Unprivileged mail image proof is blocked by license directory permissions

🤖 Generated by the Agentic Engineer

Expected Behavior

The deployed unprivileged process can read the public licenses supplied in its image. The native image proof then continues to the existing account and recipient checks without changing its access, privacy or checksum requirements.

Actual Behavior

The current candidate's native proof stops before mailbox bootstrap with the fixed diagnostic IMAGE_ASSET_FAILURE=proxy-license-directory. The same proof blocks the active shared-CI repairs #5561 and #5562.

Read-only inspection of an immutable published image independently confirms the packaging defect: the added proxy-license directory has mode 0444, so it cannot be traversed by the image's unprivileged identity. The license file is correctly read-only. The Dockerfile is unchanged between that producer revision and current main. This establishes an image packaging and validation failure; no mailbox service outage or credential exposure is claimed.

Steps to Replicate

Build the current pinned bootstrap Dockerfile.
Run its existing image asset proof with the unprivileged identity, read-only filesystem and dropped capabilities.
Observe the missing directory traversal permission before the account/bootstrap phase starts.

Acceptance Criteria

Restore traversal of the public proxy-license directory after the remote asset is added, preserving the license file's read-only mode.
Keep the current user, capability, read-only filesystem, checksum, license-readability and log-privacy requirements.
Pass the complete native mail proof and relevant source checks at the proposed head.
Complete current-head review and protected delivery; verify the published image's effective directory and file modes afterward.

Planning

Shared delivery hotfix under #4979, high priority and medium end-to-end effort because it requires a real image build, native protocol proof, review and publication readback. It preempts the held performance follow-up while the independent jq and publication repairs remain under validation. The consumer contract's hotfix exception applies to draft intake; no other readiness or security gate is waived.

Part of #4979.

🔗 Related PRs

#5575 - fix(mail): adopt the corrected bootstrap image [closed]
#5565 - fix(ci): unblock native platform validation [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

chore: agent-claim #5563 nonce=b8af79f26dda9e7bdc7453d5bcbee986

🤖 Generated by the Agentic Engineer

#5565 merged through the protected queue as 2d60bc4f498f6a15fca1970aeff6db940d781405. Its production-deploying run, Validate Main and image publication all passed at that source revision.

The publisher signed and verified sha256:1d812772d101dbb1499c23319b0b8dfe77dc8079f4e45ab046b77dd2ac244376, which matches anonymous registry readback. All 14 layer sizes and digests were independently checked. The final public-license directory is 0755, its ancestors remain traversable, the license file stays 0444, and the image user remains unchanged. The complete native mail proof also passed before protected delivery.

The producer acceptance checks are verified. Runtime adoption remains pending because the checked-in image pin still references the preceding publication; this issue stays open for that follow-up.

chore: agent-claim #5563 nonce=d50a079293490f3f4990cd3a866c9f61

chore: agent-claim #5563 nonce=f7bc3660bc83f2d40fcd2a45beb20c73

🤖 Generated by the Agentic Engineer

The packaging repair is delivered. #5565 restored the public license directory to mode 0755 while preserving the read-only 0444 file and unprivileged identity. Its complete native image proof passed, and independent inspection of the signed published image confirmed the effective modes. #5575 adopted that exact publication without changing Stalwart 0.16.27 or its data format.

The adoption's protected production run passed all 17 public checks with active readiness. Validate Main, Release, Code Quality and CodeQL all passed at merged source 3f185eb977ffc4d0d61f13ec52dcda6b6cb3b967. Native convergence confirmed that source, v1.283.7 was published from it, and live readback confirmed the adopted image was ready with zero restarts.

This completes the image-packaging acceptance criteria. The separate mail availability investigation, storage, recovery, SSO and high-availability acceptance remain open; closing this issue does not establish overall mail-service health.

chore: agent-claim #5563 nonce=2b59d10cb40920164e021ec30fbd3209

Navigation Menu

Repository navigation

Unprivileged mail image proof is blocked by license directory permissions #5563

Expected Behavior

Actual Behavior

Steps to Replicate

Acceptance Criteria

Planning

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Unprivileged mail image proof is blocked by license directory permissions #5563

Description

Expected Behavior

Actual Behavior

Steps to Replicate

Acceptance Criteria

Planning

Activity

coderabbitai commented on Oct 29, 2026

devantler commented on Oct 29, 2026

devantler commented on Oct 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions