import cyrus-imapd-3.4.1-10.el9

.cyrus-imapd.metadata

@@ -0,0 +1,4 @@
+616efd5bc85d00486a80c78a4d6cc12ebe07565f SOURCES/cassandane-693da61.tar.gz
+fd08427d105d2306e95528eff407ab1723b31c69 SOURCES/cassandane-testdata-ca669d4b.tar.gz
+8edfa3bca1f914ca30856e6f73d07e4de66173ed SOURCES/cyrus-imapd-3.4.1.tar.gz
+7eefe4d240d7033b1f460f85038f6607154e58f4 SOURCES/cyrus-manpages-3.2.6.tar.gz

.gitignore

@@ -0,0 +1,4 @@
+SOURCES/cassandane-693da61.tar.gz
+SOURCES/cassandane-testdata-ca669d4b.tar.gz
+SOURCES/cyrus-imapd-3.4.1.tar.gz
+SOURCES/cyrus-manpages-3.2.6.tar.gz

SOURCES/README.rpm

@@ -0,0 +1,34 @@
+---------------
+Cyrus IMAPd RPM
+---------------
+
+This is a _very_ 'quick and dirty' install howto.
+
+The following steps should lead you to a running Cyrus IMAP server:
+
+1)  Install on a distribution which is supported by this RPM. Don't install
+    on a dirty system, where you have previously installed from source.
+2)  Don't install if you have a previous Cyrus IMAPd installation <=2.1.x on
+    your box. Upgrading any Invoca rpm based installation should be fine.
+3)  Make sure you understand that this RPM installs in FHS compliant
+    directories, like /var/lib/imap and /var/spool/imap
+4)  Make sure cyrus-sasl is installed.
+5)  Make sure saslauthd is running. If not, edit /etc/sysconfig/saslauthd as
+    needed and do 'chkconfig saslauthd on ; service saslauthd start'
+6)  Install the cyrus-imapd RPMs.
+7)  If it's your first install of Cyrus IMAPd, then set a password for the
+    cyrus user in whatever database you are using to authenticate. When
+    using a local account, this should be 'passwd cyrus'.
+8)  Make sure your MTA delivers to Cyrus IMAPd, I recommend LMTP for this.
+9)  Start Cyrus IMAPd with 'service cyrus-imapd start'
+10) Run cyradm and create a user. Usually it's something like this:
+    'cyradm --user=cyrus --auth=login localhost'
+11) If you're using sendmail, be aware that cyrusv2.m4 included in standard
+    sendmail distribution uses socket /var/imap/socket/lmtp while this rpm
+    uses /var/lib/imap/socket/lmtp.
+12) Check your syslog configuration. This RPM uses the mail facility to log
+    messages. On busy sites you may want to limit the mail facility to the
+    info priority with something like 'mail.info    /var/log/maillog' in
+    /etc/syslog.conf.
+
+Enjoy!

SOURCES/cassandane.ini

@@ -0,0 +1,56 @@
+# A basic cassandane.ini file for running cassandane as part of the Fedora
+# package build process.
+
+# The idea here is to run tests on the just-compiled version of cyrus-imapd.
+# However, many of the build locations are just random temporary directories, and
+# so this requires some finesse.
+
+[cassandane]
+rootdir = CASSDIR/work
+pwcheck = alwaystrue # This is enabled in Fedora builds
+cleanup = no
+maxworkers = 1
+base_port = 19100
+
+#[valgrind]
+#enabled = no
+
+# The installed copy
+[cyrus default]
+prefix = /usr
+destdir = BUILDROOT
+quota = cyr_quota
+
+# Replication testing disabled
+# [cyrus replica]
+# [cyrus murder]
+
+# Don't enable any of the gdb options but leave them here in case someone ever
+# needs to do so
+#[gdb]
+# imapd = yes
+# sync_server = yes
+# lntpd = yes
+# timsieved = yes
+# backupd = yes
+
+[config]
+altnamespace = no
+unixhierarchysep = no
+client_timeout = 60
+
+#[caldavtalk]
+#basedir = CASSDIR/cassandane/testdata
+
+[imaptest]
+# Cassandane wants this to not be installed.  Don't know why.  To use it we
+# have to make a directory and link things into it.
+basedir = imaptest
+
+# [jmaptester]
+# basedir = JMAP-Tester
+# The JMAP modules end up needing JSON-Typist (which I could bundle) and CryptX (which is a bit too much to bundle)
+
+# [caldavtester]
+# XXX Would need to include the source in the cyrus package just as cassandane is, and get it built before running tests
+# basedir = ...

