Release v0.1.15

Make package publication retries hash-safe
Define governed secure mail profiles
2026-08-04 15:22:07 +02:00 · 2026-08-04 14:32:19 +02:00 · 2026-08-04 14:02:21 +02:00 · 2026-08-04 14:02:10 +02:00
9 changed files with 287 additions and 40 deletions
@@ -14,6 +14,8 @@ on:
 jobs:
  publish-packages:
    runs-on: ubuntu-latest
+    env:
+      GITEA_REPOSITORY: ${{ gitea.repository }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
@@ -29,7 +31,6 @@ jobs:
        env:
          REQUESTED_TAG: ${{ inputs.release_tag }}
          TRIGGER_TAG: ${{ gitea.ref_name }}
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          set -euo pipefail
          tag="${REQUESTED_TAG:-$TRIGGER_TAG}"
@@ -43,24 +44,6 @@ jobs:
            echo "Release tag is not contained in main" >&2
            exit 1
          }
-          python - "$tag" <<'PY'
-          import fnmatch
-          import json
-          import os
-          import sys
-          import urllib.request
-
-          tag = sys.argv[1]
-          repository = os.environ["GITEA_REPOSITORY"]
-          request = urllib.request.Request(
-              f"{os.environ['GITEA_API_URL']}/repos/{repository}/tag_protections",
-              headers={"Authorization": f"token {os.environ['GITEA_TOKEN']}"},
-          )
-          with urllib.request.urlopen(request, timeout=30) as response:
-              protections = json.load(response)
-          if not any(fnmatch.fnmatchcase(tag, item.get("name_pattern", "")) for item in protections):
-              raise SystemExit(f"Release tag {tag!r} is not covered by repository tag protection")
-          PY
          git checkout --detach "$tag"
          printf 'RELEASE_TAG=%s\n' "$tag" >> "$GITEA_ENV"
          printf 'SOURCE_DATE_EPOCH=%s\n' "$(git show -s --format=%ct HEAD)" >> "$GITEA_ENV"
@@ -130,7 +113,7 @@ jobs:
              const escapedRepository = repository.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
              const gitTag = specifier.match(
                new RegExp(
-                  `^git\\+(?:ssh://git@|https://)git\\.add-ideas\\.de/GovOPlaN/${escapedRepository}\\.git#v([0-9]+\\.[0-9]+\\.[0-9]+)$`,
+                  `^git\\+(?:ssh://git@|https://)git\\.add-ideas\\.de/(?:GovOPlaN|add-ideas)/${escapedRepository}\\.git#v([0-9]+\\.[0-9]+\\.[0-9]+)$`,
                ),
              );
              if (gitTag) {
@@ -180,6 +163,78 @@ jobs:
        with:
          name: module-packages-${{ gitea.ref_name }}
          path: dist/package-artifacts.json
+      - name: Check immutable registry state
+        shell: bash
+        env:
+          PACKAGE_TOKEN: ${{ secrets.GOVOPLAN_PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "$PACKAGE_TOKEN"
+          python - <<'PY'
+          import hashlib
+          import json
+          import os
+          from pathlib import Path
+          import tomllib
+          from urllib.error import HTTPError
+          from urllib.parse import quote
+          from urllib.request import Request, urlopen
+
+          api_root = "https://git.add-ideas.de/api/v1/packages/GovOPlaN"
+          token = os.environ["PACKAGE_TOKEN"]
+
+          def should_publish(kind, name, version, path):
+              package_url = "/".join(
+                  (api_root, kind, quote(name, safe=""), quote(version, safe=""), "files")
+              )
+              request = Request(
+                  package_url,
+                  headers={"Accept": "application/json", "Authorization": f"token {token}"},
+              )
+              try:
+                  with urlopen(request, timeout=30) as response:
+                      files = json.load(response)
+              except HTTPError as exc:
+                  if exc.code == 404:
+                      print(f"{kind} package {name}=={version} is not published yet")
+                      return True
+                  raise
+              if not isinstance(files, list) or len(files) != 1:
+                  raise SystemExit(
+                      f"immutable {kind} package {name}=={version} has an unexpected file set"
+                  )
+              expected_sha256 = hashlib.sha256(path.read_bytes()).hexdigest()
+              if files[0].get("sha256") != expected_sha256:
+                  raise SystemExit(
+                      f"immutable {kind} package {name}=={version} already exists with a different SHA-256"
+                  )
+              print(f"verified existing {kind} package {name}=={version} ({expected_sha256})")
+              return False
+
+          project = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]
+          wheels = tuple(Path("dist").glob("*.whl"))
+          if len(wheels) != 1:
+              raise SystemExit("release build must contain exactly one wheel")
+          publish_pypi = should_publish(
+              "pypi", str(project["name"]), str(project["version"]), wheels[0]
+          )
+
+          tarballs = tuple(Path("dist").glob("*.tgz"))
+          if len(tarballs) > 1:
+              raise SystemExit("release build must contain at most one npm package")
+          publish_npm = False
+          if tarballs:
+              webui = json.loads(
+                  Path(".package-webui/package.json").read_text(encoding="utf-8")
+              )
+              publish_npm = should_publish(
+                  "npm", str(webui["name"]), str(webui["version"]), tarballs[0]
+              )
+
+          with Path(os.environ["GITEA_ENV"]).open("a", encoding="utf-8") as env_file:
+              env_file.write(f"PUBLISH_PYPI={int(publish_pypi)}\n")
+              env_file.write(f"PUBLISH_NPM={int(publish_npm)}\n")
+          PY
      - name: Publish wheel and WebUI package
        shell: bash
        env:
@@ -189,13 +244,17 @@ jobs:
          set -euo pipefail
          test -n "$PACKAGE_USERNAME"
          test -n "$PACKAGE_TOKEN"
+          if [[ "$PUBLISH_PYPI" == 1 ]]; then
            TWINE_USERNAME="$PACKAGE_USERNAME" TWINE_PASSWORD="$PACKAGE_TOKEN" \
              python -m twine upload --non-interactive \
                --repository-url https://git.add-ideas.de/api/packages/GovOPlaN/pypi \
                dist/*.whl
+          else
+            echo "Exact wheel is already present; skipping immutable retry."
+          fi
          shopt -s nullglob
          webui_packages=(dist/*.tgz)
-          if (( ${#webui_packages[@]} )); then
+          if (( ${#webui_packages[@]} )) && [[ "$PUBLISH_NPM" == 1 ]]; then
            npmrc="$(mktemp)"
            trap 'rm -f "$npmrc"' EXIT
            chmod 600 "$npmrc"
@@ -203,7 +262,9 @@ jobs:
              '@govoplan:registry=https://git.add-ideas.de/api/packages/GovOPlaN/npm/' \
              "//git.add-ideas.de/api/packages/GovOPlaN/npm/:_authToken=$PACKAGE_TOKEN" \
              > "$npmrc"
-            NPM_CONFIG_USERCONFIG="$npmrc" npm publish "${webui_packages[0]}" \
+            NPM_CONFIG_USERCONFIG="$npmrc" npm publish "./${webui_packages[0]}" \
              --ignore-scripts --access public \
              --registry https://git.add-ideas.de/api/packages/GovOPlaN/npm/
+          elif (( ${#webui_packages[@]} )); then
+            echo "Exact WebUI package is already present; skipping immutable retry."
          fi
@@ -125,7 +125,9 @@ does not contribute these routes directly.
 POP3 and JMAP are deferred. The protocol decision is documented in
 [docs/MAIL_PROTOCOL_ROADMAP.md](docs/MAIL_PROTOCOL_ROADMAP.md): stabilize
 SMTP/IMAP first, prefer JMAP for modern mailbox sync/search later, and add POP3
-only for explicit legacy-download requirements.
+only for explicit legacy-download requirements. The same roadmap records the
+approved S/MIME-first, OpenPGP-additional message-protection profile and its
+no-silent-downgrade requirement.

