bongo/docs/test-evidence/0.7-r1.md

Bongo 0.7.0 R1 test evidence

R1 is the implementation and repair pass defined by the release test matrix. This index contains non-secret, reproducible evidence. Disposable credentials, private keys, captured mail, and complete runtime configurations remain outside Git.

Environment

• Date started: 2026-07-19
• Source: 50a38f2325293278e3f5e56a4a831c11bf0bc150
• Host: tiulk, x86-64
• Kernel: 7.1.3-xanmod1-dist
• CMake: 4.3.4
• Ninja: 1.13.2

BLD-01

Result: PASS

Clean GCC 15.3.0 debug configuration and all 360 build steps completed without a compiler warning or link failure.

cmake -S . -B /tmp/bongo-0.7-r1-gcc -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON
cmake --build /tmp/bongo-0.7-r1-gcc --parallel 12

• CMake cache SHA-256: 286ff1fcbc8b0fdc2949ee1624296bbb79bdc934ddec6eabcde39ae48e6e8a49
• Runtime configuration: not applicable to this compile-only test.

BLD-04

Result: PASS

All 51 CTest tests passed against the Clang-built binaries.

ctest --test-dir /tmp/bongo-0.7-r1-clang --output-on-failure --parallel 12

• Result: 51 passed, 0 failed
• Elapsed test time: 4.43 seconds
• Source and CMake cache: identical to BLD-03
• Runtime configuration: isolated fixtures supplied by the tests; no live Bongo configuration was used.

BLD-02

Result: PASS

All 59 GCC CTest tests passed. The suite covered authentication, SQLite transactions, StreamIO search, TLS and PROXY protocol, mail authentication, Sieve, ACME, collector accounts and transport, IMAP, POP3, SMTP, worker jobs, configuration, and Web/DAV discovery.

ctest --test-dir /tmp/bongo-0.7-r1-gcc --output-on-failure --parallel 12

• Result: 59 passed, 0 failed
• Elapsed test time: 2.66 seconds
• Source: ea1e1610a670b233f7e57157d597f0f888282d27 plus the R1 portability repairs recorded by BLD-09.
• CMake cache SHA-256: 9292384a8e8b073e11c3abc01e5d698ccba449ef625246c0dd120c71ec60fab2
• Runtime configuration: isolated fixtures supplied by the tests; no live Bongo configuration was used.

BLD-03

Result: PASS

Clean Clang 22.1.8 debug configuration with the same discovered dependencies and all 360 build steps completed without a compiler warning or link failure.

CC=clang cmake -S . -B /tmp/bongo-0.7-r1-clang -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON
cmake --build /tmp/bongo-0.7-r1-clang --parallel 12

• CMake cache SHA-256: 9f8ca3b62e88c57e9cfd13ed0d6e0072c71dc47cb4fa1a420e329e14bb050920
• Runtime configuration: not applicable to this compile-only test.

BLD-05

Result: PASS

Commit ed6fc871e344fc7c9a5cd5b6d8ec90486dfca13c was built with GCC, AddressSanitizer, UndefinedBehaviorSanitizer, frame pointers, and the complete test feature set. The installed tree and disposable state/configuration roots were placed below /tmp; the normal bongo.service remained stopped. The protocol session ran as root inside a private user and network namespace, so the real Bongo ports could be exercised without touching host listeners.

cmake -S . -B /tmp/bongo-0.7-r1-asan-live -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON \
  -DCMAKE_C_FLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer' \
  -DCMAKE_INSTALL_PREFIX=/tmp/bongo-0.7-r1-asan-root/usr \
  -DBONGO_CONFIG_DIR=/tmp/bongo-0.7-r1-asan-config \
  -DBONGO_STATE_DIR=/tmp/bongo-0.7-r1-asan-state -DBONGO_USER=root

• CMake cache SHA-256: 7425b6570598d6bb107066fc6f38b2207731ff12088b965a58d7f3e3c5517296
• Configuration-set SHA-256: 3f4e84d45cd706cca9bf970419750d0f15bb80addacf884898c5527cb7c344a2
• CTest: 53 passed, 0 failed in 6.44 seconds.
• Protocol session: SMTP submission with STARTTLS, SMTPS, IMAPS delivery and SUBJECT search, IMAP STARTTLS, POP3 STLS, and POP3S all passed.
• The manager and every tested native agent log contained no ASan or UBSan diagnostic. Leak detection was deliberately disabled here because BLD-06 is the separate LeakSanitizer gate.
• The Web subprocess cannot drop supplementary groups inside the unprivileged user namespace, so it was excluded from this native-agent protocol session; its Python/Web/DAV paths were covered by the sanitizer-loaded CTest suite.

The repair loop found and fixed: empty-array qsort/bsearch undefined behaviour, width-incorrect and unaligned generic JSON integer writes, installed state paths hardcoded outside the configured prefix, incorrect Store-to-IMAP UID mapping for search hits, and a signed high-bit shift in IMAP FETCH flags. Regression tests were added for integer widths, empty arrays, relocated Web state, and Store search-hit parsing.