SOURCES/cyrus-imapd-CVE-2021-33582.patch

@@ -0,0 +1,170 @@
+diff --git a/imap/http_dav.c b/imap/http_dav.c
+index d5f7c114a2..abc6da42ca 100644
+--- a/imap/http_dav.c
++++ b/imap/http_dav.c
+@@ -6108,7 +6108,7 @@ EXPORTED int meth_propfind(struct transaction_t *txn, void *params)
+     xmlDocPtr indoc = NULL, outdoc = NULL;
+     xmlNodePtr root, cur = NULL, props = NULL;
+     xmlNsPtr ns[NUM_NAMESPACE];
+-    struct hash_table ns_table = { 0, NULL, NULL };
++    struct hash_table ns_table = HASH_TABLE_INITIALIZER;
+     struct propfind_ctx fctx;
+ 
+     memset(&fctx, 0, sizeof(struct propfind_ctx));
+@@ -8083,7 +8083,7 @@ int meth_report(struct transaction_t *txn, void *params)
+     xmlNodePtr inroot = NULL, outroot = NULL, cur, prop = NULL, props = NULL;
+     const struct report_type_t *report = NULL;
+     xmlNsPtr ns[NUM_NAMESPACE];
+-    struct hash_table ns_table = { 0, NULL, NULL };
++    struct hash_table ns_table = HASH_TABLE_INITIALIZER;
+     struct propfind_ctx fctx;
+ 
+     memset(&fctx, 0, sizeof(struct propfind_ctx));
+diff --git a/imap/jmap_mail.c b/imap/jmap_mail.c
+index 7f2d9cb563..84845d273b 100644
+--- a/imap/jmap_mail.c
++++ b/imap/jmap_mail.c
+@@ -4334,7 +4334,7 @@ static void _email_querychanges_collapsed(jmap_req_t *req,
+     memset(&touched_ids, 0, sizeof(hash_table));
+     construct_hash_table(&touched_ids, mdcount + 1, 0);
+ 
+-    hashu64_table touched_cids = HASH_TABLE_INITIALIZER;
++    hashu64_table touched_cids = HASHU64_TABLE_INITIALIZER;
+     memset(&touched_cids, 0, sizeof(hashu64_table));
+     construct_hashu64_table(&touched_cids, mdcount + 1, 0);
+ 
+diff --git a/lib/hash.c b/lib/hash.c
+index 639b6997e6..593f1bf968 100644
+--- a/lib/hash.c
++++ b/lib/hash.c
+@@ -43,10 +43,11 @@ EXPORTED hash_table *construct_hash_table(hash_table *table, size_t size, int us
+       assert(table);
+       assert(size);
+ 
+-      table->size  = size;
++      table->size = size;
++      table->seed = rand(); /* might be zero, that's okay */
+ 
+       /* Allocate the table -- different for using memory pools and not */
+-      if(use_mpool) {
++      if (use_mpool) {
+           /* Allocate an initial memory pool for 32 byte keys + the hash table
+            * + the buckets themselves */
+           table->pool =
+@@ -72,7 +73,7 @@ EXPORTED hash_table *construct_hash_table(hash_table *table, size_t size, int us
+ 
+ EXPORTED void *hash_insert(const char *key, void *data, hash_table *table)
+ {
+-      unsigned val = strhash(key) % table->size;
++      unsigned val = strhash_seeded(table->seed, key) % table->size;
+       bucket *ptr, *newptr;
+       bucket **prev;
+ 
+@@ -159,7 +160,7 @@ EXPORTED void *hash_lookup(const char *key, hash_table *table)
+       if (!table->size)
+           return NULL;
+ 
+-      val = strhash(key) % table->size;
++      val = strhash_seeded(table->seed, key) % table->size;
+ 
