diff options
Diffstat (limited to 'pkgs/by-name/st')
| -rw-r--r-- | pkgs/by-name/st/stalwart-mail-free/mail-send.nix | 20 | ||||
| -rw-r--r-- | pkgs/by-name/st/stalwart-mail-free/patches/crates-Use-the-platform-CA-bundle-instead-of-the-bun.patch | 879 | ||||
| -rw-r--r-- | pkgs/by-name/st/stalwart-mail-free/patches/crates-main-Cargo.toml-Use-libre-features.patch | 25 | ||||
| -rw-r--r-- | pkgs/by-name/st/stalwart-mail-patched/package.nix (renamed from pkgs/by-name/st/stalwart-mail-free/package.nix) | 51 | ||||
| -rw-r--r-- | pkgs/by-name/st/stalwart-mail-patched/patches/0001-Allow-to-switch-to-operating-system-CA-root-store.patch | 1214 | ||||
| -rw-r--r-- | pkgs/by-name/st/stalwart-mail-patched/spam-filter.nix (renamed from pkgs/by-name/st/stalwart-mail-free/spam-filter.nix) | 4 | ||||
| -rwxr-xr-x | pkgs/by-name/st/stalwart-mail-patched/update.sh.ignored | 5 |
7 files changed, 1244 insertions, 954 deletions
diff --git a/pkgs/by-name/st/stalwart-mail-free/mail-send.nix b/pkgs/by-name/st/stalwart-mail-free/mail-send.nix deleted file mode 100644 index e0d8c57..0000000 --- a/pkgs/by-name/st/stalwart-mail-free/mail-send.nix +++ /dev/null @@ -1,20 +0,0 @@ -{ - stdenv, - fetchFromGitHub, -}: -stdenv.mkDerivation (finalAttrs: { - pname = "mail-send"; - version = "0.5.0"; - - src = fetchFromGitHub { - owner = "stalwartlabs"; - repo = "mail-send"; - tag = "v${finalAttrs.version}"; - hash = "sha256-uDD4GLwjRpNqjtXPMask0twGW2Gcm1PFyDGXcfPS0F4="; - }; - - installPhase = '' - mkdir --parents "$out" - cp --recursive ./. "$out/" - ''; -}) diff --git a/pkgs/by-name/st/stalwart-mail-free/patches/crates-Use-the-platform-CA-bundle-instead-of-the-bun.patch b/pkgs/by-name/st/stalwart-mail-free/patches/crates-Use-the-platform-CA-bundle-instead-of-the-bun.patch deleted file mode 100644 index e6c3d4b..0000000 --- a/pkgs/by-name/st/stalwart-mail-free/patches/crates-Use-the-platform-CA-bundle-instead-of-the-bun.patch +++ /dev/null @@ -1,879 +0,0 @@ -From 6825a35213d604a7149265af2346a69143c0853b Mon Sep 17 00:00:00 2001 -From: Benedikt Peetz <benedikt.peetz@b-peetz.de> -Date: Tue, 4 Mar 2025 19:15:06 +0100 -Subject: [PATCH] crates/*: Use the platform CA bundle instead of the - bundled certificates - ---- - Cargo.lock | 284 ++++++++++++++++++++++++++++++- - crates/cli/Cargo.toml | 2 +- - crates/common/Cargo.toml | 4 +- - crates/directory/Cargo.toml | 4 +- - crates/imap/Cargo.toml | 2 +- - crates/jmap/Cargo.toml | 4 +- - crates/mail-send/Cargo.toml | 1 + - crates/mail-send/src/smtp/tls.rs | 22 +-- - crates/managesieve/Cargo.toml | 2 +- - crates/pop3/Cargo.toml | 2 +- - crates/smtp/Cargo.toml | 4 +- - crates/spam-filter/Cargo.toml | 4 +- - crates/store/Cargo.toml | 2 +- - crates/trc/Cargo.toml | 2 +- - crates/utils/Cargo.toml | 5 +- - crates/utils/src/lib.rs | 16 +- - tests/Cargo.toml | 10 +- - 17 files changed, 314 insertions(+), 56 deletions(-) - -diff --git a/Cargo.lock b/Cargo.lock -index be36759b..eca9699f 100644 ---- a/Cargo.lock -+++ b/Cargo.lock -@@ -440,6 +440,47 @@ dependencies = [ - "url", - ] - -+[[package]] -+name = "aws-lc-fips-sys" -+version = "0.13.3" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "29003a681b2b9465c1139bfb726da452a841a8b025f35953f3bce71139f10b21" -+dependencies = [ -+ "bindgen 0.69.5", -+ "cc", -+ "cmake", -+ "dunce", -+ "fs_extra", -+ "paste", -+ "regex", -+] -+ -+[[package]] -+name = "aws-lc-rs" -+version = "1.12.5" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "5e4e8200b9a4a5801a769d50eeabc05670fec7e959a8cb7a63a93e4e519942ae" -+dependencies = [ -+ "aws-lc-fips-sys", -+ "aws-lc-sys", -+ "paste", -+ "zeroize", -+] -+ -+[[package]] -+name = "aws-lc-sys" -+version = "0.26.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "0f9dd2e03ee80ca2822dd6ea431163d2ef259f2066a4d6ccaca6d9dcb386aa43" -+dependencies = [ -+ "bindgen 0.69.5", -+ "cc", -+ "cmake", -+ "dunce", -+ "fs_extra", -+ "paste", -+] -+ - [[package]] - name = "aws-region" - version = "0.25.5" -@@ -673,12 +714,15 @@ dependencies = [ - "itertools 0.12.1", - "lazy_static", - "lazycell", -+ "log", -+ "prettyplease", - "proc-macro2", - "quote", - "regex", - "rustc-hash 1.1.0", - "shlex", - "syn 2.0.96", -+ "which", - ] - - [[package]] -@@ -1035,6 +1079,12 @@ dependencies = [ - "smallvec", - ] - -+[[package]] -+name = "cesu8" -+version = "1.1.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c" -+ - [[package]] - name = "cexpr" - version = "0.6.0" -@@ -1347,6 +1397,16 @@ dependencies = [ - "libc", - ] - -+[[package]] -+name = "core-foundation" -+version = "0.10.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "b55271e5c8c478ad3f38ad24ef34923091e0548492a266d19b3c0b4d82574c63" -+dependencies = [ -+ "core-foundation-sys", -+ "libc", -+] -+ - [[package]] - name = "core-foundation-sys" - version = "0.8.7" -@@ -1912,6 +1972,12 @@ dependencies = [ - "zeroize", - ] - -+[[package]] -+name = "dunce" -+version = "1.0.5" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" -+ - [[package]] - name = "dyn-clone" - version = "1.0.17" -@@ -2117,6 +2183,29 @@ dependencies = [ - "syn 2.0.96", - ] - -+[[package]] -+name = "env_filter" -+version = "0.1.3" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0" -+dependencies = [ -+ "log", -+ "regex", -+] -+ -+[[package]] -+name = "env_logger" -+version = "0.11.6" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "dcaee3d8e3cfc3fd92428d477bc97fc29ec8716d180c0d74c643bb26166660e0" -+dependencies = [ -+ "anstream", -+ "anstyle", -+ "env_filter", -+ "humantime", -+ "log", -+] -+ - [[package]] - name = "equivalent" - version = "1.0.1" -@@ -2423,6 +2512,12 @@ dependencies = [ - "syn 2.0.96", - ] - -+[[package]] -+name = "fs_extra" -+version = "1.3.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" -+ - [[package]] - name = "funty" - version = "2.0.0" -@@ -2974,6 +3069,12 @@ version = "0.4.3" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "9994b79e8c1a39b3166c63ae7823bb2b00831e2a96a31399c50fe69df408eaeb" - -+[[package]] -+name = "humantime" -+version = "2.1.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4" -+ - [[package]] - name = "hyper" - version = "0.14.32" -@@ -3044,6 +3145,7 @@ dependencies = [ - "hyper 1.6.0", - "hyper-util", - "rustls 0.23.21", -+ "rustls-native-certs 0.8.1", - "rustls-pki-types", - "tokio", - "tokio-rustls 0.26.1", -@@ -3607,6 +3709,28 @@ dependencies = [ - "utils", - ] - -+[[package]] -+name = "jni" -+version = "0.21.1" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97" -+dependencies = [ -+ "cesu8", -+ "cfg-if", -+ "combine", -+ "jni-sys", -+ "log", -+ "thiserror 1.0.69", -+ "walkdir", -+ "windows-sys 0.45.0", -+] -+ -+[[package]] -+name = "jni-sys" -+version = "0.3.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130" -+ - [[package]] - name = "jobserver" - version = "0.1.32" -@@ -3959,14 +4083,18 @@ dependencies = [ - [[package]] - name = "mail-send" - version = "0.5.0" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "b12277cdcacfc15af67fe9cf155f31ff68ad8c301304573ea116ed8870f192d5" - dependencies = [ - "base64 0.22.1", -+ "env_logger", - "gethostname", -+ "mail-auth", -+ "mail-builder", -+ "mail-parser", - "md5", -+ "rand 0.8.5", - "rustls 0.23.21", - "rustls-pki-types", -+ "rustls-platform-verifier", - "smtp-proto", - "tokio", - "tokio-rustls 0.26.1", -@@ -5552,6 +5680,7 @@ dependencies = [ - "pin-project-lite", - "quinn", - "rustls 0.23.21", -+ "rustls-native-certs 0.8.1", - "rustls-pemfile 2.2.0", - "rustls-pki-types", - "serde", -@@ -5920,6 +6049,8 @@ version = "0.23.21" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "8f287924602bf649d949c63dc8ac8b235fa5387d394020705b80c4eb597ce5b8" - dependencies = [ -+ "aws-lc-rs", -+ "log", - "once_cell", - "ring 0.17.8", - "rustls-pki-types", -@@ -5937,7 +6068,7 @@ dependencies = [ - "openssl-probe", - "rustls-pemfile 1.0.4", - "schannel", -- "security-framework", -+ "security-framework 2.11.1", - ] - - [[package]] -@@ -5950,7 +6081,19 @@ dependencies = [ - "rustls-pemfile 2.2.0", - "rustls-pki-types", - "schannel", -- "security-framework", -+ "security-framework 2.11.1", -+] -+ -+[[package]] -+name = "rustls-native-certs" -+version = "0.8.1" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3" -+dependencies = [ -+ "openssl-probe", -+ "rustls-pki-types", -+ "schannel", -+ "security-framework 3.2.0", - ] - - [[package]] -@@ -5980,6 +6123,33 @@ dependencies = [ - "web-time", - ] - -+[[package]] -+name = "rustls-platform-verifier" -+version = "0.5.