BLD-06

Result: PASS

Commit 3e9b934ec471ec75f3872558d58f25c710064dab was tested with LeakSanitizer enabled together with ASan and UBSan. Leak detection remained enabled during startup, SMTP delivery, IMAP and POP access, and the complete manager/agent shutdown. The host bongo.service stayed stopped; the protocol session ran in the same private user/network namespace described in BLD-05.

ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:detect_leaks=1:\
fast_unwind_on_malloc=0:malloc_context_size=50 \
UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1 \
LSAN_OPTIONS=exitcode=23:report_objects=1 \
ctest --test-dir /tmp/bongo-0.7-r1-asan-live \
  --output-on-failure -E '^python-'

LD_PRELOAD=/usr/lib/gcc/x86_64-pc-linux-gnu/15/libasan.so \
ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:detect_leaks=1:\
fast_unwind_on_malloc=0:malloc_context_size=50 \
LSAN_OPTIONS=exitcode=23:report_objects=1 \
ctest --test-dir /tmp/bongo-0.7-r1-asan-live \
  --output-on-failure -R '^python-'

unshare --user --map-root-user --net \
  /tmp/bongo-0.7-r1-asan-session.sh

• Native CTest: 55 passed, 0 failed. This includes the full Mailutils Sieve syntax/error path and the queue-registration cancellation regression test.
• Python C-extension CTest: 2 passed, 0 failed with the ASan runtime loaded before CPython.
• Protocol session: SMTP submission with STARTTLS, SMTPS, IMAPS delivery and search, IMAP STARTTLS, POP3 STLS, and POP3S passed.
• Manager and agents stopped normally; no process reached the manager's forced-kill deadline.
• No LeakSanitizer, AddressSanitizer, UBSan, or runtime-error diagnostic was present in the test output or manager/agent log.
• CMake cache SHA-256: 9696f8805c0f7c50c50ee4e2828600bd8f110b266e49cb72f2a188584f424e4f
• Configuration-set SHA-256: d6de90aed16ac5c1407fc6dce9a4ee08740c6971d174436eb563df832ec82eed

The repair pass fixed real ownership and lifecycle defects rather than adding sanitizer suppressions: Mailutils Sieve parser/checker lists, Bongo Sieve and GMime objects, Store parser child termination, configuration/JSON/stream allocations, libcurl global cleanup, detached thread-pool lifetime, monitor shutdown, the IMAP busy-thread count, and cancellation of Queue registration while the Queue server is going away. The Mailutils 3.21 fix is carried by the Bongo overlay as commit 61670a4 and was installed for this run.

BLD-07

Result: PASS

Commit 3e9b934ec471ec75f3872558d58f25c710064dab was built with Clang 22.1.8 and ThreadSanitizer. The installed tree used the same private configuration/state roots and isolated user/network namespace as the ASan/LSan protocol session.

CC=clang cmake -S . -B /tmp/bongo-0.7-r1-tsan-live -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON \
  -DCMAKE_C_FLAGS='-fsanitize=thread -fno-omit-frame-pointer' \
  -DCMAKE_EXE_LINKER_FLAGS='-fsanitize=thread' \
  -DCMAKE_SHARED_LINKER_FLAGS='-fsanitize=thread' \
  -DCMAKE_INSTALL_PREFIX=/tmp/bongo-0.7-r1-tsan-root/usr \
  -DBONGO_CONFIG_DIR=/tmp/bongo-0.7-r1-asan-config \
  -DBONGO_STATE_DIR=/tmp/bongo-0.7-r1-asan-state -DBONGO_USER=root

TSAN_OPTIONS=halt_on_error=1 \
ctest --test-dir /tmp/bongo-0.7-r1-tsan-live \
  --output-on-failure -E '^python-'

LD_PRELOAD=/usr/lib/clang/22/lib/linux/libclang_rt.tsan-x86_64.so \
TSAN_OPTIONS=halt_on_error=1 \
ctest --test-dir /tmp/bongo-0.7-r1-tsan-live \
  --output-on-failure -R '^python-'

unshare --user --map-root-user --net \
  /tmp/bongo-0.7-r1-tsan-session.sh

• Native CTest: 55 passed, 0 failed, including the concurrent atomic and Store logical-lock regression tests.
• Python C-extension CTest: 2 passed, 0 failed with the Clang TSan runtime loaded before the uninstrumented CPython executable.
• Protocol session: SMTP submission with STARTTLS, SMTPS, IMAPS delivery and search, IMAP STARTTLS, POP3 STLS, and POP3S passed.
• Every listener and worker stopped normally. No ThreadSanitizer diagnostic remained in test output or manager/agent logs.
• CMake cache SHA-256: d20e5508f082782b8867520f3123171de74e76ac2c0004e1f16fa274c1a9f468
• Configuration-set SHA-256: d6de90aed16ac5c1407fc6dce9a4ee08740c6971d174436eb563df832ec82eed

The repair loop found and fixed real concurrency defects: an AB/BA Store lock order, non-atomic shared agent and listener state, Queue worker teardown while shared tables were still in use, listener socket ownership during shutdown, SMTP client-pool lifetime accounting, the legacy thread-group macro writing to shared caller state, and POP3 freeing a shared GnuTLS context while a worker was still negotiating. The portable atomic implementation is selected through GCC/Clang builtins and CMake links libatomic automatically on targets that require it, including older 32-bit architectures.