+       if (!(table->table)[val])
+             return NULL;
+@@ -183,7 +184,7 @@ EXPORTED void *hash_lookup(const char *key, hash_table *table)
+  * since it will leak memory until you get rid of the entire hash table */
+ EXPORTED void *hash_del(const char *key, hash_table *table)
+ {
+-      unsigned val = strhash(key) % table->size;
++      unsigned val = strhash_seeded(table->seed, key) % table->size;
+       bucket *ptr, *last = NULL;
+ 
+       if (!(table->table)[val])
+diff --git a/lib/hash.h b/lib/hash.h
+index e49037d614..e476de77da 100644
+--- a/lib/hash.h
++++ b/lib/hash.h
+@@ -3,10 +3,11 @@
+ #define HASH__H
+ 
+ #include <stddef.h>           /* For size_t     */
++#include <stdint.h>
+ #include "mpool.h"
+ #include "strarray.h"
+ 
+-#define HASH_TABLE_INITIALIZER {0, NULL, NULL}
++#define HASH_TABLE_INITIALIZER {0, 0, NULL, NULL}
+ 
+ /*
+ ** A hash table consists of an array of these buckets.  Each bucket
+@@ -32,6 +33,7 @@ typedef struct bucket {
+ 
+ typedef struct hash_table {
+     size_t size;
++    uint32_t seed;
+     bucket **table;
+     struct mpool *pool;
+ } hash_table;
+diff --git a/lib/strhash.c b/lib/strhash.c
+index d7c1741d2a..1b3251db73 100644
+--- a/lib/strhash.c
++++ b/lib/strhash.c
+@@ -42,17 +42,32 @@
+ 
+ #include "config.h"
+ 
+-EXPORTED unsigned strhash(const char *string)
++#include "lib/strhash.h"
++
++/* The well-known djb2 algorithm (e.g. http://www.cse.yorku.ca/~oz/hash.html),
++ * with the addition of an optional seed to limit predictability.
++ *
++ * XXX return type 'unsigned' for back-compat to previous version, but
++ * XXX ought to be 'uint32_t'
++ */
++EXPORTED unsigned strhash_seeded_djb2(uint32_t seed, const char *string)
+ {
+-      unsigned ret_val = 0;
+-      int i;
++    const unsigned char *ustr = (const unsigned char *) string;
++    unsigned hash = 5381;
++    int c;
+ 
+-      while (*string)
+-      {
+-            i = (int) *string;
+-            ret_val ^= i;
+-            ret_val <<= 1;
+-            string ++;
+-      }
+-      return ret_val;
++    if (seed) {
++        /* treat the bytes of the seed as a prefix to the string */
++        unsigned i;
++        for (i = 0; i < sizeof seed; i++) {
++            c = seed & 0xff;
++            hash = ((hash << 5) + hash) ^ c;
++            seed >>= 8;
++        }
++    }
++
++    while ((c = *ustr++))
++        hash = ((hash << 5) + hash) ^ c;
++
++    return hash;
+ }
+diff --git a/lib/strhash.h b/lib/strhash.h
+index 34533fdffa..27339bb288 100644
+--- a/lib/strhash.h
++++ b/lib/strhash.h
+@@ -41,7 +41,11 @@
+  */
+ 
+ #ifndef _STRHASH_H_
++#include <stdint.h>
+ 
+-unsigned strhash(const char *string);
++unsigned strhash_seeded_djb2(uint32_t seed, const char *string);
++
++#define strhash(in)             strhash_seeded_djb2((0),  (in))
++#define strhash_seeded(sd, in)  strhash_seeded_djb2((sd), (in))
+ 
+ #endif /* _STRHASH_H_ */

