEC tests against the live resolvers;
store suite and JMAP suite (RocksDB); SMTP group serially (78 passed,
3 live-network tests skipped). Not run: the OIDC directory test
(needs Keycloak) and the system suite.

Brings in upstream v0.16.26 as a stripped snapshot (1fd32c5, branch import/upstream-v0.16.26; fast-forward `upstream` to it after this lands). Closes #194. No release is planned yet. v0.16.26: - sd_notify: the server tells systemd when it's ready and when it's stopping. The unit template is now `Type=notify`; the prod units are still `Type=simple`, where the notification is a no-op. - x86-64-v2 baseline: `.cargo/config.toml` builds glibc x86_64 with `target-cpu=x86-64-v2`, and the binary checks the CPU at startup. All three nodes qualify (checked: SSE3/SSSE3/SSE4.1/SSE4.2/POPCNT/ CMPXCHG16B/LAHF). The changed rustflags make the next CI build cold. - hickory from upstream's patched branch (DNSSEC fixes), vendored here, see below. - Fixes: RocksDB blob GC rewriting every blob on each compaction of the blobs column family; milter end-of-headers not sent with SMFIP_NOHDRS without SMFIP_NOEOH (stalled transaction); OIDC building the account from `email` without the userinfo endpoint when the username claim is missing; Mailbox/set moving under a parent with a same-named child, and rejecting case-only renames; EmailSubmission onSuccessUpdateEmail/onSuccessDestroyEmail naming an existing submission acting on the wrong Email; VacationResponse/set with only isEnabled activating an empty script. Strip: clean; same Enterprise footprint as v0.16.25; no new third-party code; privacy catalog complete; build check clean. Hickory: upstream patches hickory-proto/-net/-resolver to github.com/stalwartlabs/hickory-dns (branch stalwart/0.26). Instead of fetching from there at build time, vendor/hickory-dns holds the three crates as `cargo package` makes them at the commit upstream pins (f8b92b17), unmodified, MIT OR Apache-2.0; see its VENDORED.md. That branch is hickory's own release/0.26 plus nine DNSSEC commits. Cargo.lock has no hickory entry with a source line. With it, hickory alone gets both answers 0.26.3 called bogus in production right: the delegation below google.com (aspmx.l.google.com) and the signed CNAME to a name without a TLSA record (_25._tcp.mail.usefulinsight.com, through Hetzner's resolver over an SSH tunnel, which still serves the signed CNAME). #72's recheck stays as the fallback. 8a4f1fe: the ignored google test asserted that the recheck path ran, so it failed once hickory got it right; it now asserts the answer comes out insecure either way. Merge: - Cargo.toml: the patch section keeps sieve-rs and points hickory at vendor/. - Cargo.lock: upstream's, re-resolved against inbuxa's manifests; the only versions that differ from upstream's are inbuxa itself and the vendored hickory. - crates/main: inbuxa's name and AGPL-only license, 0.16.26; the startup CPU message says inbuxa (notice added). sd_notify Stopping is sent before the task locks are released. - .github/workflows/ci.yml: inbuxa's. Dockerfile.build (unused by inbuxa's pipelines): upstream's new build stages with inbuxa's package and runtime stages. - .dockerignore, .gitignore, manager/mod.rs: both sides. Checked locally: every fork check (name, notice, context, privacy, expr-schema, tool tests); `cargo build -p inbuxa` and `cargo test --workspace --no-run`; workspace unit tests (625 passed, smtp's with test_mode); both ignored DNSSEC tests against the live resolvers; store suite and JMAP suite (RocksDB); SMTP group serially (78 passed, 3 live-network tests skipped). Not run: the OIDC directory test (needs Keycloak) and the system suite.

jcoffey-dev added 3 commits 2026-10-12 14:52:40 +00:00

Import upstream v0.16.26, stripped 1fd32c51a0

Upstream commit: 18f4e9505027d790fd7e9fdad7f922be6719101d
Enterprise-only files removed or emptied: 63
Enterprise-only snippets removed: 118 in 50 files
Dangling module declarations removed: 5
Edits turning enterprise off: 25
Third-party code: 14 files, 0 not in THIRD-PARTY.md
Renamed identifiers: 67 in 19 files
Verification: clean

The same Enterprise footprint as v0.16.25. The build check is clean
apart from the expected errors in the rebuilt-feature tests. Adds
sd_notify readiness, an x86-64-v2 baseline for glibc x86_64 builds
with a startup CPU check, and hickory from upstream's patched branch.
Fixes RocksDB blob GC rewriting every blob on compaction, a milter
stall with SMFIP_NOHDRS, OIDC's email-claim fallback, Mailbox/set
moves and case-only renames, EmailSubmission onSuccess* naming an
existing submission, and VacationResponse/set enabling an empty script.

Merge upstream v0.16.26 a6d8f11f8f

Check the hickory upgrade test by its outcome

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 26m6s

Details

8a4f1febe5

The vendored hickory proves the delegation below google.com insecure
itself, so validated_lookup no longer takes the recheck path for
aspmx.l.google.com and the test's `validated.insecure` assertion failed.
Assert what matters instead: the answer comes out insecure, by either
path. Through Hetzner's resolver, hickory alone also accepts the
signed-CNAME TLSA denial now; the recheck stays as a fallback.

jcoffey-dev merged commit 10e2097e08 into main

2026-10-12 15:19:01 +00:00

jcoffey-dev deleted branch merge/upstream-v0.16.26

2026-10-12 15:19:01 +00:00

jcoffey-dev referenced this pull request

2026-10-12 15:20:08 +00:00

Say the vendored hickory leaves out .cargo_vcs_info.json #197

jcoffey-dev referenced this pull request

2026-10-12 15:50:18 +00:00

Release 2026.10.12.1 #198