After those repairs, the complete ASan/UBSan/LeakSanitizer CTest and live protocol session were repeated successfully. This confirms that the concurrency fixes did not regress the Mailutils Sieve leak repair or introduce new ownership errors.

BLD-08

Result: PASS

Commit f7baf37515d7f963042abd61e00f8a571bb694be was configured and built natively inside an isolated Debian Trixie i386 root with GCC 14.2.0 and GMime 3.2.15. This was a genuine i386 userland rather than an x86-64 build using only -m32. The build used the patched Mailutils 3.21 libraries and archived Debian libsrs2 1.0.18-4 i386 packages. Those historical binaries are test fixtures only; the Trixie release workflow must rebuild libsrs2 from source as specified by BLD-15.

cmake -S /src -B /build -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON
cmake --build /build --parallel 12
ctest --test-dir /build --output-on-failure --parallel 2

• CTest: 57 passed, 0 failed.
• CMake cache SHA-256: aed777cda210cc229fac4693e719f4e8c08a685c05c0da99cfdc295062a65a88
• bongoimap, bongopop3, bongosmtp, bongostore, the Python extension, patched libmu_sieve, and archived libsrs2 were verified as Intel i386 ELF32 objects.
• The same source then rebuilt without warnings on the x86-64 host against GMime 2.6 with GCC and Clang; both complete CTest runs passed 57/57. This verifies that the GMime 3 compatibility work did not drop GMime 2 support.
• Valgrind on the i386 Sieve test reported zero errors and no definite, indirect, or possible leaks. The repair fixed a real double-free after mu_message_set_stream() transferred stream ownership; it did not add a suppression.

The repair pass also corrected IMAP header-size conversions so a 64-bit message size is never silently narrowed to the int count accepted by the connection API, and made the HTML sanitizer compatible with Trixie's nh3 0.2.18 while retaining conservative inline-style filtering.

BLD-09

Result: PASS

The complete source was cross-compiled with Clang 22.1.8 for the ARMv5TE soft-float ABI against an isolated Debian Trixie armel sysroot. This is a genuine ARM EABI5 build, not a host build with architecture macros overridden. The sysroot used freshly cross-built copies of the overlay's patched libspf2 and libsrs2 sources. Their LIBSPF2_RFC7208 and SRS2_HAS_SECURE_FREE_SECRETS feature probes both passed during configuration.

cmake -S /home/dbp/bongo-server -B /tmp/bongo-armv5-cross-r1 -G Ninja \
  -DCMAKE_TOOLCHAIN_FILE=/tmp/armv5-bongo-toolchain.cmake \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON
cmake --build /tmp/bongo-armv5-cross-r1 --parallel 12
QEMU_LD_PREFIX=/tmp/bongo-armv5-root2 \
  ctest --test-dir /tmp/bongo-armv5-cross-r1 \
  --output-on-failure --parallel 4

• Build: all 380 steps completed without a compiler warning or link failure.
• CTest through QEMU user emulation: 58 passed, 0 failed in 32.41 seconds.
• CMake cache SHA-256: 8660c5d56d91f58e26aca3d103861adfb42f0a1573fe0d124c26d1998a560969
• readelf -A reports Tag_CPU_arch: v5TE, ARM ISA, Thumb-1, and the EABI 8-byte alignment rules for the tested server binaries.
• Source: ea1e1610a670b233f7e57157d597f0f888282d27 plus the documented R1 ARM portability repairs.
• Runtime configuration: isolated fixtures supplied by the tests; no live Bongo configuration was used.

This pass found and fixed cross-build leakage from LibIcal's host-side CMake package, unsafe packed DNS-result members on strict-alignment ARM, truncated IMAP body offsets on ILP32, and format-width errors in IMAP and Queue. It also enables the 64-bit time_t and off_t ABI on 32-bit Linux, matching modern Trixie armel dependencies and keeping dates beyond 2038 and large mail stores correct.

BLD-10

Result: PASS

ARMv6 soft-float was replaced by ARMv7 hard-float in the release matrix because it exercises a materially different ABI rather than making only a marginal code-generation change from the already tested ARMv5 soft-float baseline. The complete source was cross-compiled with GCC 15.3.0 for ARMv7-A, VFPv3-D16 and the hard-float procedure-call standard against an isolated Debian Trixie armhf sysroot.