SOURCES/cyrus-imapd-init.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=One-time configuration for cyrus-imapd
+
+ConditionPathExists=!/etc/pki/cyrus-imapd/cyrus-imapd.pem
+ConditionPathExists=!/etc/pki/cyrus-imapd/cyrus-imapd-key.pem
+ConditionPathExists=!/etc/pki/cyrus-imapd/cyrus-imapd-ca.pem
+
+[Service]
+Type=oneshot
+Group=mail
+RemainAfterExit=no
+ExecStart=/usr/bin/sscg --package cyrus-imapd --cert-file /etc/pki/cyrus-imapd/cyrus-imapd.pem --cert-key-file /etc/pki/cyrus-imapd/cyrus-imapd-key.pem --ca-file /etc/pki/cyrus-imapd/cyrus-imapd-ca.pem --cert-key-mode=0640 

SOURCES/cyrus-imapd-squatter-assert-crash.patch

@@ -0,0 +1,20 @@
+diff --git a/imap/squatter.c b/imap/squatter.c
+index 4419379..d00f003 100644
+--- a/imap/squatter.c
++++ b/imap/squatter.c
+@@ -408,8 +408,13 @@ static void expand_mboxnames(strarray_t *sa, int nmboxnames,
+         else {
+             /* Translate any separators in mailboxname */
+             char *intname = mboxname_from_external(mboxnames[i], &squat_namespace, NULL);
+-            int flags = recursive_flag ? 0 : MBOXTREE_SKIP_CHILDREN;
+-            mboxlist_mboxtree(intname, addmbox, sa, flags);
++            if (!intname || *intname == '\0') {
++                fprintf(stderr, "Mailbox %s: %s\n",
++                        mboxnames[i], error_message(IMAP_MAILBOX_BADNAME));
++            } else {
++                int flags = recursive_flag ? 0 : MBOXTREE_SKIP_CHILDREN;
++                mboxlist_mboxtree(intname, addmbox, sa, flags);
++            }
+             free(intname);
+         }
+ 

SOURCES/cyrus-imapd.cron-daily

@@ -0,0 +1,36 @@
+#!/bin/sh
+#
+# This file is run on a daily basis to perform a backup of your
+# mailbox list which can be used to recreate mailboxes.db from backup.
+# Restore is done using ctl_mboxlist after uncompressing the file.
+
+BACKDIR="/var/lib/imap/backup"
+MBOXLIST="${BACKDIR}/mboxlist"
+ROTATE=6
+
+# fallback to su if runuser not available
+if [ -x /sbin/runuser ]; then
+  RUNUSER=runuser
+else
+  RUNUSER=su
+fi
+
+# source custom configuration
+if [ -f /etc/sysconfig/cyrus-imapd ]; then
+  . /etc/sysconfig/cyrus-imapd
+fi
+
+[ -x /usr/sbin/ctl_mboxlist ] || exit 0
+[ -f /var/lib/imap/db/skipstamp ] || exit 0
+
+# rotate mailbox lists
+seq $[ $ROTATE - 1 ] -1 1 | while read i; do
+  [ -f ${MBOXLIST}.${i}.gz ] && mv -f ${MBOXLIST}.${i}.gz ${MBOXLIST}.$[ $i + 1 ].gz
+done
+[ -f ${MBOXLIST}.gz ] && mv -f ${MBOXLIST}.gz ${MBOXLIST}.1.gz
+
+# export mailboxes.db
+$RUNUSER - cyrus -s /bin/sh -c "umask 077 < /dev/null ; /usr/sbin/ctl_mboxlist -d | gzip > ${MBOXLIST}.gz"
+
+exit 0
+# EOF

SOURCES/cyrus-imapd.logrotate

@@ -0,0 +1,7 @@
+/var/log/imapd.log /var/log/auth.log {
+    missingok
+    sharedscripts
+    postrotate
+        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
+    endscript
+}

