Backport debian-security fixes from bookworm-security (2.3.19.1) to our unstable backport fork (2.3.21)

.github/workflows/pipeline.yml

@@ -39,14 +39,39 @@ jobs:
       - name: install packaging tools
         run: |
           apt-get update -q
-          apt-get install -y --no-install-recommends ca-certificates git git-buildpackage build-essential fakeroot rsync openssh-client
+          apt-get install -y --no-install-recommends ca-certificates git git-buildpackage devscripts build-essential fakeroot rsync openssh-client
 
       - uses: actions/checkout@v7
         with:
           path: dovecot
           show-progress: false
           fetch-depth: 0
 
+      # Add a distro-distinct version onto the changelog. The committed top
+      # entry is UNRELEASED with a distro-neutral base version (1:...+chatmail2);
+      # here dch finalizes it in place with a per-distro version and codename,
+      # so the bookworm and trixie build into separate versions and allow a
+      # combined release without a manual rename. Follow Debian's own security
+      # convention (+deb12uN / +deb13uN), which sorts above the neutral base
+      # and is necessary for dch to accept it as an upgrade. In the build step,
+      # the version extraction for the tarball is unaffected by this, and gbp
+      # picks up the version from the changelog for the build.
+      - name: finalize changelog for ${{ inputs.distro }}
+        working-directory: dovecot
+        env:
+          DEBFULLNAME: chatmail CI
+          DEBEMAIL: ci@chatmail.invalid
+        run: |
+          case "${{ inputs.distro }}" in
+            bookworm) suffix=deb12u1 ;;
+            trixie)   suffix=deb13u1 ;;
+            *) echo "unknown distro '${{ inputs.distro }}'" >&2; exit 1 ;;
+          esac
+          base=$(dpkg-parsechangelog -SVersion)
+          dch -v "${base}+${suffix}" --distribution "${{ inputs.distro }}" \
+              --force-distribution "Rebuild for ${{ inputs.distro }}."
+          dpkg-parsechangelog | sed -n '1,3p'
+
       - name: install build dependencies
         run: apt-get build-dep -y --no-install-recommends ./dovecot
 

.github/workflows/release.yml

@@ -65,32 +65,30 @@ jobs:
           apt-get update -q
           apt-get install -y --no-install-recommends gh
           version=$(dpkg-parsechangelog -l build-area/dovecot_*.dsc -Sversion | sed 's/^1://')
-          tag="upstream/${version}"
-          for f in build-area/dovecot-core_*.deb \
-                   build-area/dovecot-imapd_*.deb \
-                   build-area/dovecot-lmtpd_*.deb; do
-            mv "$f" "${f%.deb}_${{ matrix.distro }}.deb"
-          done
-          for f in build-area/dovecot_*.buildinfo; do
-            mv "$f" "${f%.buildinfo}_${{ matrix.distro }}.buildinfo"
-          done
+          # The build stamps a distro-distinct version onto the changelog
+          # (+deb12u1 / +deb13u1). The GitHub release itself
+          # stays combined across the matrix, keyed on the neutral base
+          # version with that stamp stripped back off.
+          base_version=$(echo "$version" | sed -E 's/\+deb[0-9]+u[0-9]+$//')
+          tag="upstream/${base_version}"
           gh release create "$tag" --title "$tag" || true
           gh release upload "$tag" --clobber \
-            build-area/dovecot-core_*_${{ matrix.distro }}.deb \
-            build-area/dovecot-imapd_*_${{ matrix.distro }}.deb \
-            build-area/dovecot-lmtpd_*_${{ matrix.distro }}.deb \
-            build-area/dovecot_*_${{ matrix.distro }}.buildinfo
+            build-area/dovecot-core_*.deb \
+            build-area/dovecot-imapd_*.deb \
+            build-area/dovecot-lmtpd_*.deb \
+            build-area/dovecot_*.buildinfo
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      # Sources are byte-identical across the matrix (dpkg-source is
-      # deterministic on the same tag), so only one job uploads them to
-      # avoid the other three racing on the same object names.
+      # The changelog is stamped per-distro before the build so the source
+      # package differs and must be uploaded once per distro. Arch doesn't
+      # affect the source, so only one arch per distro uploads it.
       - name: upload source to github release
-        if: matrix.distro == 'trixie' && matrix.arch == 'amd64'
+        if: matrix.arch == 'amd64'
         run: |
           version=$(dpkg-parsechangelog -l build-area/dovecot_*.dsc -Sversion | sed 's/^1://')
-          tag="upstream/${version}"
+          base_version=$(echo "$version" | sed -E 's/\+deb[0-9]+u[0-9]+$//')
+          tag="upstream/${base_version}"
           gh release upload "$tag" --clobber \
             build-area/dovecot_*.dsc \
             build-area/dovecot_*.orig.tar.* \