The Trixie sysroot was resolved and extracted without installing target packages on the host. Since Trixie no longer supplies libsrs2, the overlay's patched libsrs2 source and patched libspf2 source were both cross-built for the same ARM hard-float ABI. Their security feature probes passed during the Bongo configuration.

cmake -S /home/dbp/bongo-server -B /tmp/bongo-armv7hf-cross-r1 -G Ninja \
  -DCMAKE_TOOLCHAIN_FILE=/tmp/armv7-bongo-toolchain.cmake \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON
cmake --build /tmp/bongo-armv7hf-cross-r1 --parallel 12
QEMU_LD_PREFIX=/tmp/bongo-armv7-root \
LD_LIBRARY_PATH=/tmp/libspf2-armv7-stage:/tmp/libsrs2-armv7-stage \
  ctest --test-dir /tmp/bongo-armv7hf-cross-r1 \
  --output-on-failure --parallel 4

• Build: all 380 steps completed without a compiler warning or link failure.
• CTest through QEMU user emulation: 58 passed, 0 failed in 35.80 seconds.
• CMake cache SHA-256: 8b12f27d448d8de3c7f1b4592b347ea1d8ed7d3f38b705551d8dd345b80b0c16
• bongoimap, bongosmtp, and bongostore are ELF32 ARM EABI5 PIEs using /lib/ld-linux-armhf.so.3.
• readelf -A reports ARMv7-A, Thumb-2, VFPv3-D16, and Tag_ABI_VFP_args: VFP registers for Bongo, patched libspf2, and patched libsrs2.
• Source: ea1e1610a670b233f7e57157d597f0f888282d27 plus the documented R1 portability repairs.
• Runtime configuration: isolated fixtures supplied by the tests; no live Bongo configuration was used.

BLD-11

Result: PASS

The complete source was cross-compiled with GCC 15.3.0 for AArch64 against an isolated Debian Trixie arm64 sysroot. Trixie does not provide libsrs2, so the overlay's patched libsrs2 and libspf2 sources were both cross-built for the same AArch64 ABI. Their security feature probes passed during Bongo configuration.

cmake -S /home/dbp/bongo-server -B /tmp/bongo-aarch64-cross-r1 -G Ninja \
  -DCMAKE_TOOLCHAIN_FILE=/tmp/aarch64-bongo-toolchain.cmake \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON
cmake --build /tmp/bongo-aarch64-cross-r1 --parallel 12
QEMU_LD_PREFIX=/tmp/bongo-aarch64-root \
LD_LIBRARY_PATH=/tmp/libspf2-aarch64-stage:/tmp/libsrs2-aarch64-stage \
  ctest --test-dir /tmp/bongo-aarch64-cross-r1 \
  --output-on-failure --parallel 4

• Build: all 380 steps completed without a compiler warning or link failure.
• CTest through QEMU user emulation: 58 passed, 0 failed in 20.76 seconds.
• CMake cache SHA-256: 97a2c242b187c4d2f3a1f9b7d67addd8e248cd37e27ef12b7857e85a03ab9ab2
• bongoimap, bongosmtp, and bongostore are ELF64 AArch64 PIEs using /lib/ld-linux-aarch64.so.1; patched libspf2 and libsrs2 are ELF64 AArch64 shared libraries.
• Source: ea1e1610a670b233f7e57157d597f0f888282d27 plus the documented R1 portability repairs.
• Runtime configuration: isolated fixtures supplied by the tests; no live Bongo configuration was used.

BLD-12

Result: PASS

CPack generated the native TGZ binary package, which was extracted into a new empty staging root. Its /usr/local tree and a disposable /var/lib/bongo were then mounted only inside a private user/mount namespace so the installed Python extensions could be loaded at their configured paths without modifying the host installation.

cpack -G TGZ --config /tmp/bongo-0.7-r1-gcc/CPackConfig.cmake \
  -B /tmp/bongo-cpack-r1-fixed
mkdir -p /tmp/bongo-cpack-r1-root3
tar -xzf /tmp/bongo-cpack-r1-fixed/bongo-0.7.0-Linux.tar.gz \
  -C /tmp/bongo-cpack-r1-root3
unshare --user --map-root-user --mount \
  /bin/sh /tmp/bongo-cpack-stage-smoke.sh

• Package: bongo-0.7.0-Linux.tar.gz, 1,035 regular files.
• Package SHA-256: af00479ac617f98c95be4739e3d74c8cc8ef381b5733e5bda363b1bccf8a33c9
• CMake cache SHA-256: 9292384a8e8b073e11c3abc01e5d698ccba449ef625246c0dd120c71ec60fab2
• All 1,115 archive members use relative, non-traversing paths.
• All 24 symbolic links resolve inside the staged installation.
• All 37 ELF objects have a complete dependency tree when the staged Bongo library directory is used; none resolves a Bongo library from the host.
• The staged bongo, bongo.configuration, bongo_web, libbongo, calendar, external-account, QR-code, and authentication-security Python modules load successfully without writing bytecode into the package tree.
• Source: commit 9b3c958c plus the XPL initialization repair described below.
• Runtime configuration: disposable state only; no live Bongo configuration or service was used.

The first staging run found that importing _calendar and _external_accounts in one process called XplInit() twice. libgcrypt rejects changing its seed-file configuration after initialization and aborted. XPL initialization is now guarded by pthread_once, detects libgcrypt initialized by another library, and has a dedicated repeat-initialization regression test. The complete host suite passed 59/59 after the repair.