SOURCES/cyrus-imapd.magic

@@ -0,0 +1,9 @@
+# Magic
+# Magic data for file(1) command.
+# Format is described in magic(files), where:
+# files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID.
+
+#------------------------------------------------------------------------------
+# skiplist:  file(1) magic Cyrus skiplist DB
+#
+0	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB

SOURCES/cyrus-imapd.pam-config

@@ -0,0 +1,5 @@
+#%PAM-1.0
+auth       required     pam_nologin.so
+auth       include      password-auth
+account    include      password-auth
+session    include      password-auth

SOURCES/cyrus-imapd.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Cyrus-imapd IMAP/POP3 email server
+After=local-fs.target network-online.target
+
+Requires=cyrus-imapd-init.service
+After=cyrus-imapd-init.service
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/sysconfig/cyrus-imapd
+ExecStart=/usr/libexec/cyrus-imapd/master $CYRUSOPTIONS
+ExecReload=/bin/kill -HUP $MAINPID
+PrivateTmp=true
+
+# Cyrus may spawn many processes in normal operation.  These figures are higher
+# than the defaults, but may still need to be tuned for your local
+# configuration.
+TasksMax=2048
+LimitNOFILE=16384
+
+[Install]
+WantedBy=multi-user.target

SOURCES/cyrus-imapd.sysconfig

@@ -0,0 +1,5 @@
+# Options to cyrus-master
+CYRUSOPTIONS=""
+
+# Mailbox list dumps are rotated n times via cron.daily
+#ROTATE=6

SOURCES/cyrus-imapd.sysusers

@@ -0,0 +1,5 @@
+#Type Name     ID             GECOS                 Home directory Shell
+g     saslauth 76
+g     mail     12
+u     cyrus    76:mail        "Cyrus IMAP Server"   /var/lib/imap  /sbin/nologin
+m     cyrus    saslauth

SOURCES/cyrus-imapd.tmpfiles.conf

@@ -0,0 +1,5 @@
+d /run/cyrus        0750 cyrus mail -
+d /run/cyrus/db     0700 cyrus mail -
+d /run/cyrus/lock   0700 cyrus mail -
+d /run/cyrus/proc   0700 cyrus mail -
+d /run/cyrus/socket 0750 cyrus mail -

SOURCES/fix-broken-delivery-to-shared-mailboxes.patch

@@ -0,0 +1,25 @@
+commit a8ccdaf109b85cedfd609678d95f7b7d5fdb91f5
+Author: ellie timoney <ellie@fastmail.com>
+Date:   Mon Jun 7 12:00:27 2021 +1000
+
+    lmtpd: shared mailboxes don't have conversations to lock
+    
+    Fixes #3488
+
+diff --git a/imap/lmtpd.c b/imap/lmtpd.c
+index 498bb8765..dc9ca21bc 100644
+--- a/imap/lmtpd.c
++++ b/imap/lmtpd.c
+@@ -843,8 +843,10 @@ int deliver(message_data_t *msgdata, char *authuser,
+             // lock conversations for the duration of delivery, so nothing else can read
+             // the state of any mailbox while the delivery is half done
+             struct conversations_state *state = NULL;
+-            r = conversations_open_user(mbname_userid(mbname), 0/*shared*/, &state);
+-            if (r) goto setstatus;
++            if (mbname_userid(mbname)) {
++                r = conversations_open_user(mbname_userid(mbname), 0/*shared*/, &state);
++                if (r) goto setstatus;
++            }
+ 
+             /* local mailbox */
+             mydata.cur_rcpt = n;

