Commit 0eac4e8

name: Publish to PyPI

on:

workflow_dispatch:

push:

tags:

- 'v*'

permissions:

contents: read

jobs:

build:

name: Build distribution

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@v4

- name: Set up Python

uses: actions/setup-python@v5

with:

python-version: '3.x'

- name: Install build dependencies

run: |

- name: Build package

run: python -m build

- name: Upload distribution artifacts

uses: actions/upload-artifact@v4

with:

name: dist

path: dist/

publish:

name: Publish to PyPI

needs: build

runs-on: ubuntu-latest

environment:

name: pypi

url: https://pypi.org/p/offlineimap

permissions:

id-token: write # Required for Trusted Publishers (OIDC)

steps:

- name: Download distribution artifacts

uses: actions/download-artifact@v4

with:

name: dist

path: dist/

- name: Publish package to PyPI

uses: pypa/gh-action-pypi-publish@release/v1

language: python

python:

- '2.7'

- '3.6'

- '3.7'

- '3.8'

- '3.9'

- '3.10'

- '3.11'

- '3.12'

- '3.13'

dist: jammy

notifications:

webhooks:

urls:

include:

- os: osx

language: generic

env: PYTHON=2.7.14 OUTLOOK_AUTH=PLAIN GMAIL_AUTH=XOAUTH2

env: PYTHON=3.12.0 OUTLOOK_AUTH=PLAIN GMAIL_AUTH=XOAUTH2

- os: osx

language: generic

env: PYTHON=2.7.14 OUTLOOK_AUTH=LOGIN GMAIL_AUTH=XOAUTH2

env: PYTHON=3.12.0 OUTLOOK_AUTH=LOGIN GMAIL_AUTH=XOAUTH2

allow_failures:

- os: osx

cache: pip

1. We mostly care about making our softwares better.

1. We mostly care about making our software better.

2. Everybody is free to decide how to contribute.

* The following excerpt is only usefull when rendered in the website.

{:toc}

**Notes**

Rodolfo García Peñas (kix): To my father, with love. Rest in peace, Dad.

This release focuses on security hardening, deadlock prevention, and robustness improvements. A TLS-stripping attack vector when using STARTTLS has been closed, a deadlock in connection teardown has been fixed, and several crash and encoding edge cases have been resolved.

- **Fix TLS-stripping attack on STARTTLS**: When `starttls = yes`, a MITM attacker could remove the `STARTTLS` capability from the server greeting, causing offlineimap to silently skip TLS negotiation and send credentials in plaintext. The connection now aborts if STARTTLS is expected but not offered. (Fixes #222)

- **Fallback for non-standard STARTTLS capability handling**: Some servers do not re-advertise capabilities after the TLS handshake in the expected way. A configurable `allow_nonstandard_capabilities` option has been added to tolerate this without compromising security. (Fixes #242)

- **Prevent deadlock in `IMAPServer.close()`**: Calling `close()` while `maxsyncaccounts` or `maxconnections` > 1 could deadlock. The semaphore reset now happens outside the `connectionlock`. (Fixes #241)

- **Retry connection on dead socket during authentication**: When an auth method fails due to a dead socket, the connection is re-established and the remaining auth methods are retried instead of failing immediately.

- **Fix `UnicodeEncodeError` on emails with malformed bytes**: Message bodies with bytes that cannot be encoded in the local charset are now handled gracefully. (Fixes #239)

- **Use correct IMAP folder name in `imapobj.select`**: The encoded mailbox name is now passed correctly, fixing sync failures with non-ASCII folder names.

- **Reevaluate `oauth2_access_token_eval` on every connection**: The OAuth2 access token getter is now called on each `acquireconnection()` call, ensuring expired tokens are refreshed. (Fixes #244)

- **Fix `Blinkenlights` UI crash**: The `isusable()` method had a wrong signature (`cls` instead of `self`) that caused an `AttributeError` at startup. The ncurses availability check has also been simplified.

- **Handle exceptions from the IMAP `ID` command**: Servers that do not support the `ID` extension or return an error no longer crash the sync.

- **Handle errors reading `remotepassfile` gracefully**: A missing or unreadable password file now produces a clear error instead of a traceback.

- **Make folder name encoding conditional on `utf8foldernames`**: IMAP folder name encoding via `encode_mailbox_name` is now only applied when `utf8foldernames = yes`, preventing double-encoding for servers that do not require it.

- **Replace deprecated `platform.linux_distribution`** with the `distro` library in OS SSL certificate path detection.

- **GitHub Actions workflow for PyPI publishing**: Automated release publishing to PyPI on tagged commits.

- Rodolfo García Peñas (kix) (30)

- Noa Torstensvik (1)

- Michael Hohmuth (1)

- Derek Schrock (1)

- Andreas Schacker (1)

**Notes**

- Fedora `dnf install offlineimap`

- FreeBSD `pkg search offlineimap3`, and install the python versioned package, `pkg install py311-offlineimap3`

- Arch Linux: [`pacman -S offlineimap`](https://archlinux.org/packages/extra/any/offlineimap/), or through AUR package [offlineimap3-git](https://aur.archlinux.org/packages/offlineimap3-git/)

- Docker image: `offlineimap/offlineimap:latest`

- Docker image: `offlineimap/offlineimap:latest`

(note: image not published yet, just an example)

* Python v3+

* Python v3.6+

* rfc6555 (required)

* imaplib2 >= 3.5

* keyring

* imaplib2 >= 3.5 (required)

* keyring (optional), for storing passwords in a secure way

* gssapi (optional), for Kerberos authentication

* pysocks (optional), for proxy support

* portalocker (optional), if you need to run offlineimap in Cygwin for Windows

* certify (optional), for Internet SSL certificate validation

* urllib3 (optional), for Internet SSL certificate validation

except:

print(("""

cat <<EOF

if test ! $? -eq 0

then

echo "Oops! you don't have $SPHINXBUILD installed?"

echo "Cannot update the webite documentation..."

echo "Cannot update the website documentation..."

echo "You should install it and run:"

echo " $ cd docs"

echo " $ make websitedoc"

remoterepository = account2-remote

status_backend = sqlite

# thi sis a gmail account

# this is a gmail account

[Repository account1-local]

type = Maildir

# create with maildirmake or by hand by creating cur, new, tmp

account has two sides. One of the side must be an IMAP server. The other side

can either be a Maildir or another IMAP server.

Works with Python 2.

Works with Python 3.

OPTIONS

*DO NOT RELY ON STARTTLS AS A SAFE CONNECTION GUARANTEEING THE AUTHENTICITY OF

YOUR IMAP SERVER!*

* allow_nonstandard_capabilities

+

Some non-standard IMAP servers do not send a CAPABILITY response after

completing the STARTTLS handshake, as required by RFC 2595. By default,

OfflineIMAP aborts with an error in this situation to avoid silently

proceeding over a potentially broken encrypted channel.

+

Setting `allow_nonstandard_capabilities = yes` in the repository section

enables a best-effort fallback: OfflineIMAP reuses the capabilities advertised

before STARTTLS, removing `LOGINDISABLED`, so that authentication can continue

over the (assumed) encrypted connection.

+

*WARNING: only enable this option when you have verified that TLS is actually

established correctly.* If the server is not performing STARTTLS properly,

enabling this option could cause credentials to be transmitted in plain text.

+

Default: `no`.

Unix Signals

------------

echo "Usage: website-doc.sh <releases|api|contrib|usage>"

;;

*)

echo "unkown option $arg"

echo "unknown option $arg"

exit_code=$(( $exit_code + 1 ))

;;

esac