BLD-13

Result: PASS

CPack generated a source-only TXZ named bongo-0.7.0.tar.xz; neither the archive nor its single top-level directory contains -Linux or -linux. The archive was extracted into a new directory and configured and compiled from that extracted copy to prove that the filtering did not remove a required source.

cpack -G TXZ \
  --config /tmp/bongo-0.7-r1-gcc/CPackSourceConfig.cmake \
  -B /tmp/bongo-source-r1
tar -xJf /tmp/bongo-source-r1/bongo-0.7.0.tar.xz \
  -C /tmp/bongo-source-r1-root
cmake -S /tmp/bongo-source-r1-root/bongo-0.7.0 \
  -B /tmp/bongo-source-r1-build -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=OFF
cmake --build /tmp/bongo-source-r1-build --parallel 12

• Source archive SHA-256: c11c4baaacdc0205d02a846277883c3223795c3b4d521f9fe1f7c4d212acd635
• Extracted-build CMake cache SHA-256: 61bf4b5f556b5c7c9c51f67eeac7754d0a29cd902f3a8aa639146d3092819072
• Archive contents: 1,880 members, 1,752 regular files, one top-level directory, and no symbolic links.
• No absolute or parent-traversing archive paths were present.
• No Git/SVN/Hg, Codex/agent, CMake build/cache, Python cache, private-key, credential-token, database, core, or log artifacts matched the release checks.
• The extracted source completed all 244 non-test build steps without a compiler warning or link failure.
• Source: commit 9b3c958c plus the XPL initialization repair recorded by BLD-12.
• Runtime configuration: not applicable to this source-package test.

BLD-14

Result: PASS

The Gentoo live ebuild was rebuilt from commit 806bdf789d79f41031f14aeb1a40264ac7fa07ee, ran its test phase, and merged successfully on the native amd64 test host. The active package configuration was debug fail2ban test with Python 3.14.

emerge --oneshot '=mail-mta/bongo-9999::bongo'
pkgcheck scan --cache-dir /tmp/pkgcheck-bongo \
  --exit error '=mail-mta/bongo-9999'
qcheck -v mail-mta/bongo

• The test-enabled build, install, and merge completed without a Portage QA notice or internal package collision.
• pkgcheck completed with status zero for the live ebuild.
• qcheck verified all 1,445 installed package entries.
• The installed image contains 303 compiled Python bytecode files as well as the systemd units, tmpfiles configuration, man pages, translations, Web assets, Fail2ban files, zone information, and examples.
• No package entry is installed below /usr/var, /usr/etc, or /var/run.
• The sendmail, mailq, newaliases, and /usr/lib/sendmail compatibility links are all owned by mail-mta/bongo-9999 and resolve to bongo-sendmail.
• scanelf found no unresolved dependency among the installed Bongo server executables and versioned shared libraries.
• bongo.service remained inactive throughout package QA, as required for this non-lifecycle test.

Runtime configuration: the installed development configuration was not started or modified by this package test.

BLD-15

Result: PASS

Gitea Actions run 2537 rebuilt Bongo and all maintained patched dependencies in a Debian Trixie amd64 container. The workflow completed successfully in 21 minutes 9 seconds, including dependency regression tests under Valgrind, the Bongo build, lintian --fail-on error, package installation, and the installed-package smoke test.

unzip -t bongo-0.7.0-dev9e02056-debian-trixie.zip
unzip -q bongo-0.7.0-dev9e02056-debian-trixie.zip -d bundle
(cd bundle/bongo-0.7.0-dev9e02056-debian-trixie && \
  sha256sum -c SHA256SUMS)
dpkg-source -x sources/mailutils/mailutils_3.19-1+bongo1.dsc mailutils
dpkg-source -x sources/libspf2/libspf2_1.2.10-8.3+bongo1.dsc libspf2
dpkg-source -x sources/libsrs2/libsrs2_1.0.18-4+bongo1.dsc libsrs2
dpkg-source -x sources/bongo/bongo_0.7.0-1.dsc bongo

• Source: commit 9e02056ba17a9edf67574da792d1000bcf839ab0.
• Build environment: Debian Trixie amd64, GCC 14.2.0; the four source buildinfo files record their architecture, compiler, and package set.
• Release archive: bongo-0.7.0-dev9e02056-debian-trixie.zip, SHA-256 e0bf2e8d4273621c2799940ca4b84fc104d159cdc2eff09a3f14560a4bb75479.
• ZIP integrity passed and all 57 entries covered by the internal SHA256SUMS verified. The bundle contains 36 binary packages and 21 source artifacts.
• The complete, unsigned local source packages independently extracted: Mailutils 1:3.19-1+bongo1, libspf2 1.2.10-8.3+bongo1, libsrs2 1.0.18-4+bongo1, and Bongo 0.7.0-1. Their upstream archives, Debian patch archives, .dsc, source .changes, and source .buildinfo files are all present.
• Mailutils and libspf2 retain the official Trixie binary-package splits. The rebuilt archived libsrs2 source retains libsrs2-0 and libsrs2-dev and adds the historical srs2 daemon package; no archived binary was used.
• Bongo's source buildinfo pins the three patched development packages. The resulting SMTP/Sieve ELF objects directly require the expected libspf2.so.2, libsrs2.so.0, libmailutils.so.9, and libmu_sieve.so.9 SONAMEs.
• The bundle installer verifies checksums and exact patched package versions, then holds only the patched dependency libraries; Bongo itself remains upgradeable.