SOURCES/patch-cassandane-fix-annotator

@@ -0,0 +1,14 @@
+diff --git a/utils/annotator.pl b/utils/annotator.pl
+index 265c73f..8af3d58 100755
+--- a/utils/annotator.pl
++++ b/utils/annotator.pl
+@@ -140,6 +140,8 @@ GetOptions(
+ xlog "annotator $$ starting";
+ Cassandane::AnnotatorDaemon->run(
+         pid_file => $pidfile,
+-        port => $port
++	port => $port,
++	user => (getpwuid($<))[0],
++	group => (getgrgid($())[0],
+     );
+ xlog "annotator $$ exiting";

SOURCES/patch-cassandane-no-syslog

@@ -0,0 +1,41 @@
+diff --git a/Cassandane/Util/Log.pm b/Cassandane/Util/Log.pm
+index 17d2cc7..11b747f 100644
+--- a/Cassandane/Util/Log.pm
++++ b/Cassandane/Util/Log.pm
+@@ -51,9 +51,6 @@ our @EXPORT = qw(
+ 
+ my $verbose = 0;
+ 
+-openlog('cassandane', '', LOG_LOCAL6)
+-    or die "Cannot openlog";
+-
+ sub xlog
+ {
+     my $id;
+@@ -70,7 +67,6 @@ sub xlog
+     $msg .= "($id) " if $id;
+     $msg .= join(' ', @_);
+     print STDERR "$msg\n";
+-    syslog(LOG_ERR, "$msg");
+ }
+ 
+ sub set_verbose
+diff --git a/Cassandane/Instance.pm b/Cassandane/Instance.pm
+index bdfa44f..e852599 100644
+--- a/Cassandane/Instance.pm
++++ b/Cassandane/Instance.pm
+@@ -2030,12 +2030,8 @@ sub setup_syslog_replacement
+ {
+     my ($self) = @_;
+ 
+-    if (not(-e 'utils/syslog.so') || not(-e 'utils/syslog_probe')) {
+-        xlog "utils/syslog.so not found (do you need to run 'make'?)";
+-        xlog "tests will not examine syslog output";
+-        $self->{have_syslog_replacement} = 0;
+-        return;
+-    }
++    $self->{have_syslog_replacement} = 0;
++    return;
+ 
+     $self->{syslog_fname} = "$self->{basedir}/conf/log/syslog";
+     $self->{have_syslog_replacement} = 1;