 Platform RBAC and governance rules are documented in `govoplan-core/docs/`.
 The [Mail handbook](docs/MAIL_HANDBOOK.md) provides the adaptive user,
@@ -13,6 +13,28 @@ and JMAP are deferred until the IMAP mailbox MVP is stable.
 This baseline matches the first production use case: send campaign mail, append
 sent copies when configured, and inspect mailboxes read-only.

+## Message Protection Profiles
+
+The product and security profile approved on 2026-08-04 makes S/MIME the first
+institutional signing/encryption profile and OpenPGP an additional explicit
+profile. Neither profile is implemented by treating protection as a local Mail
+toggle:
+
+- private-key custody belongs to an Encryption/KMS provider and usable private
+  keys are never persisted by Mail;
+- recipient certificates and keys initially come from administered directory
+  or LDAP sources; opportunistic Internet discovery is deferred;
+- required signing or encryption fails closed when material is missing,
+  expired, revoked, unverifiable, or its provider is unavailable;
+- plaintext fallback is permitted only by an explicit, audited policy and is
+  never inferred from provider failure; and
+- delivery evidence pins the signing identity, trust/revocation evidence,
+  algorithm suite, key version, and any explicit downgrade decision.
+
+Provider-neutral S/MIME custody and interoperability fixtures are the first
+implementation slice. OpenPGP uses the same no-silent-downgrade boundary after
+the S/MIME profile is stable.
+
 ## JMAP

 JMAP is the preferred future sync/search protocol where target mail servers
@@ -0,0 +1,93 @@
+{
+  "name": "@govoplan/mail-webui",
+  "version": "0.1.15",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@govoplan/mail-webui",
+      "version": "0.1.15",
+      "peerDependencies": {
+        "@govoplan/core-webui": "^0.1.15",
+        "lucide-react": "^1.23.0",
+        "react": ">=19.2.7 <20",
+        "react-dom": ">=19.2.7 <20",
+        "react-router": ">=8.3.0 <9"
+      },
+      "peerDependenciesMeta": {
+        "@govoplan/core-webui": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cookie-es": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/cookie-es/-/cookie-es-3.1.1.tgz",
+      "integrity": "sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/lucide-react": {
+      "version": "1.28.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.28.0.tgz",
+      "integrity": "sha512-fARAFJULsGuDDydjp6+6blekG/sBIM29TerzLjc9bQUKAcEfrSc4ZQKb25KRz4OMKd87cZTb5dgq0w/T6KufVg==",
+      "license": "ISC",
+      "peer": true,
+      "peerDependencies": {
+        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/react": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
+      "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz",
+      "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.8"
+      }
+    },
+    "node_modules/react-router": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-8.3.0.tgz",
+      "integrity": "sha512-qyPMvW83jGIct3yiieisxdk9M745anqhpIMKN5m1t6yBMfgVPpt77aHOqs5fUlEJRMCGffg9BaQLH9oPVOL7xQ==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "cookie-es": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=22.22.0"
+      },
+      "peerDependencies": {
+        "react": ">=19.2.7",
+        "react-dom": ">=19.2.7"
+      },
+      "peerDependenciesMeta": {
+        "react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT",
+      "peer": true
+    }
+  }
+}
@@ -1,6 +1,6 @@
 {
  "name": "@govoplan/mail-webui",
-  "version": "0.1.10",
+  "version": "0.1.15",
  "private": true,
  "type": "module",
  "main": "webui/src/index.ts",
@@ -19,11 +19,11 @@
    "LICENSE"
  ],
  "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.10",
+    "@govoplan/core-webui": "^0.1.15",
    "lucide-react": "^1.23.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "react-router-dom": "^7.1.1"
+    "react": ">=19.2.7 <20",
+    "react-dom": ">=19.2.7 <20",
+    "react-router": ">=8.3.0 <9"
  },
  "peerDependenciesMeta": {
    "@govoplan/core-webui": {
@@ -4,14 +4,14 @@ build-backend = "setuptools.build_meta"

 [project]
 name = "govoplan-mail"
-version = "0.1.10"
+version = "0.1.15"
 description = "GovOPlaN mail module with backend and WebUI integration."
