Bongo rebuilds Debian Trixie's Mailutils 3.19 source with the Sieve ownership repair required by its native filtering and ManageSieve implementation. The release bundle never substitutes an unpatched runner copy.

Source inputs

Download these files from https://deb.debian.org/debian/pool/main/m/mailutils/:

File	SHA-256
`mailutils_3.19.orig.tar.xz`	`50230d20036c5b8ad8c96b0d996177f1f133fba4c7c7e3b462d39eeb30849f45`
`mailutils_3.19.orig.tar.xz.asc`	`4a7560b5a716a04e57b88ae312fe879b6f702c960ae9c7df6e15d7d172fbfd4b`
`mailutils_3.19-1.debian.tar.xz`	`181de5e8c4f5a35e6a749c4a0d9143199c4374cd1887aaf19940dc31a4f7bd16`
`mailutils_3.19-1.dsc`	`079dcec1749fe025b55686b439c99cf710d8c6524b3cc991060f4c97fcc44d9a`

The workflow verifies these hashes before dpkg-source reads any input.

The Debian binary-package split is retained without modification. The build therefore still produces libmailutils9t64, libmu-dbm9t64, libmailutils-dev, mailutils, mailutils-common, mailutils-comsatd, mailutils-doc, mailutils-guile, mailutils-imap4d, mailutils-mda, mailutils-mh, mailutils-pop3d, and python3-mailutils. The release ZIP contains all of those freshly rebuilt packages, while Bongo's installer selects only the runtime libraries and common data it needs.

Patch order

After dpkg-source -x mailutils_3.19-1.dsc, install 0001-sieve-parser-ownership.patch as the final quilt patch and apply 0002-debian-trixie.patch directly to the Debian changelog. The official Trixie debian/control, package names, install lists, and dependencies are not changed.

The source patch gives Bison destructors to discarded identifiers and syntax trees, and destroys the Sieve checker list on the successful path. Both are ownership fixes: malformed or repeatedly validated scripts must not retain parser or checker allocations.

Build and verification

Build both source and binary artifacts on Trixie:

dpkg-buildpackage -us -uc -S
dpkg-buildpackage -us -uc -b

Compile tests/sieve-ownership-regression.c against the newly built library and run it under Valgrind or LeakSanitizer. The release ZIP contains the complete rebuilt source package and its binary packages. Bongo must link to the 1:3.19-1+bongo1 library produced by this build.