debian/changelog

@@ -1,3 +1,54 @@
+dovecot (1:2.3.21+dfsg1-3+chatmail2) UNRELEASED; urgency=medium
+
+  * Backport 14 Debian security fixes from bookworm-security (2.3.19.1
+    base, deb12u1-u6, tip b0beae072) onto our 2.3.21 rebuild, which shared no
+    history with the backport work and previously carried none of them. The
+    deb12u3/u4 regression fixes and deb12u5 corrections are already folded
+    into the copied files (single CVE-2025-59032.patch; CVE-2026-0394-2.patch
+    is the passwd-file regression fix; -27855-4 and -27857-5 are the u5
+    corrections). All 26 patch files apply to 2.3.21 with offsets only, no
+    fuzz and no rejects. 
+    - CVE-2024-23184: many address headers cause excessive CPU use during
+      message parsing. (deb12u1)
+    - CVE-2024-23185: oversized headers cause excessive memory/CPU use in the
+      header parser. (deb12u1)
+    - CVE-2025-59031: remove the FTS decode2text.sh helper; we shipped it only
+      as a doc example, and d/rules and d/dovecot-core.examples are updated to
+      drop the now-missing file. (deb12u2)
+    - CVE-2025-59032: managesieve-login crash on an unfinished command
+      pre-auth. (deb12u2)
+    - CVE-2026-0394: passwd-file passdb path normalization. (deb12u2)
+    - CVE-2026-27855: auth cache used the untranslated username when removing
+      an entry; align it with the lookup/insert paths, plus supporting passdb
+      event-lifecycle refactor and an empty-update_query guard. (deb12u2)
+    - CVE-2026-27856: doveadm HTTP/TCP API-key comparison timing side channel.
+      (deb12u2)
+    - CVE-2026-27857: unbounded IMAP parser list nesting is a pre-auth memory
+      DoS; add imap_parser_params.list_count_limit and cap the pre-login
+      parser to one open list. (deb12u2)
+    - CVE-2026-27858: managesieve-login accepted an unverified SASL initial
+      response. (deb12u2)
+    - CVE-2026-27859: RFC2231 continuation-parameter parsing DoS. (deb12u2)
+    - CVE-2026-33603: login-common accepted non-base64 bytes (e.g. TAB) in a
+      SASL continuation response, injecting fields into the auth protocol.
+      (deb12u6)
+    - CVE-2026-40016: Sieve :contains/:matches match could bypass the CPU
+      limit. (deb12u6)
+    - CVE-2026-40020: invalid ACL identifier handling in acl/imap-acl.
+      (deb12u6)
+    - CVE-2026-42006: the CVE-2026-27857 limit counted ')' not '('; move the
+      check into imap_parser_open_list() so it actually bounds nesting.
+      (deb12u6)
+  * d/tests: converge with bookworm-security, adding the regression tests that
+    ship with the fixes: usage/imap-cram-md5, usage/sieve, and the
+    debian_bug_1134464 passwd-file delivery test (guards CVE-2026-0394);
+    extend the usage Depends with dovecot-managesieved and sieve-connect.
+  * CI: emit a distro-distinct package version per stable target. The base
+    version here stays UNRELEASED; .github/workflows/pipeline.yml finalizes it
+    to +deb12u1 (bookworm) or +deb13u1 (trixie) at build time.
+
+ -- j4n <j4n@systemli.org>  Tue, 21 Jul 2026 09:58:59 +0200
+
 dovecot (1:2.3.21+dfsg1-3+chatmail1) unstable; urgency=medium
 
   * Introduce subversion for chatmail relay downstream rebuild of Debian's