Runtime configuration: the workflow used only its disposable Trixie container and did not install or alter the live test host.

BLD-16

Result: PASS

Two clean GCC 15.3.0 debug builds exercised crossed prefix/library layouts: a distribution /usr install using lib64, and a self-contained /usr/local install using lib. Both were installed below empty DESTDIR roots and their compiled defaults, generated units, tmpfiles declaration, ELF runpaths, directory trees, and symbolic links were audited.

cmake -S . -B /tmp/bongo-bld16-usr -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON \
  -DCMAKE_INSTALL_PREFIX=/usr -DLIB_DIR_NAME=lib64
cmake --build /tmp/bongo-bld16-usr --parallel 12
ctest --test-dir /tmp/bongo-bld16-usr --output-on-failure --parallel 12
DESTDIR=/tmp/bongo-bld16-usr-root \
  cmake --install /tmp/bongo-bld16-usr --prefix /usr

cmake -S . -B /tmp/bongo-bld16-local -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=OFF \
  -DCMAKE_INSTALL_PREFIX=/usr/local -DLIB_DIR_NAME=lib
cmake --build /tmp/bongo-bld16-local --parallel 12
DESTDIR=/tmp/bongo-bld16-local-root \
  cmake --install /tmp/bongo-bld16-local --prefix /usr/local

systemd-tmpfiles --create --dry-run \
  --root=/tmp/bongo-bld16-tmpfiles-root \
  /tmp/bongo-bld16-usr/init/bongo.conf

• Source: commit 58d2e89 (Move volatile PID files under run).
• Full CTest result: 72 passed, 0 failed in 3.40 seconds.
• /usr cache SHA-256: f56949bfc8fa2a0963c3460a96db3e61bb9f4a274ddfc4370f2d9e7c56025e48.
• /usr/local cache SHA-256: 5f86eafad069052a4fd7e04b523f6bf56f1f38becab410598cc0df7f8197637d.
• Both staged trees contain 1,064 regular files or symbolic links. The first uses /usr/lib64, /etc/bongo, and /var/lib/bongo; the second uses /usr/local/lib, /usr/local/etc/bongo, and the same FHS state path.
• No staged directory appeared below /usr/etc, /usr/var, /usr/local/var, /var/run, or /run. Runtime and persistent directories are declarations created after installation, not package payload.
• Generated tmpfiles data passed systemd-tmpfiles parsing and declares /run/bongo separately from /var/lib/bongo. The manager, agent recovery flags, administration status, and managed LDAP PID paths all compile to the volatile directory.
• All installed ELF runpaths match the selected lib64 or lib directory; no build-directory runpath was present. All 26 library symlinks in either staged tree are relative and resolve within their selected library root.

The initial audit failed because PID and agent recovery files still used the persistent /var/lib/bongo/work directory. The repair adds the configurable BONGO_RUNTIME_DIR (default /run/bongo) while keeping diagnostic traces and ring logs in persistent state.

Runtime configuration: isolated staging roots and a dry-run tmpfiles root; the live Bongo installation and service were not modified.

BLD-17

Result: PASS

The Debian Trixie workflow now runs a destructive package lifecycle test only inside its disposable build container. It installs the freshly built Bongo package, creates distinct configuration, private-key, user-mail, system-Store, and queued-message markers, and verifies all five after a same-version reinstall. The test then repacks the identical payload with the unpublished test-only version 0.7.0-1+lifecycle1 and installs it through APT so that dpkg's real upgrade maintainer-script path is exercised.

Normal removal deleted the program payload while retaining Debian conffiles and every site-created marker. Purge then deleted the package-owned Fail2ban filter and disabled jail template, removed Bongo from the package database, and still preserved /etc/bongo and /var/lib/bongo. This matches the now documented safe-removal policy; /run/bongo remains explicitly volatile and is not treated as recoverable state.

The package test also found and removed a redundant hand-written systemd-tmpfiles invocation from postinst. Debhelper's generated sequence already performs the operation once and correctly handles DPKG_ROOT.

• Source: commit 00b7cc3f3a945d744dafd0165e47dc9a67e72c01.
• Gitea Actions: Debian Trixie workflow run 2543, success in 21m05s.
• Build environment: Debian Trixie amd64, GCC 14.2.0, CMake 3.31.6.
• Build date: 2026-07-21 10:48:28 UTC.
• Release archive: bongo-0.7.0-dev00b7cc3-debian-trixie.zip, SHA-256 087011d70582c672d72d6a30c3d98276bc35764e4195e1734c423e308ebcb31d.
• Package configuration: Bongo 0.7.0-1, Mailutils 1:3.19-1+bongo1, libspf2 1.2.10-8.3+bongo1, and libsrs2 1.0.18-4+bongo1, as recorded by the bundle manifest and source buildinfo.

