OSMAP is a security-focused, server-rendered webmail platform for hardened OpenBSD mail systems. It provides browser access to an existing mail stack without replacing Postfix, Dovecot, Rspamd, nginx, PF, TLS, or native mail clients.
The project favors a small trust boundary, least privilege, bounded behavior, safe mail rendering, auditable operations, and reversible deployment over feature breadth or Roundcube parity.
V13 is the current reviewed production and assurance closeout. It supersedes earlier post-V9 status summaries as the description of the present project state.
| Current record | V13 evidence |
|---|---|
| Status | WSTG assurance integrity, adversarial validation, and production deployment closeout completed |
| Final reviewed commit | 7009b15322c4e7795c797c1387b403e0f4935adb |
| Live and staged binary SHA256 | 333a417bf435ae74bfc2b7a9eebedeca1ad541cb527e2555fed408e11e24d963 |
| Credentialed release run | osmap-wstg-20260627-204207 against https://mail.blackbagsecurity.com |
| Credentialed result | 42 pass, 0 fail, 0 warning, 0 skip, and 4 justified not-applicable results |
| WSTG matrix | 97 scenarios: 64 automated and 33 not applicable, with no invalid or missing dispositions |
| Browser edge | GET /, GET /login, and GET /healthz passed; invalid Host was rejected with HTTP 421 |
V13 also records passing live checks for CSP, Host and request desynchronization, reflected and stored XSS, cross-account authorization isolation, attachment containment, Rspamd and ClamAV detection, dependency and CycloneDX validation, and security-event logging with redaction.
The current project status summary is maintained in
docs/CURRENT_PROJECT_STATUS.md. Historical version documents remain valid as
provenance for the slices that produced them, but the current README,
docs/CURRENT_PROJECT_STATUS.md, docs/README.md, and the latest version
closeout records control the present release posture.
V12 remains a non-cryptographic OpenPGP foundation. It provides requirements, diagnostics, account fingerprint binding, helper protocol and client scaffolding, GPGME readiness gates, and capability policy models. It does not enable decrypt, verify, sign, encrypt, PGP/MIME parsing, passphrase handling, private-key access, browser OpenPGP controls, key discovery, or decrypted rendering.
The current release evidence is still bounded. V4 remains the historical tagged hostile-content safety release, and V9 remains historical selected-cohort release-candidate provenance. The current V13 record does not claim complete Roundcube replacement, general hostile-email safety, unbounded MIME or mailbox safety, full ASVS verification, endpoint safety after attachment download, or OpenPGP runtime cryptographic operation.
Start with:
- Documentation index
- Project charter
- Program baseline
- Current project status
- Known limitations
- Decision log
- Internet exposure status
OSMAP is intended for self-hosted OpenBSD environments that need public webmail access with a narrow and reviewable browser surface.
Core goals:
- strong password plus TOTP authentication
- bounded sessions with expiry and revocation
- CSRF and same-origin enforcement
- least-privilege mailbox access through a helper boundary
- safe MIME analysis, HTML sanitization, and forced attachment downloads
- bounded parsing, worker budgets, and throttling
- public HTTPS through nginx while application services remain private
- reproducible validation, evidence, rollback, and release governance
The project does not currently target calendars, groupware, plugins, SaaS, multi-tenant hosting, broad JavaScript application behavior, attachment preview, or replacement of the underlying mail stack.
