src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: housekeeping — rescue orphaned doc, ignore .DS_Store, adopt vnc-v0.3.0

Browse Source 
Commits the offline-client architecture analysis doc that was sitting
untracked in docs/ — its own header already warns this exact thing
happened once before (~/vncmail-plus is a shared checkout; an earlier
untracked copy was lost to a concurrent branch switch). Confirmed the
hazard is still live: vnc/VNC-CHANGES.md itself was found deleted from
disk mid-edit by this session, by something else touching the checkout
concurrently, and had to be restored with `git checkout --` before this
commit. Committing on sight is the only defense against that, not a
process improvement for later.

Also:
- .DS_Store added to .gitignore (was untracked in docs/)
- introduces a VNC-side feature version, separate from package.json's
  upstream-tracking version (1.7.8, must stay that way per the fork's own
  rule 4 - bumping it would turn merging upstream releases into a diffing
  exercise). Retroactively bucketed at the milestone boundaries the commit
  history already has: v0.1.0 fork bootstrap, v0.2.0 S/MIME plugin
  audit+fixes, v0.3.0 the internal-CA foundation just landed. Tagged
  vnc-v0.3.0 on this commit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Bernd Rodler
2026-08-04 13:10:03 +02:00
co-authored by Claude Opus 5
parent 3afa7ce012
commit b6fdfe72ca
3 changed files with 168 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vnc/VNC-CHANGES.md
+14
View File
@@ -4,6 +4,20 @@ VNCmail+ is a fork of [bulwarkmail/webmail](https://github.com/bulwarkmail/webma
(AGPL-3.0). This file records **every** intentional divergence from upstream so
that merging new upstream releases stays a triage exercise, not an archaeology dig.
## VNC feature version
`package.json`'s version tracks **upstream** (currently `1.7.8`) and must stay
that way per rule 4 below — bumping it would turn merging upstream releases into
a diffing exercise instead of a fast-forward. The VNC-side feature set gets its
own counter instead, tagged `vnc-vX.Y.Z` on `dev`, bumped whenever a milestone
below closes:
| Version | Date | Milestone |
|---|---|---|
| `v0.1.0` | 2026-08-03 | Fork bootstrap: VNClagoon + SRC brand themes, per-theme logos, k8s deploy (after Vercel was abandoned — Bulwark writes to a local data dir, serverless fs is read-only), 6h session cookie |
| `v0.2.0` | 2026-08-04 | SRC theme MD3 componentry; plugin-sandbox hardening (`B-01` scanner bypass, `B-04` unpermissioned hook registration); S/MIME plugin forked, audited (S-01, 9 findings), 3 shipping-blockers fixed + 2 hardened, verified end-to-end on real mail (sign, encrypt, decrypt, banner) |
| `v0.3.0` | 2026-08-04 | Internal CA foundation (`P1`): EJBCA Community manifests + root-ceremony runbook (`A-01`/`A-06`), server-side `CaProvider` + enrolment route (`A-02`, `C-08` server half), finding 11 (certificate address binding). **No certificate has been issued yet** — the browser half of `C-08` (in-browser CSR generation) and a live EJBCA are both still outstanding. |
## Rules of the fork
1. **Keep upstream files unmodified whenever possible.** Prefer env vars