Runtime configuration: disposable marker files in the isolated Gitea job; the live Bongo installation and service were not modified.

BLD-18

Result: PASS

A clean GCC 15.3.0 debug build enabled the GNU linker --no-undefined check for every Bongo shared library and loadable module. The repair removed legacy circular object ownership between connio, util, and msgapi, made each shared object declare its actual direct dependencies, and removed the artificial dependency lists previously needed by the connio tests. The complete 72-test suite then passed in 2.46 seconds.

cmake -S . -B /tmp/bongo-bld18-clean-build -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON \
  -DCMAKE_INSTALL_PREFIX=/usr -DLIB_DIR_NAME=lib64
cmake --build /tmp/bongo-bld18-clean-build --parallel 12
ctest --test-dir /tmp/bongo-bld18-clean-build \
  --output-on-failure --parallel 12
DESTDIR=/tmp/bongo-bld18-final-root \
  cmake --install /tmp/bongo-bld18-clean-build --prefix /usr

• Source repair: commit 2085fbfbab0b598f5b722be508de11e6913d9c68. The package retry commit ce75ba3a95f94c5e649f713749b498abf9d52cdd is intentionally empty and contains the identical source tree.
• Clean CMake cache SHA-256: 50c4181e8f96cff15f1259293decfe03073f502495e87f43ab02c25cb10aefac.
• The staged installation contains 1,064 files or symbolic links. All 20 ELF shared objects were checked with ldd -r; none reported a missing library or undefined symbol.
• All 13 versioned Bongo shared libraries carry the matching libbongo*.so.0 SONAME. Each development link resolves through a relative .so -> .so.0 -> .so.0.7.0 chain within the selected library directory.
• The seven additional loadable authentication and Python extension modules also pass the dependency audit without relying on the loading executable to provide unresolved Bongo symbols.
• Gitea Actions run 2549 repeated the full Debian Trixie dependency, Bongo, Lintian, installed-package, and package-lifecycle build successfully in 21 minutes 8 seconds.
• Release archive: bongo-0.7.0-devce75ba3-debian-trixie.zip, SHA-256 579aa9903a3e98e029596749f7ea7ddd574aac95dfa3ef2c6365b6241f337f97. The ZIP test passed and all 57 files listed in its internal SHA256SUMS verified.

The first remote attempt, run 2546, failed before checkout while its Actions runner was overloaded. It spent its whole lifetime in Set up job and produced no build log; run 2549 is the unchanged, successful retry.

Runtime configuration: isolated staging roots and a disposable Debian Trixie job; the live Bongo installation and service were not modified.

BLD-19

Result: PASS

A clean GCC 15.3.0 installation audit verified that the source and installed trees contain the complete documentation, localization, Web UI, service, and configuration payload. The staged installation contains 1,106 regular files or symbolic links, and the complete 72-test suite passed in 2.85 seconds.

• Source: commit faf4f706c5c92aa78550bf9b7e2afa6132336573.
• Clean CMake cache SHA-256: f39024ab6b8a2d5625fab564667187895d7f0ec66d322e85faec00b04d5e231b.
• All 199 Web static files are installed byte-for-byte, together with all 25 Markdown documentation files and all 10 ACME, antispam, and reverse-proxy examples.
• Nine section-1 and 14 section-8 manual pages are installed. All 23 render successfully with groff, and every one of the 22 installed /usr/sbin executables has a same-name manual page.
• Five compiled message catalogs are installed: German, French, and Brazilian Portuguese for the Web UI plus French and Brazilian Portuguese for the core tools. Every catalog decodes successfully with msgunfmt.
• The three installed systemd units pass systemd-analyze verify. The staged ELF dependency audit also reports no missing library or unresolved symbol.
• Gitea Actions run 2552 repeated the Debian Trixie build, tests, Lintian audit, package lifecycle, and development-release publication successfully in 21 minutes 24 seconds.
• Release archive: bongo-0.7.0-devfaf4f70-debian-trixie.zip, SHA-256 9a66e50b0c85df53ad456a65625c846b2fdfd7f82e98a8605a931d24583b0a41. Its ZIP structure is valid and all 57 entries in the internal SHA256SUMS verify, including 36 binary Debian packages and 21 source-package files.

Runtime configuration: isolated staging roots and a disposable Debian Trixie job; the live Bongo installation and service were not modified.

CFG-01

Result: PASS

The real curses setup wizard was driven from start to finish in a 100-column by 24-line pseudo-terminal. DNS discovery and scanner probes were made deterministic, and every configuration, alias, TLS, DKIM, DMARC, and ACME path was redirected below /tmp/bongo-cfg01-root. The test stopped at the final confirmation without calling the installer.

The default flow selected Apache reverse-proxy mode with HTTPS public URL, loopback-only trusted proxy access, IMAP, POP3, ManageSieve, and authenticated submission. ACME, legacy TLS, internal relay, LDAP, ClamAV, and SpamAssassin remained disabled until explicitly selected. The generated scenario used mail.example.test, 192.0.2.10, and example.test; all generated documents passed model validation with no errors.