SOURCES/patch-cyrus-default-configs

@@ -0,0 +1,105 @@
+diff --git a/doc/examples/imapd_conf/normal.conf b/doc/examples/imapd_conf/normal.conf
+index 95b54e9..3935b77 100644
+--- a/doc/examples/imapd_conf/normal.conf
++++ b/doc/examples/imapd_conf/normal.conf
+@@ -10,7 +10,7 @@ admins: cyrus
+ ###################################################################
+ 
+ # Configuration directory
+-configdirectory: /var/lib/cyrus
++configdirectory: /var/lib/imap
+ 
+ # Directories for proc and lock files
+ proc_path: /run/cyrus/proc
+@@ -19,18 +19,18 @@ mboxname_lockpath: /run/cyrus/lock
+ # Locations for DB files
+ # The following DB are recreated upon initialization, so should live in
+ # ephemeral storage for best performance.
+-duplicate_db_path: /run/cyrus/deliver.db
+-ptscache_db_path:  /run/cyrus/ptscache.db
+-statuscache_db_path: /run/cyrus/statuscache.db
+-tls_sessions_db_path: /run/cyrus/tls_sessions.db
++duplicate_db_path: /run/cyrus/db/deliver.db
++ptscache_db_path:  /run/cyrus/db/ptscache.db
++statuscache_db_path: /run/cyrus/db/statuscache.db
++tls_sessions_db_path: /run/cyrus/db/tls_sessions.db
+ 
+ # Which partition to use for default mailboxes
+ defaultpartition: default
+-partition-default: /var/spool/cyrus/mail
++partition-default: /var/spool/imap
+ 
+ # If sieveusehomedir is false (the default), this directory is searched
+ # for Sieve scripts.
+-sievedir: /var/spool/sieve
++sievedir: /var/lib/imap/sieve
+ 
+ ###################################################################
+ ## Important: KEEP THESE IN SYNC WITH cyrus.conf
+@@ -51,19 +51,16 @@ syslog_prefix: cyrus
+ # Space-separated list of HTTP modules that will be enabled in
+ # httpd(8).  This option has no effect on modules that are disabled at
+ # compile time due to missing dependencies (e.g. libical).
+-#
+-# Allowed values: caldav, carddav, domainkey, ischedule, rss
+-httpmodules: caldav carddav
++# Fedora default: enable all modules besides admin and tzdist
++httpmodules: caldav carddav domainkey freebusy ischedule rss webdav
+ 
+ # If enabled, the partitions will also be hashed, in addition to the
+ # hashing done on configuration directories. This is recommended if one
+ # partition has a very bushy mailbox tree.
+ hashimapspool: true
+ 
+-# Enable virtual domains
+-# and set default domain to localhost
+-virtdomains: yes
+-defaultdomain: localhost
++# Disable virtual domains by default
++virtdomains: off
+ 
+ ###################################################################
+ ## User experience settings
+@@ -72,6 +69,14 @@ defaultdomain: localhost
+ # Minimum time between POP mail fetches in minutes
+ popminpoll: 1
+ 
++# Conversation support is required for jmap
++conversations: 1
++conversations_db: twoskip
++
++# This will default to on in 3.1, and improves compatibility with some Apple
++# devices.  Upstream https://github.com/cyrusimap/cyrus-imapd/issues/1556
++specialusealways: 1
++
+ ###################################################################
+ ## User Authentication settings
+ ###################################################################
+@@ -99,6 +104,12 @@ sasl_auto_transition: no
+ ## SSL/TLS Options
+ ###################################################################
+ 
++# These three files will automatically be generated by the systemd unit when
++# the service starts for the first time.
++tls_server_cert: /etc/pki/cyrus-imapd/cyrus-imapd.pem
++tls_server_key: /etc/pki/cyrus-imapd/cyrus-imapd-key.pem
++tls_client_ca_file: /etc/pki/cyrus-imapd/cyrus-imapd-ca.pem
++
+ # File containing the global certificate used for ALL services (imap,
+ # pop3, lmtp, sieve)
+ #tls_server_cert: /etc/ssl/certs/ssl-cert-snakeoil.pem
+diff --git a/doc/examples/cyrus_conf/prefork.conf b/doc/examples/cyrus_conf/prefork.conf
+index 186fe66..ab97848 100644
+--- a/doc/examples/cyrus_conf/prefork.conf
++++ b/doc/examples/cyrus_conf/prefork.conf
+@@ -19,8 +19,8 @@ SERVICES {
+ #  nntps         cmd="nntpd -s" listen="nntps" prefork=1
+ 
+   # these are only necessary if using HTTP for CalDAV, CardDAV, or RSS
+-#  http          cmd="httpd" listen="http" prefork=3
+-#  https         cmd="httpd -s" listen="https" prefork=1
++  http          cmd="httpd" listen="http" prefork=3
++  https         cmd="httpd -s" listen="https" prefork=1
+ 
+   # at least one LMTP is required for delivery
+ #  lmtp          cmd="lmtpd" listen="lmtp" prefork=0