Detailed scope:
Debian-family collaborators, including Parrot OS users, should begin with the development environment bootstrap:
bash maint/development/bootstrap-debian.sh
make verify-debianBuild and validation entry points:
cargo build
cargo test
make security-checkImportant gates:
make v6-check
make v7-check
make v8-check
make v10-check
make v11-check
make v12-check
make v13-check
make acceptance-check
OSMAP_SECURITY_PROFILE=release make release-checkmake security-check is the developer and CI gate. The strict release gate
requires current live, authenticated, supply-chain, WSTG, TLS, resource, and
sanitized evidence. See:
- Contributing
- Test strategy
- Secure SDLC
- Build and release process
- Supply-chain policy
- Toolchain baseline
| Element | Primary documents |
|---|---|
| Existing host and mail stack | Current architecture, mail stack analysis, network analysis |
| Application architecture | Architecture, configuration and state, mailbox helper model |
| Identity and authentication | Identity and authentication, TOTP secret model, auth socket model |
| Browser and HTTP security | HTTP hardening, browser slice, TLS standard |
| MIME, rendering, and attachments | Rendering policy, MIME policy, attachment download |
| Runtime and capacity | OpenBSD confinement, worker budgets, logging model |
| Deployment and operations | OpenBSD deployment, hardening guide, observability, incident response |
| Public exposure | Exposure checklist, exposure SOP, current exposure status |
| Migration and retirement | Roundcube migration, pilot deployment, pilot workflows |
| Security assurance | ASVS baseline, CWE and WSTG review, WSTG due diligence |
The implementation is documented as small security and workflow slices:
| Slice | Document |
|---|---|
| Authentication | Authentication slice baseline |
| Session lifecycle | Session management model |
| Browser routing | HTTP browser slice |
| Mailbox listing | Mailbox listing slice |
| Message listing | Message list slice |
| Message viewing | Message view slice |
| Rendering | Rendering policy |
| Attachments | Attachment download slice |
| Compose and send | Compose and send slice |
| Folder organization | Folder organization slice |
| User settings | Settings surface slice |
Versions are listed newest first. Historical entries remain evidence provenance, not competing descriptions of the current V13 state.
| Version | Purpose and status | Authoritative documents |
|---|---|---|
| V13 | WSTG assurance integrity, adversarial validation, and production deployment closeout | V13 sprint and closeout, current project status |
| V12 | Non-cryptographic OpenPGP secure foundation through Slice 14 closeout readiness | OpenPGP requirements and claims, closeout readiness audit, known limitations |
| V11 | Runtime fail-closed closure for refined high-relevance assumptions | Runtime fail-closed closure |
| V10 | Governance, acceptance, and fail-closed assumption triage | Governance status, claims and limitations, targeted remediation |
| V9 | Historical production convergence and selected-cohort release-candidate decision | Production convergence, release-candidate closeout |
| V8 | Source stabilization through mandatory regression matrices | Program, final closeout |
| V7 | Boundary hardening, rendering recovery, and availability invariants | Due diligence, rendering closeout, production availability closeout |
| V6 | Controlled Roundcube retirement readiness | Definition, acceptance criteria, closeout evidence |
| V5 | Identity, Host, origin, response, and trusted HTML boundaries | Boundary evidence, production deployment |
| V4 | Hostile-content safety release | Definition, security gates, closeout evidence |
| V3 | Daily-driver hardening and WSTG due diligence | Definition, security gates, WSTG plan |
| V2 | Migration-capable pilot and operator readiness | Definition, pilot closeout |
| V1 | Narrow browser-mail baseline and closeout | Acceptance criteria, closeout SOP |
V3 divides WSTG and daily-driver assurance into focused records covering:
- authentication applicability
- identity lifecycle
- authorization and account isolation
- session lifecycle
- webmail input validation
- HTTP input tampering
- Host and request smuggling
- cryptography and transport
- form routes and state transitions
- client-side browser security
- error and information disclosure
- configuration and deployment
V6 records each controlled-retirement slice separately:
| Slice | Trace |
|---|---|
| 00 | Baseline |
| 01 | Scope |
| 02 | Gates |
| 03 | Production readiness |
| 04 | Retirement rehearsal |
| 05 | Observability |
| 06 | Session locking |
| 07 | Source attachment drafts |
| 08 | Resource resilience |
| 09 | Closeout |
V8 protects existing behavior without adding product features:
- Mail workflow matrix
- Attachment safety matrix
- Mailbox operation matrix
- Session integrity matrix
- Resource robustness matrix
All V8 gates run through make v8-check, which is enforced by
make security-check and the repository CI workflow.
Production changes should follow the reviewed, reversible OpenBSD procedures:
- Binary deployment SOP
- Runtime group provisioning
- Service artifacts
- Service activation
- Service enablement
- Edge cutover plan
- Edge cutover rehearsal
Report security issues through SECURITY.md. General support guidance is in SUPPORT.md.
Contributions must preserve the narrow trust boundary and include appropriate tests, documentation, and evidence. See CONTRIBUTING.md and CODE_OF_CONDUCT.md.
OSMAP is licensed under the ISC License. It is provided without warranty. Operators remain responsible for deployment, configuration, monitoring, backup, recovery, legal compliance, and risk acceptance.