3.7.1

A patch for 3.7.0, released the same day. 3.7.0 could not install the Community webmail on any server, which is the feature 3.7.0 is for.

Upgrading is hitechcloudcli update. Nothing else changes.

Fixed​

• native-module install webmail-roundcube failed on every server. 3.7.0 refuses an archive it cannot verify — the right rule, pointed at a source that does not exist. The project publishes a detached GPG signature beside each release archive and no .sha256 file at all, so the fetch answered 404 every time and the install ended with "No checksum to hold Roundcube to … this copy is being discarded". A Community server upgrading to 3.7.0 therefore still had no webmail, and 3.7.0's own update step reported the failure as a warning and carried on.

  The checksum is now pinned in the source beside the version it belongs to, taken from the archive at the release URL, whose length also matches the size the release API publishes for that asset. Every install is held to a number that was reviewed in a pull request, so the bytes a server installs cannot change quietly. A version chosen with HITECHCLOUD_ROUNDCUBE_VERSION has no pinned sum, falls back to a published one, and still refuses without --unverified; bumping the version without its checksum does not compile.

• Setting a mailbox password stored a hash that matched nothing. hitechcloudcli native-mailbox passwd reported "Password changed" and the mailbox owner could not sign in with the password they had just been given, while every page in the panel said the password was set. doveadm pw asks for the password and then for a confirmation; sending one line fails that check quietly — the refusal goes to stderr, a hash of something else is printed on stdout, and the exit status is 0, so every check the code made passed. Both lines are sent now, and the hash is verified against the password before it is stored.

  Only webmail was unaffected, because it signs in through the mail server's master account rather than the mailbox password — so this showed up on a real mail client, and nowhere else.

Verified on a server, not only in tests​

The defect above was found by running the install on a real server rather than in a fixture. The same session confirmed, on that server:

• the module registry reads on a real machine and reports live memory from systemd;
• ManageSieve installed and listening on 127.0.0.1:4190, so mail filters are enforced at delivery;
• the update's webmail step correctly skips a server that already has a webmail;
• native-roundcube remove keeps the database and the mailbox data and removes only the program files;
• the installer refuses a vhost it did not write, leaving the existing one byte-for-byte unchanged.