SOURCES/patch-cyrus-perl-linking

@@ -0,0 +1,26 @@
+diff --git a/perl/sieve/managesieve/Makefile.PL.in b/perl/sieve/managesieve/Makefile.PL.in
+index 7180b98..d589ebe 100644
+--- a/perl/sieve/managesieve/Makefile.PL.in
++++ b/perl/sieve/managesieve/Makefile.PL.in
+@@ -69,7 +69,7 @@ WriteMakefile(
+     'ABSTRACT'  => 'Cyrus Sieve management interface',
+     'VERSION_FROM' => "@top_srcdir@/perl/sieve/managesieve/managesieve.pm", # finds $VERSION
+     'MYEXTLIB'  => '../lib/.libs/libisieve.a @top_builddir@/perl/.libs/libcyrus.a @top_builddir@/perl/.libs/libcyrus_min.a',
+-    'LIBS'	=> ["$LIB_SASL @SSL_LIBS@ @LIB_UUID@ @LIB_REGEX@ @ZLIB@ @SQLITE_LIBADD@ @MYSQL_LIBADD@ @PGSQL_LIBADD@"],
++    'LIBS'	=> ["$LIB_SASL @SSL_LIBS@ @LIB_UUID@ @LIB_REGEX@ @ZLIB@ @SQLITE_LIBADD@ @MYSQL_LIBADD@ @PGSQL_LIBADD@ -lpcreposix"],
+     'CCFLAGS'	=> '@GCOV_CFLAGS@',
+     'DEFINE'	=> '-DPERL_POLLUTE',     # e.g., '-DHAVE_SOMETHING' 
+     'INC'	=> "-I@top_srcdir@/lib -I@top_srcdir@/perl/sieve -I@top_srcdir@/perl/sieve/lib @SASLFLAGS@ @SSL_CPPFLAGS@",
+diff --git a/perl/imap/Makefile.PL.in b/perl/imap/Makefile.PL.in
+index 71416cc..f76cda6 100644
+--- a/perl/imap/Makefile.PL.in
++++ b/perl/imap/Makefile.PL.in
+@@ -91,7 +91,7 @@ WriteMakefile(
+     'LD'       => $Config{ld} . ' @GCOV_LDFLAGS@',
+     'OBJECT'    => 'IMAP.o',
+     'MYEXTLIB'  => '@top_builddir@/perl/.libs/libcyrus.a @top_builddir@/perl/.libs/libcyrus_min.a',
+-    'LIBS'	=> [ "$LIB_SASL @SSL_LIBS@ @LIB_UUID@ @ZLIB@ @GCOV_LIBS@ @LIBCAP_LIBS@"],
++    'LIBS'	=> [ "$LIB_SASL @SSL_LIBS@ @LIB_UUID@ @ZLIB@ @GCOV_LIBS@ @LIBCAP_LIBS@ -lpcreposix"],
+     'DEFINE'	=> '-DPERL_POLLUTE',    # e.g., '-DHAVE_SOMETHING'
+     'INC'	=> "-I@top_srcdir@ -I@top_srcdir@/com_err/et @SASLFLAGS@ @SSL_CPPFLAGS@ @GCOV_CFLAGS@ -I@top_srcdir@/perl/imap",
+     'EXE_FILES' => [cyradm],

SOURCES/patch-cyrus-rename-quota

@@ -0,0 +1,13 @@
+diff --git a/imap/imapd.c b/imap/imapd.c
+index 3cc75f5..a22a356 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -8022,7 +8022,7 @@ static void cmd_reconstruct(const char *tag, const char *name, int recursive)
+             fclose(stdout);
+             fclose(stderr);
+ 
+-            ret = snprintf(buf, sizeof(buf), "%s/quota", SBIN_DIR);
++            ret = snprintf(buf, sizeof(buf), "%s/cyr_quota", SBIN_DIR);
+             if(ret < 0 || ret >= (int) sizeof(buf)) {
+                 /* in child, so fatailing won't disconnect our user */
+                 fatal("quota buffer not sufficiently big", EX_CONFIG);

SOURCES/patch-cyrus-testsuite-timeout

@@ -0,0 +1,13 @@
+diff --git a/cunit/unit.c b/cunit/unit.c
+index 46dc358..ca37f22 100644
+--- a/cunit/unit.c
++++ b/cunit/unit.c
+@@ -97,7 +97,7 @@ EXPORTED void fatal(const char *s, int code)
+ }
+ 
+ /* Each test gets a maximum of 20 seconds. */
+-#define TEST_TIMEOUT_MS (20*1000)
++#define TEST_TIMEOUT_MS (30*1000)
+ 
+ static jmp_buf jbuf;
+ static const char *code;