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "e012c45844a1790332c9386ed4ca3a06def221092eda277e6f079728f8ea99da" -+dependencies = [ -+ "core-foundation 0.10.0", -+ "core-foundation-sys", -+ "jni", -+ "log", -+ "once_cell", -+ "rustls 0.23.21", -+ "rustls-native-certs 0.8.1", -+ "rustls-platform-verifier-android", -+ "rustls-webpki 0.102.8", -+ "security-framework 3.2.0", -+ "security-framework-sys", -+ "webpki-root-certs", -+ "windows-sys 0.52.0", -+] -+ -+[[package]] -+name = "rustls-platform-verifier-android" -+version = "0.1.1" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" -+ - [[package]] - name = "rustls-webpki" - version = "0.101.7" -@@ -5996,6 +6166,7 @@ version = "0.102.8" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9" - dependencies = [ -+ "aws-lc-rs", - "ring 0.17.8", - "rustls-pki-types", - "untrusted 0.9.0", -@@ -6125,7 +6296,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02" - dependencies = [ - "bitflags 2.8.0", -- "core-foundation", -+ "core-foundation 0.9.4", -+ "core-foundation-sys", -+ "libc", -+ "security-framework-sys", -+] -+ -+[[package]] -+name = "security-framework" -+version = "3.2.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316" -+dependencies = [ -+ "bitflags 2.8.0", -+ "core-foundation 0.10.0", - "core-foundation-sys", - "libc", - "security-framework-sys", -@@ -6817,7 +7001,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7" - dependencies = [ - "bitflags 1.3.2", -- "core-foundation", -+ "core-foundation 0.9.4", - "system-configuration-sys", - ] - -@@ -7569,6 +7753,7 @@ dependencies = [ - "rustls 0.23.21", - "rustls-pemfile 2.2.0", - "rustls-pki-types", -+ "rustls-platform-verifier", - "serde", - "serde_json", - "smtp-proto", -@@ -7764,6 +7949,15 @@ dependencies = [ - "untrusted 0.9.0", - ] - -+[[package]] -+name = "webpki-root-certs" -+version = "0.26.8" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "09aed61f5e8d2c18344b3faa33a4c837855fe56642757754775548fee21386c4" -+dependencies = [ -+ "rustls-pki-types", -+] -+ - [[package]] - name = "webpki-roots" - version = "0.25.4" -@@ -7789,6 +7983,18 @@ dependencies = [ - "once_cell", - ] - -+[[package]] -+name = "which" -+version = "4.4.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7" -+dependencies = [ -+ "either", -+ "home", -+ "once_cell", -+ "rustix", -+] -+ - [[package]] - name = "whoami" - version = "1.5.2" -@@ -7886,6 +8092,15 @@ dependencies = [ - "windows-targets 0.52.6", - ] - -+[[package]] -+name = "windows-sys" -+version = "0.45.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0" -+dependencies = [ -+ "windows-targets 0.42.2", -+] -+ - [[package]] - name = "windows-sys" - version = "0.48.0" -@@ -7913,6 +8128,21 @@ dependencies = [ - "windows-targets 0.52.6", - ] - -+[[package]] -+name = "windows-targets" -+version = "0.42.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071" -+dependencies = [ -+ "windows_aarch64_gnullvm 0.42.2", -+ "windows_aarch64_msvc 0.42.2", -+ "windows_i686_gnu 0.42.2", -+ "windows_i686_msvc 0.42.2", -+ "windows_x86_64_gnu 0.42.2", -+ "windows_x86_64_gnullvm 0.42.2", -+ "windows_x86_64_msvc 0.42.2", -+] -+ - [[package]] - name = "windows-targets" - version = "0.48.5" -@@ -7944,6 +8174,12 @@ dependencies = [ - "windows_x86_64_msvc 0.52.6", - ] - -+[[package]] -+name = "windows_aarch64_gnullvm" -+version = "0.42.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8" -+ - [[package]] - name = "windows_aarch64_gnullvm" - version = "0.48.5" -@@ -7956,6 +8192,12 @@ version = "0.52.6" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" - -+[[package]] -+name = "windows_aarch64_msvc" -+version = "0.42.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43" -+ - [[package]] - name = "windows_aarch64_msvc" - version = "0.48.5" -@@ -7968,6 +8210,12 @@ version = "0.52.6" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" - -+[[package]] -+name = "windows_i686_gnu" -+version = "0.42.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f" -+ - [[package]] - name = "windows_i686_gnu" - version = "0.48.5" -@@ -7986,6 +8234,12 @@ version = "0.52.6" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" - -+[[package]] -+name = "windows_i686_msvc" -+version = "0.42.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060" -+ - [[package]] - name = "windows_i686_msvc" - version = "0.48.5" -@@ -7998,6 +8252,12 @@ version = "0.52.6" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" - -+[[package]] -+name = "windows_x86_64_gnu" -+version = "0.42.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36" -+ - [[package]] - name = "windows_x86_64_gnu" - version = "0.48.5" -@@ -8010,6 +8270,12 @@ version = "0.52.6" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" - -+[[package]] -+name = "windows_x86_64_gnullvm" -+version = "0.42.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3" -+ - [[package]] - name = "windows_x86_64_gnullvm" - version = "0.48.5" -@@ -8022,6 +8288,12 @@ version = "0.52.6" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" - -+[[package]] -+name = "windows_x86_64_msvc" -+version = "0.42.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0" -+ - [[package]] - name = "windows_x86_64_msvc" - version = "0.48.5" -diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml -index a2d19a06..76866b80 100644 ---- a/crates/cli/Cargo.toml -+++ b/crates/cli/Cargo.toml -@@ -13,7 +13,7 @@ resolver = "2" - [dependencies] - jmap-client = { version = "0.3", features = ["async"] } - mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"]} -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2"]} - tokio = { version = "1.23", features = ["full"] } - num_cpus = "1.13.1" - clap = { version = "4.1.6", features = ["derive"] } -diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml -index 3da0183f..93c49bb5 100644 ---- a/crates/common/Cargo.toml -+++ b/crates/common/Cargo.toml -@@ -16,7 +16,7 @@ sieve-rs = { version = "0.6" } - mail-parser = { version = "0.10", features = ["full_encoding"] } - mail-builder = { version = "0.4" } - mail-auth = { version = "0.6" } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - smtp-proto = { version = "0.1", features = ["serde_support"] } - dns-update = { version = "0.1" } - ahash = { version = "0.8.2", features = ["serde"] } -@@ -32,7 +32,7 @@ tokio = { version = "1.23", features = ["net", "macros"] } - tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] } - futures = "0.3" - rcgen = "0.12" --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]} -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2", "stream"]} - serde = { version = "1.0", features = ["derive"]} - serde_json = "1.0" - base64 = "0.22" -diff --git a/crates/directory/Cargo.toml b/crates/directory/Cargo.toml -index dc022e7a..10e0c00a 100644 ---- a/crates/directory/Cargo.toml -+++ b/crates/directory/Cargo.toml -@@ -12,7 +12,7 @@ trc = { path = "../trc" } - jmap_proto = { path = "../jmap-proto" } - smtp-proto = { version = "0.1" } - mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - mail-builder = { version = "0.4" } - tokio = { version = "1.23", features = ["net"] } - tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] } -@@ -34,7 +34,7 @@ futures = "0.3" - regex = "1.7.0" - serde = { version = "1.0", features = ["derive"]} - totp-rs = { version = "5.5.1", features = ["otpauth"] } --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"] } -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2"] } - serde_json = "1.0" - base64 = "0.22" - -diff --git a/crates/imap/Cargo.toml b/crates/imap/Cargo.toml -index 640ca4fd..d91931c1 100644 ---- a/crates/imap/Cargo.toml -+++ b/crates/imap/Cargo.toml -@@ -16,7 +16,7 @@ email = { path = "../email" } - nlp = { path = "../nlp" } - utils = { path = "../utils" } - mail-parser = { version = "0.10", features = ["full_encoding"] } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - rustls = { version = "0.23.5", default-features = false, features = ["std", "ring", "tls12"] } - rustls-pemfile = "2.0" - tokio = { version = "1.23", features = ["full"] } -diff --git a/crates/jmap/Cargo.toml b/crates/jmap/Cargo.toml -index 7be56e44..ad5ed795 100644 ---- a/crates/jmap/Cargo.toml -+++ b/crates/jmap/Cargo.toml -@@ -18,7 +18,7 @@ email = { path = "../email" } - smtp-proto = { version = "0.1" } - mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } - mail-builder = { version = "0.4" } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - mail-auth = { version = "0.6", features = ["generate"] } - sieve-rs = { version = "0.6" } - serde = { version = "1.0", features = ["derive"]} -@@ -38,7 +38,7 @@ p256 = { version = "0.13", features = ["ecdh"] } - hkdf = "0.12.3" - sha1 = "0.10" - sha2 = "0.10" --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"]} -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2"]} - tokio-tungstenite = "0.26" - tungstenite = "0.26" - chrono = "0.4" -diff --git a/crates/mail-send/Cargo.toml b/crates/mail-send/Cargo.toml -index fb5f402d..6760afab 100644 ---- a/crates/mail-send/Cargo.toml -+++ b/crates/mail-send/Cargo.toml -@@ -27,6 +27,7 @@ rustls = { version = "0.23", default-features = false, features = ["std"]} - tokio-rustls = { version = "0.26", default-features = false } - webpki-roots = { version = "0.26"} - rustls-pki-types = { version = "1" } -+rustls-platform-verifier = "0.5" - gethostname = { version = "0.5"} - - [dev-dependencies] -diff --git a/crates/mail-send/src/smtp/tls.rs b/crates/mail-send/src/smtp/tls.rs -index b15a6db8..7ddd0798 100644 ---- a/crates/mail-send/src/smtp/tls.rs -+++ b/crates/mail-send/src/smtp/tls.rs -@@ -12,9 +12,9 @@ use std::{convert::TryFrom, io, sync::Arc}; - - use rustls::{ - client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}, -- ClientConfig, ClientConnection, RootCertStore, SignatureScheme, -+ ClientConfig, ClientConnection, SignatureScheme, - }; --use rustls_pki_types::{ServerName, TrustAnchor}; -+use rustls_pki_types::ServerName; - use tokio::net::TcpStream; - use tokio_rustls::{client::TlsStream, TlsConnector}; - -@@ -78,20 +78,14 @@ impl SmtpClient<TlsStream<TcpStream>> { - } - - pub fn build_tls_connector(allow_invalid_certs: bool) -> TlsConnector { -+ use rustls_platform_verifier::BuilderVerifierExt; -+ -+ let config = ClientConfig::builder(); -+ - let config = if !allow_invalid_certs { -- let mut root_cert_store = RootCertStore::empty(); -- -- root_cert_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().map(|ta| TrustAnchor { -- subject: ta.subject.clone(), -- subject_public_key_info: ta.subject_public_key_info.clone(), -- name_constraints: ta.name_constraints.clone(), -- })); -- -- ClientConfig::builder() -- .with_root_certificates(root_cert_store) -- .with_no_client_auth() -+ config.with_platform_verifier().with_no_client_auth() - } else { -- ClientConfig::builder() -+ config - .dangerous() - .with_custom_certificate_verifier(Arc::new(DummyVerifier {})) - .with_no_client_auth() -diff --git a/crates/managesieve/Cargo.toml b/crates/managesieve/Cargo.toml -index 650ab23b..42738e68 100644 ---- a/crates/managesieve/Cargo.toml -+++ b/crates/managesieve/Cargo.toml -@@ -15,7 +15,7 @@ store = { path = "../store" } - utils = { path = "../utils" } - trc = { path = "../trc" } - mail-parser = { version = "0.10", features = ["full_encoding"] } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - sieve-rs = { version = "0.6" } - rustls = { version = "0.23.5", default-features = false, features = ["std", "ring", "tls12"] } - rustls-pemfile = "2.0" -diff --git a/crates/pop3/Cargo.toml b/crates/pop3/Cargo.toml -index 5f86ed00..89e7b732 100644 ---- a/crates/pop3/Cargo.toml -+++ b/crates/pop3/Cargo.toml -@@ -15,7 +15,7 @@ trc = { path = "../trc" } - jmap_proto = { path = "../jmap-proto" } - email = { path = "../email" } - mail-parser = { version = "0.10", features = ["full_encoding"] } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - rustls = { version = "0.23.5", default-features = false, features = ["std", "ring", "tls12"] } - tokio = { version = "1.23", features = ["full"] } - tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] } -diff --git a/crates/smtp/Cargo.toml b/crates/smtp/Cargo.toml -index 5997c1c3..5f5badc2 100644 ---- a/crates/smtp/Cargo.toml -+++ b/crates/smtp/Cargo.toml -@@ -21,7 +21,7 @@ email = { path = "../email" } - spam-filter = { path = "../spam-filter" } - trc = { path = "../trc" } - mail-auth = { version = "0.6" } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - mail-parser = { version = "0.10", features = ["full_encoding"] } - mail-builder = { version = "0.4" } - smtp-proto = { version = "0.1", features = ["serde_support"] } -@@ -47,7 +47,7 @@ blake3 = "1.3" - lru-cache = "0.1.2" - rand = "0.8.5" - x509-parser = "0.16.0" --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"] } -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2"] } - serde = { version = "1.0", features = ["derive", "rc"] } - serde_json = "1.0" - num_cpus = "1.15.0" -diff --git a/crates/spam-filter/Cargo.toml b/crates/spam-filter/Cargo.toml -index f5b63353..c9176cf6 100644 ---- a/crates/spam-filter/Cargo.toml -+++ b/crates/spam-filter/Cargo.toml -@@ -14,12 +14,12 @@ smtp-proto = { version = "0.1", features = ["serde_support"] } - mail-parser = { version = "0.10", features = ["full_encoding"] } - mail-builder = { version = "0.4" } - mail-auth = { version = "0.6" } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - tokio = { version = "1.23", features = ["net", "macros"] } - psl = "2" - hyper = { version = "1.0.1", features = ["server", "http1", "http2"] } - idna = "1.0" --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]} -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2", "stream"]} - decancer = "3.0.1" - unicode-security = "0.1.0" - infer = "0.16" -diff --git a/crates/store/Cargo.toml b/crates/store/Cargo.toml -index b0cf7d77..67c2d742 100644 ---- a/crates/store/Cargo.toml -+++ b/crates/store/Cargo.toml -@@ -15,7 +15,7 @@ rust-s3 = { version = "=0.35.0-alpha.2", default-features = false, features = [" - azure_core = { version = "0.21.0", optional = true } - azure_storage = { version = "0.21.0", default-features = false, features = ["enable_reqwest_rustls", "hmac_rust"], optional = true } - azure_storage_blobs = { version = "0.21.0", default-features = false, features = ["enable_reqwest_rustls", "hmac_rust"], optional = true } --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]} -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2", "stream"]} - tokio = { version = "1.23", features = ["sync", "fs", "io-util"] } - r2d2 = { version = "0.8.10", optional = true } - futures = { version = "0.3", optional = true } -diff --git a/crates/trc/Cargo.toml b/crates/trc/Cargo.toml -index e4f2ca7c..f294e469 100644 ---- a/crates/trc/Cargo.toml -+++ b/crates/trc/Cargo.toml -@@ -11,7 +11,7 @@ mail-parser = { version = "0.10", features = ["full_encoding"] } - base64 = "0.22.1" - serde = "1.0" - serde_json = "1.0.120" --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"]} -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2"]} - bincode = "1.3.3" - rtrb = "0.3.1" - parking_lot = "0.12.3" -diff --git a/crates/utils/Cargo.toml b/crates/utils/Cargo.toml -index e0a7ef9d..14b1d675 100644 ---- a/crates/utils/Cargo.toml -+++ b/crates/utils/Cargo.toml -@@ -9,12 +9,13 @@ trc = { path = "../trc" } - rustls = { version = "0.23.5", default-features = false, features = ["std", "ring", "tls12"] } - rustls-pemfile = "2.0" - rustls-pki-types = { version = "1" } -+rustls-platform-verifier = "0.5" - tokio = { version = "1.23", features = ["net", "macros"] } - tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] } - serde = { version = "1.0", features = ["derive"]} - mail-auth = { version = "0.6" } - smtp-proto = { version = "0.1" } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - ahash = { version = "0.8" } - chrono = "0.4" - rand = "0.8.5" -@@ -23,7 +24,7 @@ ring = { version = "0.17" } - base64 = "0.22" - serde_json = "1.0" - rcgen = "0.13" --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]} -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2", "stream"]} - x509-parser = "0.16.0" - pem = "3.0" - parking_lot = "0.12" -diff --git a/crates/utils/src/lib.rs b/crates/utils/src/lib.rs -index acec2f04..b2cdaf65 100644 ---- a/crates/utils/src/lib.rs -+++ b/crates/utils/src/lib.rs -@@ -18,9 +18,9 @@ use futures::StreamExt; - use reqwest::Response; - use rustls::{ - client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}, -- ClientConfig, RootCertStore, SignatureScheme, -+ ClientConfig, SignatureScheme, - }; --use rustls_pki_types::TrustAnchor; -+use rustls_platform_verifier::BuilderVerifierExt; - - pub const BLOB_HASH_LEN: usize = 32; - -@@ -280,17 +280,7 @@ pub fn rustls_client_config(allow_invalid_certs: bool) -> ClientConfig { - let config = ClientConfig::builder(); - - if !allow_invalid_certs { -- let mut root_cert_store = RootCertStore::empty(); -- -- root_cert_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().map(|ta| TrustAnchor { -- subject: ta.subject.clone(), -- subject_public_key_info: ta.subject_public_key_info.clone(), -- name_constraints: ta.name_constraints.clone(), -- })); -- -- config -- .with_root_certificates(root_cert_store) -- .with_no_client_auth() -+ config.with_platform_verifier().with_no_client_auth() - } else { - config - .dangerous() -diff --git a/tests/Cargo.toml b/tests/Cargo.toml -index 6aa6d35b..256a574b 100644 ---- a/tests/Cargo.toml -+++ b/tests/Cargo.toml -@@ -34,12 +34,12 @@ spam-filter = { path = "../crates/spam-filter", features = ["test_mode", "enterp - trc = { path = "../crates/trc" } - managesieve = { path = "../crates/managesieve", features = ["test_mode", "enterprise"] } - smtp-proto = { version = "0.1" } --mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } -+mail-send = { path = "../crates/mail-send", default-features = false, features = ["cram-md5", "ring", "tls12"] } - mail-auth = { version = "0.6", features = ["test"] } --sieve-rs = { version = "0.6" } -+sieve-rs = { version = "0.6" } - utils = { path = "../crates/utils", features = ["test_mode"] } --jmap-client = { version = "0.3", features = ["websockets", "debug", "async"] } --mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } -+jmap-client = { version = "0.3", features = ["websockets", "debug", "async"] } -+mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } - tokio = { version = "1.23", features = ["full"] } - tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] } - rustls = { version = "0.23.5", default-features = false, features = ["std", "ring", "tls12"] } -@@ -50,7 +50,7 @@ rayon = { version = "1.5.1" } - flate2 = { version = "1.0.17", features = ["zlib"], default-features = false } - serde = { version = "1.0", features = ["derive"]} - serde_json = "1.0" --reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "multipart", "http2"]} -+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "multipart", "http2"]} - bytes = "1.4.0" - futures = "0.3" - ece = "2.2" --- -2.47.2 - diff --git a/pkgs/by-name/st/stalwart-mail-free/patches/crates-main-Cargo.toml-Use-libre-features.patch b/pkgs/by-name/st/stalwart-mail-free/patches/crates-main-Cargo.toml-Use-libre-features.patch deleted file mode 100644 index 5844793..0000000 --- a/pkgs/by-name/st/stalwart-mail-free/patches/crates-main-Cargo.toml-Use-libre-features.