The terminal transcript contains neither of the previously observed merged prompt fragments (WeYesdirect and MaNo proxy). The layout unit checks also place choices below both single-line prompts and multiline confirmation summaries, including scrolling in a 60x12 terminal.

• Source: commit faf4f706c5c92aa78550bf9b7e2afa6132336573.
• Terminal: TERM=xterm-256color, 100 columns by 24 lines.
• Result: one complete wizard pass, zero validation errors, zero writes to the live Bongo configuration or Store.

Runtime configuration: isolated pseudo-terminal and temporary configuration root; the live Bongo installation and service were not modified.

CFG-02

Result: PASS

The current Gentoo live ebuild was installed over an already configured Bongo test installation. The setup installer was then repeated with the same host, domain, and administrator account. It reused the existing TLS certificate and key, printed Complete., and exited with status zero. This exercises the real Store and privilege transition rather than a redirected staging root.

Before and after the repeated setup, SHA-256 digests were recorded for all 14 documents in config.d, the default alias document, both TLS files, the Store databases of test1 and test2, and an existing message in test2's mailbox. All 20 files remained byte-identical. The user list also remained exactly admin, test1, and test2.

The setup path was additionally run twice under AddressSanitizer in an isolated network and staging root. Both runs completed with status zero and no sanitizer diagnostic. The regression fixed an uninitialised stack-based BongoAgent whose shutdown path could wait on random monitor state and free a random monitor pointer.

• Source: commit 0e06501c72a1281e326cef265a40ef31de3cb182.
• Package: mail-mta/bongo-9999::bongo, Gentoo debug build.
• Automated regression suite: 74 of 74 tests passed.
• Result: one repeated live setup and two isolated ASan repetitions passed; configuration, credentials, TLS material, users, Store databases, and the existing message were preserved.

Runtime configuration: the Bongo service remained stopped during setup and data-integrity verification.

CFG-03

Result: PASS

The installed administration TUI loaded the operative Store and changed the worker polling interval from 30 to 31 seconds. The resulting suffixless file and the Store document both contained 31. Repeating the edit restored both to 30. During the first pseudo-terminal run, a terminal which did not implement cursor-visibility control exposed a fatal curs_set() assumption. Commit b4526b95580565722b235de7023a8e2dec00ad0b makes cursor visibility a best-effort operation and adds a regression test for that terminal class.

bongo-admin config check accepted both states and reported only the two expected policy warnings for this disposable configuration. bongo-admin config sync completed after each change and requested a manager reload. The systemd service remained active and the manager retained PID 584414 and its original start timestamp across the final reload.

The injected Store-write failure regression was extended to assert complete transaction rollback. It now verifies restoration of both earlier Store documents and every local configuration file, while the existing scanner activation test verifies restoration when a manager reload fails. The complete configuration-model suite passes with these checks at commit 732300efd68e6da5e2121e50d418d94defca30b3.

• Live source: commit b4526b95580565722b235de7023a8e2dec00ad0b.
• Rollback regression: commit 732300efd68e6da5e2121e50d418d94defca30b3.
• Live edit: worker.poll_interval_seconds 30 to 31 to 30.
• Result: check, interactive edit/save, file/Store synchronization, rollback, and manager reload passed without restarting or failing the service.

Runtime configuration: local Gentoo debug installation with Bongo active under systemd; no release tag was created.

CFG-04

Result: PASS

The complete installed setup wizard was run as root against the disposable Gentoo test installation with SMTP, submission, IMAP, POP3, ManageSieve, the rate-limited internal relay, ClamAV, SpamAssassin, and outgoing DKIM signing enabled. It reused the existing TLS certificate and key, generated a new 2048-bit DKIM key for bongo.test, persisted the DMARC guidance, and created the ACME credential directory even though automatic certificate issuance was left disabled.

The resulting layout contains exactly 14 suffixless documents in config.d and one suffixless default fragment in aliases.d; neither directory contains a .json filename. The security directories ssl.d, dkim.d, dmarc.d, and acme.d are owned by root:bongo with mode 0750. Private TLS and DKIM keys and the DMARC state use mode 0640. Public certificates and DKIM DNS material use mode 0644. The generated SMTP configuration points at /etc/bongo/dkim.d, uses selector bongo, and enables outgoing DKIM signing.

bongo-admin config check accepted the complete configuration. Its sole warning is expected for the intentionally direct HTTP test listener. After a systemd restart, all configured native agents, both scanner agents, the scheduler worker, and the Python Web agent remained active; the Web agent reported that it was listening on 0.0.0.0:8080.

• Live source: commit b4526b95580565722b235de7023a8e2dec00ad0b.
• Mail identity: mail.bongo.test, hosted domain bongo.test.
• Result: suffixless configuration and alias files, secure TLS/DKIM/DMARC/ACME layout, Store validation, and complete service startup passed.

Runtime configuration: local Gentoo debug installation. The generated keys are test-only material and no release tag was created.