 readme = "README.md"
 requires-python = ">=3.12"
 license = { file = "LICENSE" }
 authors = [{ name = "GovOPlaN" }]
 dependencies = [
-  "govoplan-core>=0.1.9",
+  "govoplan-core>=0.1.15",
  "pydantic>=2,<3",
  "redis>=5,<6",
  "SQLAlchemy>=2,<3",
@@ -299,7 +299,7 @@ IMAP_PROVIDER = ExternalProviderDeclaration(
 manifest = ModuleManifest(
    id="mail",
    name="Mail",
-    version="0.1.10",
+    version="0.1.15",
    required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
    optional_dependencies=("campaigns", "addresses", "calendar", "search"),
    provides_interfaces=(
@@ -1,17 +1,17 @@
 {
  "name": "@govoplan/mail-webui",
-  "version": "0.1.10",
+  "version": "0.1.15",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@govoplan/mail-webui",
-      "version": "0.1.10",
+      "version": "0.1.15",
      "devDependencies": {
        "typescript": "^5.7.2"
      },
      "peerDependencies": {
-        "@govoplan/core-webui": "^0.1.10",
+        "@govoplan/core-webui": "^0.1.15",
        "lucide-react": "^1.23.0",
        "react": ">=19.2.7 <20",
        "react-dom": ">=19.2.7 <20",
@@ -23,6 +23,75 @@
        }
      }
    },
+    "node_modules/cookie-es": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/cookie-es/-/cookie-es-3.1.1.tgz",
+      "integrity": "sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/lucide-react": {
+      "version": "1.28.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.28.0.tgz",
+      "integrity": "sha512-fARAFJULsGuDDydjp6+6blekG/sBIM29TerzLjc9bQUKAcEfrSc4ZQKb25KRz4OMKd87cZTb5dgq0w/T6KufVg==",
+      "license": "ISC",
+      "peer": true,
+      "peerDependencies": {
+        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/react": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
+      "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz",
+      "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.8"
+      }
+    },
+    "node_modules/react-router": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-8.3.0.tgz",
+      "integrity": "sha512-qyPMvW83jGIct3yiieisxdk9M745anqhpIMKN5m1t6yBMfgVPpt77aHOqs5fUlEJRMCGffg9BaQLH9oPVOL7xQ==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "cookie-es": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=22.22.0"
+      },
+      "peerDependencies": {
+        "react": ">=19.2.7",
+        "react-dom": ">=19.2.7"
+      },
+      "peerDependenciesMeta": {
+        "react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT",
+      "peer": true
+    },
    "node_modules/typescript": {
      "version": "5.9.3",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
@@ -1,6 +1,6 @@
 {
  "name": "@govoplan/mail-webui",
-  "version": "0.1.10",
+  "version": "0.1.15",
  "private": true,
  "type": "module",
  "main": "src/index.ts",
@@ -14,7 +14,7 @@
    "./styles/mail-profiles.css": "./src/styles/mail-profiles.css"
  },
  "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.10",
+    "@govoplan/core-webui": "^0.1.15",
    "lucide-react": "^1.23.0",
    "react": ">=19.2.7 <20",
    "react-dom": ">=19.2.7 <20",
Author	SHA1	Message	Date
zemion	622f63b4b5	Release v0.1.15 Module Package Release / publish-packages (push) Successful in 11s Details	2026-08-04 15:22:07 +02:00
zemion	b65431f437	Make package publication retries hash-safe	2026-08-04 14:32:19 +02:00
zemion	c42a7816fd	Define governed secure mail profiles	2026-08-04 14:02:21 +02:00
zemion	a63d541f0e	Harden module package publication	2026-08-04 14:02:10 +02:00