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 763d22e53a9c99addbd7f9ca84f0083733f3d10d Mon Sep 17 00:00:00 2001 -From: Benedikt Peetz <benedikt.peetz@b-peetz.de> -Date: Tue, 4 Mar 2025 19:00:15 +0100 -Subject: [PATCH] crates/main/Cargo.toml: Use libre features - ---- - crates/main/Cargo.toml | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/crates/main/Cargo.toml b/crates/main/Cargo.toml -index 036d2dcf..709ae5da 100644 ---- a/crates/main/Cargo.toml -+++ b/crates/main/Cargo.toml -@@ -35,7 +35,7 @@ jemallocator = "0.5.0" - - [features] - #default = ["sqlite", "postgres", "mysql", "rocks", "elastic", "s3", "redis", "azure", "enterprise"] --default = ["rocks", "enterprise"] -+default = ["rocks", "redis"] - sqlite = ["store/sqlite"] - foundationdb = ["store/foundation", "common/foundation"] - postgres = ["store/postgres"] --- -2.47.2 - diff --git a/pkgs/by-name/st/stalwart-mail-free/package.nix b/pkgs/by-name/st/stalwart-mail-patched/package.nix index 19405c7..f9bcdaa 100644 --- a/pkgs/by-name/st/stalwart-mail-free/package.nix +++ b/pkgs/by-name/st/stalwart-mail-patched/package.nix @@ -1,61 +1,56 @@ { - pkgsUnstable, + stalwart-mail, callPackage, nixLib, + rustPlatform, + lib, }: let spamfilter = callPackage ./spam-filter.nix {}; - - mail-send = callPackage ./mail-send.nix {}; - - # Need to use the newer `rustPlatform` - inherit (pkgsUnstable) rustPlatform; in - pkgsUnstable.stalwart-mail.override { + stalwart-mail.override { rustPlatform = rustPlatform // { - buildRustPackage = prev: + buildRustPackage = prev_base: let + prev = lib.fix prev_base; + in rustPlatform.buildRustPackage ( + lib.attrsets.recursiveUpdate prev - // { - pname = "stalwart-mail-free"; + { + pname = "stalwart-mail-patched"; + passthru = nixLib.warnMerge (prev.passthru or {}) { + # Use a reproducible source for the spamfilter + # instead of fetching it at runtime from GitHub. inherit spamfilter; } "stalwart-mail passthru"; - useFetchCargoVendor = true; - cargoHash = "sha256-FCRsmH9ZGYaf9ss3ECjZQkknIxAaDj9cedW32dWmBGY="; + cargoHash = "sha256-Rq18JumjKYt97WKIqnLakS+FQwsjt70irlYBYAYm3H8="; - # The tests should check if this works. + # The NixOS build tests should check if this works. # And this shaves of around 50% of the build time. doCheck = false; + # We are already overriding it, so shaving of some unused features is okay. buildNoDefaultFeatures = true; buildFeatures = [ + # "sqlite" + # "postgres" + # "mysql" "rocks" + # "elastic" + # "s3" "redis" + "tls-native-roots" ]; - postUnpack = - (prev.postUnpack or "") - + '' - cp --recursive "${mail-send}" ./source/crates/mail-send - chmod --recursive +w "./source/crates/mail-send" - ''; - cargoPatches = (prev.cargoPatches or []) ++ [ - # `stalwart-mail` does enable their `enterprise` feature per default. - # We want a AGPL only build (i.e., without unfree dependencies), therefore disable the - # `enterprise` feature here. - # We cannot use the `buildFeatures` attribute because it does not actually change the - # correct features. As such we simply patch the correct `Cargo.toml` file. - ./patches/crates-main-Cargo.toml-Use-libre-features.patch - # `stalwart-mail` uses their bundled store, which makes it impossible to use our # own CA certificate (e.g., for tests). Thus use a native version. - ./patches/crates-Use-the-platform-CA-bundle-instead-of-the-bun.patch + ./patches/0001-Allow-to-switch-to-operating-system-CA-root-store.patch ]; # Check that the enterprise feature is really disabled. diff --git a/pkgs/by-name/st/stalwart-mail-patched/patches/0001-Allow-to-switch-to-operating-system-CA-root-store.patch b/pkgs/by-name/st/stalwart-mail-patched/patches/0001-Allow-to-switch-to-operating-system-CA-root-store.patch new file mode 100644 index 0000000..17ab1f4 --- /dev/null +++ b/pkgs/by-name/st/stalwart-mail-patched/patches/0001-Allow-to-switch-to-operating-system-CA-root-store.patch @@ -0,0 +1,1214 @@ +From af19ac6465bc3f76b61deef15fcdf0a97eaa0904 Mon Sep 17 00:00:00 2001 +From: aszlig <aszlig@nix.build> +Date: Wed, 21 May 2025 19:03:55 +0200 +Subject: [PATCH] Allow to switch to operating system CA root store + +So far, we only used the root CA certificates from the "webpki-roots" +crate, which makes it very difficult if you want to run a custom CA. + +In my case I'm running automated tests of full production systems, which +also includes an ACME setup that injects a Pebble instance into the +system's CA certificates. + +Since Stalwart doesn't use the system's root CA certificate store, it's +very difficult to inject the certificate for the Pebble instance. + +Given that there's also some interest (issue #247) for doing this in an +enterprise environment with intranet CAs, I decided to generalise this +far enough that it can not only be used in my downstream setup. + +Currently, this doesn't fully address the issue, since in the long term +this might be something we'd want to configure at runtime, as per +@mdecimus's comment[1]: + +> A slightly more complex approach is required that allows the user to +> select at runtime which CA store to use. + +However, this makes it at least easier to switch to native root CA store +by simply recompiling with the "tls-native-roots" feature. + +[1]: https://github.com/stalwartlabs/stalwart/issues/247#issuecomment-2437039500 + +Signed-off-by: aszlig <aszlig@nix.build> +Issue: https://github.com/stalwartlabs/stalwart/issues/247 +--- + Cargo.lock | 237 +++++++++++++++++-- + crates/cli/Cargo.toml | 8 +- + crates/cli/src/main.rs | 8 +- + crates/common/Cargo.toml | 2 +- + crates/common/src/enterprise/llm.rs | 2 +- + crates/common/src/enterprise/mod.rs | 4 +- + crates/common/src/lib.rs | 3 +- + crates/common/src/listener/acme/directory.rs | 6 +- + crates/common/src/manager/mod.rs | 2 +- + crates/common/src/scripts/plugins/http.rs | 2 +- + crates/common/src/telemetry/webhooks/mod.rs | 2 +- + crates/directory/Cargo.toml | 4 +- + crates/directory/src/backend/oidc/lookup.rs | 4 +- + crates/jmap/Cargo.toml | 2 +- + crates/main/Cargo.toml | 13 +- + crates/smtp/Cargo.toml | 8 +- + crates/smtp/src/inbound/hooks/client.rs | 2 +- + crates/smtp/src/outbound/mta_sts/lookup.rs | 3 +- + crates/smtp/src/reporting/tls.rs | 5 +- + crates/spam-filter/Cargo.toml | 4 +- + crates/spam-filter/src/analysis/url.rs | 2 +- + crates/store/Cargo.toml | 2 +- + crates/store/src/backend/azure/mod.rs | 2 +- + crates/store/src/backend/http/lookup.rs | 2 +- + crates/trc/Cargo.toml | 4 +- + crates/utils/Cargo.toml | 2 + + crates/utils/src/lib.rs | 41 +++- + crates/utils/src/suffixlist.rs | 7 +- + tests/Cargo.toml | 2 +- + tests/src/jmap/auth_oauth.rs | 6 +- + tests/src/jmap/mod.rs | 4 +- + tests/src/smtp/management/queue.rs | 2 +- + 32 files changed, 309 insertions(+), 88 deletions(-) + +diff --git a/Cargo.lock b/Cargo.lock +index 21c7f726..67fe5739 100644 +--- a/Cargo.lock ++++ b/Cargo.lock +@@ -410,7 +410,7 @@ checksum = "412b79ce053cef36eda52c25664b45ec92a21769488e20d5a8bf0b3c9e1a28cb" + dependencies = [ + "http 1.2.0", + "log", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "serde", + "serde_json", + "url", +@@ -1035,6 +1035,12 @@ dependencies = [ + "smallvec", + ] + ++[[package]] ++name = "cesu8" ++version = "1.1.0" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c" ++ + [[package]] + name = "cexpr" + version = "0.6.0" +@@ -1250,7 +1256,7 @@ dependencies = [ + "reqwest 0.12.12", + "ring 0.17.8", + "rsa", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pemfile 2.2.0", + "rustls-pki-types", + "serde", +@@ -1347,6 +1353,16 @@ dependencies = [ + "libc", + ] + ++[[package]] ++name = "core-foundation" ++version = "0.10.1" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6" ++dependencies = [ ++ "core-foundation-sys", ++ "libc", ++] ++ + [[package]] + name = "core-foundation-sys" + version = "0.8.7" +@@ -1819,7 +1835,7 @@ dependencies = [ + "pwhash", + "regex", + "reqwest 0.12.12", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pki-types", + "scrypt", + "serde", +@@ -3056,7 +3072,8 @@ dependencies = [ + "http 1.2.0", + "hyper 1.6.0", + "hyper-util", +- "rustls 0.23.21", ++ "rustls 0.23.27", ++ "rustls-native-certs 0.8.1", + "rustls-pki-types", + "tokio", + "tokio-rustls 0.26.1", +@@ -3296,7 +3313,7 @@ dependencies = [ + "nlp", + "parking_lot", + "rand 0.9.0", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pemfile 2.2.0", + "store", + "tokio", +@@ -3620,6 +3637,28 @@ dependencies = [ + "utils", + ] + ++[[package]] ++name = "jni" ++version = "0.21.1" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97" ++dependencies = [ ++ "cesu8", ++ "cfg-if", ++ "combine", ++ "jni-sys", ++ "log", ++ "thiserror 1.0.69", ++ "walkdir", ++ "windows-sys 0.45.0", ++] ++ ++[[package]] ++name = "jni-sys" ++version = "0.3.0" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130" ++ + [[package]] + name = "jobserver" + version = "0.1.32" +@@ -3978,7 +4017,7 @@ dependencies = [ + "base64 0.22.1", + "gethostname", + "md5", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pki-types", + "smtp-proto", + "tokio", +@@ -4022,7 +4061,7 @@ dependencies = [ + "mail-send", + "md5", + "parking_lot", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pemfile 2.2.0", + "sieve-rs", + "store", +@@ -4841,7 +4880,7 @@ dependencies = [ + "jmap_proto", + "mail-parser", + "mail-send", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "store", + "tokio", + "tokio-rustls 0.26.1", +@@ -5152,7 +5191,7 @@ dependencies = [ + "quinn-proto", + "quinn-udp", + "rustc-hash 2.1.0", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "socket2", + "thiserror 2.0.11", + "tokio", +@@ -5170,7 +5209,7 @@ dependencies = [ + "rand 0.8.5", + "ring 0.17.8", + "rustc-hash 2.1.0", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pki-types", + "slab", + "thiserror 2.0.11", +@@ -5452,7 +5491,7 @@ dependencies = [ + "percent-encoding", + "pin-project-lite", + "rand 0.8.5", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-native-certs 0.7.3", + "rustls-pemfile 2.2.0", + "rustls-pki-types", +@@ -5595,7 +5634,8 @@ dependencies = [ + "percent-encoding", + "pin-project-lite", + "quinn", +- "rustls 0.23.21", ++ "rustls 0.23.27", ++ "rustls-native-certs 0.8.1", + "rustls-pemfile 2.2.0", + "rustls-pki-types", + "serde", +@@ -5960,14 +6000,14 @@ dependencies = [ + + [[package]] + name = "rustls" +-version = "0.23.21" ++version = "0.23.27" + source = "registry+https://github.com/rust-lang/crates.io-index" +-checksum = "8f287924602bf649d949c63dc8ac8b235fa5387d394020705b80c4eb597ce5b8" ++checksum = "730944ca083c1c233a75c09f199e973ca499344a2b7ba9e755c457e86fb4a321" + dependencies = [ + "once_cell", + "ring 0.17.8", + "rustls-pki-types", +- "rustls-webpki 0.102.8", ++ "rustls-webpki 0.103.3", + "subtle", + "zeroize", + ] +@@ -5981,7 +6021,7 @@ dependencies = [ + "openssl-probe", + "rustls-pemfile 1.0.4", + "schannel", +- "security-framework", ++ "security-framework 2.11.1", + ] + + [[package]] +@@ -5994,7 +6034,19 @@ dependencies = [ + "rustls-pemfile 2.2.0", + "rustls-pki-types", + "schannel", +- "security-framework", ++ "security-framework 2.11.1", ++] ++ ++[[package]] ++name = "rustls-native-certs" ++version = "0.8.1" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3" ++dependencies = [ ++ "openssl-probe", ++ "rustls-pki-types", ++ "schannel", ++ "security-framework 3.2.0", + ] + + [[package]] +@@ -6024,6 +6076,33 @@ dependencies = [ + "web-time", + ] + ++[[package]] ++name = "rustls-platform-verifier" ++version = "0.5.3" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "19787cda76408ec5404443dc8b31795c87cd8fec49762dc75fa727740d34acc1" ++dependencies = [ ++ "core-foundation 0.10.1", ++ "core-foundation-sys", ++ "jni", ++ "log", ++ "once_cell", ++ "rustls 0.23.27", ++ "rustls-native-certs 0.8.1", ++ "rustls-platform-verifier-android", ++ "rustls-webpki 0.103.3", ++ "security-framework 3.2.0", ++ "security-framework-sys", ++ "webpki-root-certs 0.26.11", ++ "windows-sys 0.59.0", ++] ++ ++[[package]] ++name = "rustls-platform-verifier-android" ++version = "0.1.1" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" ++ + [[package]] + name = "rustls-webpki" + version = "0.101.7" +@@ -6045,6 +6124,17 @@ dependencies = [ + "untrusted 0.9.0", + ] + ++[[package]] ++name = "rustls-webpki" ++version = "0.103.3" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "e4a72fe2bcf7a6ac6fd7d0b9e5cb68aeb7d4c0a0271730218b3e92d43b4eb435" ++dependencies = [ ++ "ring 0.17.8", ++ "rustls-pki-types", ++ "untrusted 0.9.0", ++] ++ + [[package]] + name = "rustversion" + version = "1.0.19" +@@ -6169,7 +6259,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02" + dependencies = [ + "bitflags 2.8.0", +- "core-foundation", ++ "core-foundation 0.9.4", ++ "core-foundation-sys", ++ "libc", ++ "security-framework-sys", ++] ++ ++[[package]] ++name = "security-framework" ++version = "3.2.0" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316" ++dependencies = [ ++ "bitflags 2.8.0", ++ "core-foundation 0.10.1", + "core-foundation-sys", + "libc", + "security-framework-sys", +@@ -6546,7 +6649,7 @@ dependencies = [ + "rayon", + "regex", + "reqwest 0.12.12", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pemfile 2.2.0", + "rustls-pki-types", + "serde", +@@ -6684,6 +6787,7 @@ dependencies = [ + "serde", + "serde_json", + "tokio", ++ "utils", + ] + + [[package]] +@@ -6730,7 +6834,7 @@ dependencies = [ + "rocksdb", + "rusqlite", + "rust-s3", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pki-types", + "serde", + "serde_json", +@@ -6861,7 +6965,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7" + dependencies = [ + "bitflags 1.3.2", +- "core-foundation", ++ "core-foundation 0.9.4", + "system-configuration-sys", + ] + +@@ -6938,7 +7042,7 @@ dependencies = [ + "rayon", + "reqwest 0.12.12", + "ring 0.17.8", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pemfile 2.2.0", + "rustls-pki-types", + "serde", +@@ -7144,7 +7248,7 @@ version = "0.26.1" + source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37" + dependencies = [ +- "rustls 0.23.21", ++ "rustls 0.23.27", + "tokio", + ] + +@@ -7610,9 +7714,10 @@ dependencies = [ + "regex", + "reqwest 0.12.12", + "ring 0.17.8", +- "rustls 0.23.21", ++ "rustls 0.23.27", + "rustls-pemfile 2.2.0", + "rustls-pki-types", ++ "rustls-platform-verifier", + "serde", + "serde_json", + "smtp-proto", +@@ -7817,6 +7922,24 @@ dependencies = [ + "untrusted 0.9.0", + ] + ++[[package]] ++name = "webpki-root-certs" ++version = "0.26.11" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e" ++dependencies = [ ++ "webpki-root-certs 1.0.0", ++] ++ ++[[package]] ++name = "webpki-root-certs" ++version = "1.0.0" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "01a83f7e1a9f8712695c03eabe9ed3fbca0feff0152f33f12593e5a6303cb1a4" ++dependencies = [ ++ "rustls-pki-types", ++] ++ + [[package]] + name = "webpki-roots" + version = "0.25.4" +@@ -7939,6 +8062,15 @@ dependencies = [ + "windows-targets 0.52.6", + ] + ++[[package]] ++name = "windows-sys" ++version = "0.45.0" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0" ++dependencies = [ ++ "windows-targets 0.42.2", ++] ++ + [[package]] + name = "windows-sys" + version = "0.48.0" +@@ -7966,6 +8098,21 @@ dependencies = [ + "windows-targets 0.52.6", + ] + ++[[package]] ++name = "windows-targets" ++version = "0.42.2" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071" ++dependencies = [ ++ "windows_aarch64_gnullvm 0.42.2", ++ "windows_aarch64_msvc 0.42.2", ++ "windows_i686_gnu 0.42.2", ++ "windows_i686_msvc 0.42.2", ++ "windows_x86_64_gnu 0.42.2", ++ "windows_x86_64_gnullvm 0.42.2", ++ "windows_x86_64_msvc 0.42.2", ++] ++ + [[package]] + name = "windows-targets" + version = "0.48.5" +@@ -7997,6 +8144,12 @@ dependencies = [ + "windows_x86_64_msvc 0.52.6", + ] + ++[[package]] ++name = "windows_aarch64_gnullvm" ++version = "0.42.2" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8" ++ + [[package]] + name = "windows_aarch64_gnullvm" + version = "0.48.5" +@@ -8009,6 +8162,12 @@ version = "0.52.6" + source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" + ++[[package]] ++name = "windows_aarch64_msvc" ++version = "0.42.2" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43" ++ + [[package]] + name = "windows_aarch64_msvc" + version = "0.48.5" +@@ -8021,6 +8180,12 @@ version = "0.52.6" + source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" + ++[[package]] ++name = "windows_i686_gnu" ++version = "0.42.2" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f" ++ + [[package]] + name = "windows_i686_gnu" + version = "0.48.5" +@@ -8039,6 +8204,12 @@ version = "0.52.6" + source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" + ++[[package]] ++name = "windows_i686_msvc" ++version = "0.42.2" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060" ++ + [[package]] + name = "windows_i686_msvc" + version = "0.48.5" +@@ -8051,6 +8222,12 @@ version = "0.52.6" + source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" + ++[[package]] ++name = "windows_x86_64_gnu" ++version = "0.42.2" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36" ++ + [[package]] + name = "windows_x86_64_gnu" + version = "0.48.5" +@@ -8063,6 +8240,12 @@ version = "0.52.6" + source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" + ++[[package]] ++name = "windows_x86_64_gnullvm" ++version = "0.42.2" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3" ++ + [[package]] + name = "windows_x86_64_gnullvm" + version = "0.48.5" +@@ -8075,6 +8258,12 @@ version = "0.52.6" + source = "registry+https://github.com/rust-lang/crates.io-index" + checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" + ++[[package]] ++name = "windows_x86_64_msvc" ++version = "0.42.2" ++source = "registry+https://github.com/rust-lang/crates.io-index" ++checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0" ++ + [[package]] + name = "windows_x86_64_msvc" + version = "0.48.5" +diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml +index 878def77..d4239cdb 100644 +--- a/crates/cli/Cargo.toml ++++ b/crates/cli/Cargo.toml +@@ -11,8 +11,8 @@ readme = "README.md" + resolver = "2" + + [dependencies] +-jmap-client = { version = "0.3", features = ["async"] } +-mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } ++jmap-client = { version = "0.3", features = ["async"] } ++mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } + reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"]} + tokio = { version = "1.23", features = ["full"] } + num_cpus = "1.13.1" +@@ -30,3 +30,7 @@ futures = "0.3.28" + pwhash = "1.0.0" + rand = "0.9.0" + mail-auth = { version = "0.6" } ++utils.path = "../utils" ++ ++[features] ++tls-native-roots = ["utils/tls-native-roots"] +diff --git a/crates/cli/src/main.rs b/crates/cli/src/main.rs +index 1ce96eda..da52b2ba 100644 +--- a/crates/cli/src/main.rs ++++ b/crates/cli/src/main.rs +@@ -85,7 +85,7 @@ fn parse_credentials(credentials: &str) -> Credentials { + + async fn oauth(url: &str) -> Credentials { + let metadata: HashMap<String, serde_json::Value> = serde_json::from_slice( +- &reqwest::Client::builder() ++ &utils::reqwest_client_builder() + .danger_accept_invalid_certs(is_localhost(url)) + .build() + .unwrap_or_default() +@@ -103,7 +103,7 @@ async fn oauth(url: &str) -> Credentials { + let mut params: HashMap<String, String> = + HashMap::from_iter([("client_id".to_string(), "Stalwart_CLI".to_string())]); + let response: HashMap<String, serde_json::Value> = serde_json::from_slice( +- &reqwest::Client::builder() ++ &utils::reqwest_client_builder() + .danger_accept_invalid_certs(is_localhost(url)) + .build() + .unwrap_or_default() +@@ -137,7 +137,7 @@ async fn oauth(url: &str) -> Credentials { + std::io::stdin().lock().lines().next(); + + let mut response: HashMap<String, serde_json::Value> = serde_json::from_slice( +- &reqwest::Client::builder() ++ &utils::reqwest_client_builder() + .danger_accept_invalid_certs(is_localhost(url)) + .build() + .unwrap_or_default() +@@ -229,7 +229,7 @@ impl Client { + }, + url + ); +- let mut request = reqwest::Client::builder() ++ let mut request = utils::reqwest_client_builder() + .danger_accept_invalid_certs(is_localhost(&url)) + .timeout(Duration::from_secs(self.timeout.unwrap_or(60))) + .build() +diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml +index 7c53a1db..edf72dfa 100644 +--- a/crates/common/Cargo.toml ++++ b/crates/common/Cargo.toml +@@ -32,7 +32,7 @@ tokio = { version = "1.23", features = ["net", "macros"] } + tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] } + futures = "0.3" + rcgen = "0.12" +-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]} ++reqwest = { version = "0.12", default-features = false, features = ["http2", "stream"]} + serde = { version = "1.0", features = ["derive"]} + serde_json = "1.0" + base64 = "0.22" +diff --git a/crates/common/src/enterprise/llm.rs b/crates/common/src/enterprise/llm.rs +index bc370b4b..b54cae27 100644 +--- a/crates/common/src/enterprise/llm.rs ++++ b/crates/common/src/enterprise/llm.rs +@@ -125,7 +125,7 @@ impl AiApiConfig { + }; + + // Send request +- let response = reqwest::Client::builder() ++ let response = utils::reqwest_client_builder() + .timeout(self.timeout) + .danger_accept_invalid_certs(self.tls_allow_invalid_certs) + .build() +diff --git a/crates/common/src/enterprise/mod.rs b/crates/common/src/enterprise/mod.rs +index 5eec0f98..7718bbd8 100644 +--- a/crates/common/src/enterprise/mod.rs ++++ b/crates/common/src/enterprise/mod.rs +@@ -193,7 +193,9 @@ impl Server { + + let mut logo = None; + if let Some(logo_url) = logo_url { +- let response = reqwest::get(&logo_url).await.map_err(|err| { ++ let response = utils::reqwest_client_builder() ++ .build() ++ .unwrap_or_default().get(&logo_url).await.map_err(|err| { + trc::ResourceEvent::DownloadExternal + .into_err() + .details("Failed to download logo") +diff --git a/crates/common/src/lib.rs b/crates/common/src/lib.rs +index c7ffdf0a..0fee0564 100644 +--- a/crates/common/src/lib.rs ++++ b/crates/common/src/lib.rs +@@ -47,6 +47,8 @@ use utils::{ + snowflake::SnowflakeIdGenerator, + }; + ++pub use utils::USER_AGENT; ++ + pub mod addresses; + pub mod auth; + pub mod config; +@@ -63,7 +65,6 @@ pub mod telemetry; + + pub use psl; + +-pub static USER_AGENT: &str = concat!("Stalwart/", env!("CARGO_PKG_VERSION"),); + pub static DAEMON_NAME: &str = concat!("Stalwart Mail Server v", env!("CARGO_PKG_VERSION"),); + + pub const IPC_CHANNEL_BUFFER: usize = 1024; +diff --git a/crates/common/src/listener/acme/directory.rs b/crates/common/src/listener/acme/directory.rs +index 6eedc5a9..7fc3c20f 100644 +--- a/crates/common/src/listener/acme/directory.rs ++++ b/crates/common/src/listener/acme/directory.rs +@@ -4,7 +4,6 @@ use std::time::Duration; + + use base64::Engine; + use base64::engine::general_purpose::URL_SAFE_NO_PAD; +-use hyper::header::USER_AGENT; + use rcgen::{Certificate, CustomExtension, PKCS_ECDSA_P256_SHA256}; + use reqwest::header::CONTENT_TYPE; + use reqwest::{Method, Response}; +@@ -315,7 +314,7 @@ async fn https( + body: Option<String>, + ) -> trc::Result<Response> { + let url = url.as_ref(); +- let mut builder = reqwest::Client::builder() ++ let mut builder = utils::reqwest_client_builder() + .timeout(Duration::from_secs(30)) + .http1_only(); + +@@ -329,8 +328,7 @@ async fn https( + let mut request = builder + .build() + .map_err(|err| trc::EventType::Acme(trc::AcmeEvent::Error).from_http_error(err))? +- .request(method, url) +- .header(USER_AGENT, crate::USER_AGENT); ++ .request(method, url); + + if let Some(body) = body { + request = request +diff --git a/crates/common/src/manager/mod.rs b/crates/common/src/manager/mod.rs +index 51861a82..a59e74b5 100644 +--- a/crates/common/src/manager/mod.rs ++++ b/crates/common/src/manager/mod.rs +@@ -76,7 +76,7 @@ pub async fn fetch_resource( + .await + .map_err(|err| format!("Failed to read {path}: {err}")) + } else { +- let response = reqwest::Client::builder() ++ let response = utils::reqwest_client_builder() + .timeout(timeout) + .danger_accept_invalid_certs(is_localhost_url(url)) + .user_agent(USER_AGENT) +diff --git a/crates/common/src/scripts/plugins/http.rs b/crates/common/src/scripts/plugins/http.rs +index 6cba1fe6..8cc3250f 100644 +--- a/crates/common/src/scripts/plugins/http.rs ++++ b/crates/common/src/scripts/plugins/http.rs +@@ -26,7 +26,7 @@ pub async fn exec_header(ctx: PluginContext<'_>) -> trc::Result<Variable> { + return Ok(Variable::from(url.split_once("/?").unwrap().1.to_string())); + } + +- reqwest::Client::builder() ++ utils::reqwest_client_builder() + .user_agent(agent.as_ref()) + .timeout(Duration::from_millis(timeout)) + .redirect(Policy::none()) +diff --git a/crates/common/src/telemetry/webhooks/mod.rs b/crates/common/src/telemetry/webhooks/mod.rs +index 6207fd6c..994afae5 100644 +--- a/crates/common/src/telemetry/webhooks/mod.rs ++++ b/crates/common/src/telemetry/webhooks/mod.rs +@@ -150,7 +150,7 @@ async fn post_webhook_events( + } + + // Send request +- let response = reqwest::Client::builder() ++ let response = utils::reqwest_client_builder() + .timeout(settings.timeout) + .danger_accept_invalid_certs(settings.tls_allow_invalid_certs) + .build() +diff --git a/crates/directory/Cargo.toml b/crates/directory/Cargo.toml +index 3bff0fc5..ad3d8a01 100644 +--- a/crates/directory/Cargo.toml ++++ b/crates/directory/Cargo.toml +@@ -11,7 +11,7 @@ store = { path = "../store" } + trc = { path = "../trc" } + jmap_proto = { path = "../jmap-proto" } + smtp-proto = { version = "0.1" } +-mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } ++mail-parser = { version = "0.10", features = ["full_encoding", "serde_support"] } + mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } + mail-builder = { version = "0.4" } + tokio = { version = "1.23", features = ["net"] } +@@ -34,7 +34,7 @@ futures = "0.3" + regex = "1.7.0" + serde = { version = "1.0", features = ["derive"]} + totp-rs = { version = "5.5.1", features = ["otpauth"] } +-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"] } ++reqwest = { version = "0.12", default-features = false, features = ["http2"] } + serde_json = "1.0" + base64 = "0.22" + +diff --git a/crates/directory/src/backend/oidc/lookup.rs b/crates/directory/src/backend/oidc/lookup.rs +index 49253dd3..5122ccab 100644 +--- a/crates/directory/src/backend/oidc/lookup.rs ++++ b/crates/directory/src/backend/oidc/lookup.rs +@@ -36,10 +36,10 @@ impl OpenIdDirectory { + QueryBy::Credentials(Credentials::OAuthBearer { token }) => { + // Send request + #[cfg(feature = "test_mode")] +- let client = reqwest::Client::builder().danger_accept_invalid_certs(true); ++ let client = utils::reqwest_client_builder().danger_accept_invalid_certs(true); + + #[cfg(not(feature = "test_mode"))] +- let client = reqwest::Client::builder(); ++ let client = utils::reqwest_client_builder(); + + let client = client + .timeout(self.config.endpoint_timeout) +diff --git a/crates/jmap/Cargo.toml b/crates/jmap/Cargo.toml +index 25643ac5..1383ae9f 100644 +--- a/crates/jmap/Cargo.toml ++++ b/crates/jmap/Cargo.toml +@@ -38,7 +38,7 @@ p256 = { version = "0.13", features = ["ecdh"] } + hkdf = "0.12.3" + sha1 = "0.10" + sha2 = "0.10" +-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"]} ++reqwest = { version = "0.12", default-features = false, features = ["http2"]} + tokio-tungstenite = "0.26" + tungstenite = "0.26" + chrono = "0.4" +diff --git a/crates/main/Cargo.toml b/crates/main/Cargo.toml +index a5a6160c..ec737cce 100644 +--- a/crates/main/Cargo.toml ++++ b/crates/main/Cargo.toml +@@ -45,10 +45,11 @@ elastic = ["store/elastic"] + s3 = ["store/s3"] + redis = ["store/redis"] + azure = ["store/azure"] +-enterprise = [ "jmap/enterprise", +- "smtp/enterprise", +- "common/enterprise", +- "store/enterprise", +- "managesieve/enterprise", +- "directory/enterprise", ++enterprise = [ "jmap/enterprise", ++ "smtp/enterprise", ++ "common/enterprise", ++ "store/enterprise", ++ "managesieve/enterprise", ++ "directory/enterprise", + "spam-filter/enterprise" ] ++tls-native-roots = ["utils/tls-native-roots"] +diff --git a/crates/smtp/Cargo.toml b/crates/smtp/Cargo.toml +index e7232a5b..5618fcef 100644 +--- a/crates/smtp/Cargo.toml ++++ b/crates/smtp/Cargo.toml +@@ -22,10 +22,10 @@ spam-filter = { path = "../spam-filter" } + trc = { path = "../trc" } + mail-auth = { version = "0.6" } + mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } +-mail-parser = { version = "0.10", features = ["full_encoding"] } +-mail-builder = { version = "0.4" } ++mail-parser = { version = "0.10", features = ["full_encoding"] } ++mail-builder = { version = "0.4" } + smtp-proto = { version = "0.1", features = ["serde_support"] } +-sieve-rs = { version = "0.6" } ++sieve-rs = { version = "0.6" } + ahash = { version = "0.8" } + rustls = { version = "0.23.5", default-features = false, features = ["std", "ring", "tls12"] } + rustls-pemfile = "2.0" +@@ -47,7 +47,7 @@ blake3 = "1.3" + lru-cache = "0.1.2" + rand = "0.9.0" + x509-parser = "0.16.0" +-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"] } ++reqwest = { version = "0.12", default-features = false, features = ["http2"] } + serde = { version = "1.0", features = ["derive", "rc"] } + serde_json = "1.0" + num_cpus = "1.15.0" +diff --git a/crates/smtp/src/inbound/hooks/client.rs b/crates/smtp/src/inbound/hooks/client.rs +index 2e3a9e17..6bfb40a6 100644 +--- a/crates/smtp/src/inbound/hooks/client.rs ++++ b/crates/smtp/src/inbound/hooks/client.rs +@@ -13,7 +13,7 @@ pub(super) async fn send_mta_hook_request( + mta_hook: &MTAHook, + request: Request, + ) -> Result<Response, String> { +- let response = reqwest::Client::builder() ++ let response = utils::reqwest_client_builder() + .timeout(mta_hook.timeout) + .danger_accept_invalid_certs(mta_hook.tls_allow_invalid_certs) + .build() +diff --git a/crates/smtp/src/outbound/mta_sts/lookup.rs b/crates/smtp/src/outbound/mta_sts/lookup.rs +index 03c5d251..45aff403 100644 +--- a/crates/smtp/src/outbound/mta_sts/lookup.rs ++++ b/crates/smtp/src/outbound/mta_sts/lookup.rs +@@ -67,8 +67,7 @@ impl MtaStsLookup for Server { + + // Fetch policy + #[cfg(not(feature = "test_mode"))] +- let bytes = reqwest::Client::builder() +- .user_agent(common::USER_AGENT) ++ let bytes = utils::reqwest_client_builder() + .timeout(timeout) + .redirect(reqwest::redirect::Policy::none()) + .build()? +diff --git a/crates/smtp/src/reporting/tls.rs b/crates/smtp/src/reporting/tls.rs +index 1da29ea9..3b504b13 100644 +--- a/crates/smtp/src/reporting/tls.rs ++++ b/crates/smtp/src/reporting/tls.rs +@@ -13,7 +13,7 @@ use common::{ + resolver::{Mode, MxPattern}, + }, + ipc::{TlsEvent, ToHash}, +- Server, USER_AGENT, ++ Server, + }; + use mail_auth::{ + flate2::{write::GzEncoder, Compression}, +@@ -145,8 +145,7 @@ impl TlsReporting for Server { + for uri in &rua { + match uri { + ReportUri::Http(uri) => { +- if let Ok(client) = reqwest::Client::builder() +- .user_agent(USER_AGENT) ++ if let Ok(client) = utils::reqwest_client_builder() + .timeout(Duration::from_secs(2 * 60)) + .build() + { +diff --git a/crates/spam-filter/Cargo.toml b/crates/spam-filter/Cargo.toml +index 4d0e0fa8..aefd5d0f 100644 +--- a/crates/spam-filter/Cargo.toml ++++ b/crates/spam-filter/Cargo.toml +@@ -11,7 +11,7 @@ store = { path = "../store" } + trc = { path = "../trc" } + common = { path = "../common" } + smtp-proto = { version = "0.1", features = ["serde_support"] } +-mail-parser = { version = "0.10", features = ["full_encoding"] } ++mail-parser = { version = "0.10", features = ["full_encoding"] } + mail-builder = { version = "0.4" } + mail-auth = { version = "0.6" } + mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] } +@@ -19,7 +19,7 @@ tokio = { version = "1.23", features = ["net", "macros"] } + psl = "2" + hyper = { version = "1.0.1", features = ["server", "http1", "http2"] } + idna = "1.0" +-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]} ++reqwest = { version = "0.12", default-features = false, features = ["http2", "stream"]} + decancer = "3.0.1" + unicode-security = "0.1.0" + infer = "0.16" +diff --git a/crates/spam-filter/src/analysis/url.rs b/crates/spam-filter/src/analysis/url.rs +index c3d5f828..51a93141 100644 +--- a/crates/spam-filter/src/analysis/url.rs ++++ b/crates/spam-filter/src/analysis/url.rs +@@ -289,7 +289,7 @@ async fn http_get_header( + Ok(None) + }; + } +- reqwest::Client::builder() ++ utils::reqwest_client_builder() + .user_agent("Mozilla/5.0 (X11; Linux i686; rv:109.0) Gecko/20100101 Firefox/118.0") + .timeout(timeout) + .redirect(Policy::none()) +diff --git a/crates/store/Cargo.toml b/crates/store/Cargo.toml +index d89d8da1..aa1aef33 100644 +--- a/crates/store/Cargo.toml ++++ b/crates/store/Cargo.toml +@@ -15,7 +15,7 @@ rust-s3 = { version = "=0.35.0-alpha.2", default-features = false, features = [" + azure_core = { version = "0.21.0", optional = true } + azure_storage = { version = "0.21.0", default-features = false, features = ["enable_reqwest_rustls", "hmac_rust"], optional = true } + azure_storage_blobs = { version = "0.21.0", default-features = false, features = ["enable_reqwest_rustls", "hmac_rust"], optional = true } +-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]} ++reqwest = { version = "0.12", default-features = false, features = ["http2", "stream"]} + tokio = { version = "1.23", features = ["sync", "fs", "io-util"] } + r2d2 = { version = "0.8.10", optional = true } + futures = { version = "0.3", optional = true } +diff --git a/crates/store/src/backend/azure/mod.rs b/crates/store/src/backend/azure/mod.rs +index 3b6d5be4..e91d6275 100644 +--- a/crates/store/src/backend/azure/mod.rs ++++ b/crates/store/src/backend/azure/mod.rs +@@ -63,7 +63,7 @@ impl AzureStore { + let timeout = config + .property_or_default::<Duration>((&prefix, "timeout"), "30s") + .unwrap_or_else(|| Duration::from_secs(30)); +- let transport = match reqwest::Client::builder().timeout(timeout).build() { ++ let transport = match utils::reqwest_client_builder().timeout(timeout).build() { + Ok(client) => Arc::new(client), + Err(err) => { + config.new_build_error( +diff --git a/crates/store/src/backend/http/lookup.rs b/crates/store/src/backend/http/lookup.rs +index bb5c6104..ce7c6149 100644 +--- a/crates/store/src/backend/http/lookup.rs ++++ b/crates/store/src/backend/http/lookup.rs +@@ -90,7 +90,7 @@ impl HttpStore { + async fn try_refresh(&self) -> trc::Result<AHashMap<String, Value<'static>>> { + let time = Instant::now(); + let agent = BROWSER_USER_AGENTS.choose(&mut rand::rng()).unwrap(); +- let response = reqwest::Client::builder() ++ let response = utils::reqwest_client_builder() + .timeout(self.config.timeout) + .user_agent(*agent) + .build() +diff --git a/crates/trc/Cargo.toml b/crates/trc/Cargo.toml +index 13221373..bb7b6fd8 100644 +--- a/crates/trc/Cargo.toml ++++ b/crates/trc/Cargo.toml +@@ -7,11 +7,11 @@ resolver = "2" + [dependencies] + event_macro = { path = "./event-macro" } + mail-auth = { version = "0.6" } +-mail-parser = { version = "0.10", features = ["full_encoding"] } ++mail-parser = { version = "0.10", features = ["full_encoding"] } + base64 = "0.22.1" + serde = "1.0" + serde_json = "1.0.120" +-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2"]} ++reqwest = { version = "0.12", default-features = false, features = ["http2"]} + bincode = "1.3.3" + rtrb = "0.3.1" + parking_lot = "0.12.3" +diff --git a/crates/utils/Cargo.toml b/crates/utils/Cargo.toml +index b451e742..cbd981ec 100644 +--- a/crates/utils/Cargo.toml ++++ b/crates/utils/Cargo.toml +@@ -23,6 +23,7 @@ ring = { version = "0.17" } + base64 = "0.22" + serde_json = "1.0" + rcgen = "0.13" ++rustls-platform-verifier = { version = "0.5.3", optional = true } + reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]} + x509-parser = "0.16.0" + pem = "3.0" +@@ -40,6 +41,7 @@ privdrop = "0.5.3" + + [features] + test_mode = [] ++tls-native-roots = ["dep:rustls-platform-verifier", "reqwest/rustls-tls-native-roots"] + + [dev-dependencies] + tokio = { version = "1.23", features = ["full"] } +diff --git a/crates/utils/src/lib.rs b/crates/utils/src/lib.rs +index acec2f04..f3c667f3 100644 +--- a/crates/utils/src/lib.rs ++++ b/crates/utils/src/lib.rs +@@ -18,10 +18,11 @@ use futures::StreamExt; + use reqwest::Response; + use rustls::{ + client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}, +- ClientConfig, RootCertStore, SignatureScheme, ++ ClientConfig, SignatureScheme, + }; + use rustls_pki_types::TrustAnchor; + ++pub static USER_AGENT: &str = "Stalwart/1.0.0"; + pub const BLOB_HASH_LEN: usize = 32; + + #[derive(Clone, Debug, Default, PartialEq, Eq, Hash, serde::Serialize, serde::Deserialize)] +@@ -277,20 +278,28 @@ pub async fn wait_for_shutdown() { + } + + pub fn rustls_client_config(allow_invalid_certs: bool) -> ClientConfig { ++ #[cfg(feature = "tls-native-roots")] ++ use rustls_platform_verifier::BuilderVerifierExt; ++ + let config = ClientConfig::builder(); + + if !allow_invalid_certs { +- let mut root_cert_store = RootCertStore::empty(); ++ #[cfg(feature = "tls-native-roots")] ++ let config = config.with_platform_verifier(); + +- root_cert_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().map(|ta| TrustAnchor { +- subject: ta.subject.clone(), +- subject_public_key_info: ta.subject_public_key_info.clone(), +- name_constraints: ta.name_constraints.clone(), +- })); ++ #[cfg(not(feature = "tls-native-roots"))] ++ let config = config.with_root_certificates( ++ webpki_roots::TLS_SERVER_ROOTS ++ .iter() ++ .map(|ta| rustls_pki_types::TrustAnchor { ++ subject: ta.subject.clone(), ++ subject_public_key_info: ta.subject_public_key_info.clone(), ++ name_constraints: ta.name_constraints.clone(), ++ }) ++ .collect::<rustls::RootCertStore>(), ++ ); + +- config +- .with_root_certificates(root_cert_store) +- .with_no_client_auth() ++ config.with_no_client_auth() + } else { + config + .dangerous() +@@ -299,6 +308,18 @@ pub fn rustls_client_config(allow_invalid_certs: bool) -> ClientConfig { + } + } + ++pub fn reqwest_client_builder() -> reqwest::ClientBuilder { ++ let builder = reqwest::Client::builder(); ++ ++ #[cfg(feature = "tls-native-roots")] ++ let builder = builder.tls_built_in_native_certs(true); ++ ++ #[cfg(not(feature = "tls-native-roots"))] ++ let builder = builder.tls_built_in_webpki_certs(true); ++ ++ builder.user_agent(USER_AGENT) ++} ++ + #[derive(Debug)] + struct DummyVerifier; + +diff --git a/crates/utils/src/suffixlist.rs b/crates/utils/src/suffixlist.rs +index e0921abe..b53126ae 100644 +--- a/crates/utils/src/suffixlist.rs ++++ b/crates/utils/src/suffixlist.rs +@@ -111,7 +111,12 @@ impl PublicSuffix { + + for (idx, value) in values.into_iter().enumerate() { + let bytes = if value.starts_with("https://") || value.starts_with("http://") { +- let result = match reqwest::get(&value).await { ++ let result = match crate::reqwest_client_builder() ++ .build() ++ .unwrap_or_default() ++ .get(&value) ++ .await ++ { + Ok(r) => { + if r.status().is_success() { + r.bytes().await +diff --git a/tests/Cargo.toml b/tests/Cargo.toml +index b054e41f..1d1762d8 100644 +--- a/tests/Cargo.toml ++++ b/tests/Cargo.toml +@@ -50,7 +50,7 @@ rayon = { version = "1.5.1" } + flate2 = { version = "1.0.17", features = ["zlib"], default-features = false } + serde = { version = "1.0", features = ["derive"]} + serde_json = "1.0" +-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "multipart", "http2"]} ++reqwest = { version = "0.12", default-features = false, features = ["multipart", "http2"]} + bytes = "1.4.0" + futures = "0.3" + ece = "2.2" +diff --git a/tests/src/jmap/auth_oauth.rs b/tests/src/jmap/auth_oauth.rs +index fb6f5fe8..c36654e6 100644 +--- a/tests/src/jmap/auth_oauth.rs ++++ b/tests/src/jmap/auth_oauth.rs +@@ -406,7 +406,7 @@ async fn post_bytes( + auth_token: Option<&str>, + params: &AHashMap<String, String>, + ) -> Bytes { +- let mut client = reqwest::Client::builder() ++ let mut client = utils::reqwest_client_builder() + .timeout(Duration::from_millis(500)) + .danger_accept_invalid_certs(true) + .build() +@@ -432,7 +432,7 @@ async fn post_json<D: DeserializeOwned>( + auth_token: Option<&str>, + body: &impl Serialize, + ) -> D { +- let mut client = reqwest::Client::builder() ++ let mut client = utils::reqwest_client_builder() + .timeout(Duration::from_millis(500)) + .danger_accept_invalid_certs(true) + .build() +@@ -468,7 +468,7 @@ async fn post_with_auth<T: DeserializeOwned>( + } + + async fn get_bytes(url: &str) -> Bytes { +- reqwest::Client::builder() ++ utils::reqwest_client_builder() + .timeout(Duration::from_millis(500)) + .danger_accept_invalid_certs(true) + .build() +diff --git a/tests/src/jmap/mod.rs b/tests/src/jmap/mod.rs +index f44f0781..fbf22556 100644 +--- a/tests/src/jmap/mod.rs ++++ b/tests/src/jmap/mod.rs +@@ -700,7 +700,7 @@ pub async fn jmap_raw_request(body: impl AsRef<str>, username: &str, secret: &st + }"#; + + String::from_utf8( +- reqwest::Client::builder() ++ utils::reqwest_client_builder() + .danger_accept_invalid_certs(true) + .timeout(Duration::from_millis(1000)) + .default_headers(headers) +@@ -901,7 +901,7 @@ impl ManagementApi { + query: &str, + body: Option<String>, + ) -> Result<String, String> { +- let mut request = reqwest::Client::builder() ++ let mut request = utils::reqwest_client_builder() + .timeout(Duration::from_millis(500)) + .danger_accept_invalid_certs(true) + .build() +diff --git a/tests/src/smtp/management/queue.rs b/tests/src/smtp/management/queue.rs +index 0a553b74..ed2a88d9 100644 +--- a/tests/src/smtp/management/queue.rs ++++ b/tests/src/smtp/management/queue.rs +@@ -489,7 +489,7 @@ async fn manage_queue() { + + // Test authentication error + assert_eq!( +- reqwest::Client::builder() ++ utils::reqwest_client_builder() + .timeout(Duration::from_millis(500)) + .danger_accept_invalid_certs(true) + .build() +-- +2.49.0 + diff --git a/pkgs/by-name/st/stalwart-mail-free/spam-filter.nix b/pkgs/by-name/st/stalwart-mail-patched/spam-filter.nix index ce3466d..8d600ab 100644 --- a/pkgs/by-name/st/stalwart-mail-free/spam-filter.nix +++ b/pkgs/by-name/st/stalwart-mail-patched/spam-filter.nix @@ -4,13 +4,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "spam-filter"; - version = "2.0.2"; + version = "3.0.0"; src = fetchFromGitHub { owner = "stalwartlabs"; repo = "spam-filter"; tag = "v${finalAttrs.version}"; - hash = "sha256-p2F0bwYBNWeoHjp9csWWaqeOISk9dNQT28OqkhUr7ew="; + hash = "sha256-mADA62eOHV7cJf4khkLh/OX0eQHRUus6nlGkieGFsKA="; }; buildPhase = '' diff --git a/pkgs/by-name/st/stalwart-mail-patched/update.sh.ignored b/pkgs/by-name/st/stalwart-mail-patched/update.sh.ignored new file mode 100755 index 0000000..a70ddc6 --- /dev/null +++ b/pkgs/by-name/st/stalwart-mail-patched/update.sh.ignored @@ -0,0 +1,5 @@ +#!/usr/bin/env sh + +NIX_CONFIG="pure-eval = false" nix-update --file ../../../standalone_pkgs.nix stalwart-mail-patched.passthru.spamfilter --option pure-eval false + +# vim: ft=sh |