On Mon, Oct 19, 2026 at 12:49:52AM +0200, H.-Dirk Schmitt wrote:
> That is the reason 2.4.5 was picked up.
> I can't identify the fix on github – sorry.
>
> > Trixie contains 2.4.1 (with a bunch of backported bugfixes, not 2.4.4).
>
> Sorry this was a typo in in the 3rd number.
>
> > Unfortunately dovecot minor versions contain incompatible changes, so we
> > cannot simply upgrade between them with trixie point releases. We will
> > need to identify the specific commit so we can introduce a targeted fix
> > into trixie's version.
>
> Maybe it can be added to backports?
> The forky version compiles as backport without any changes.
Backports isn't really the place for this, for multiple reasons. It
should be fixed in the main archive.
Unfortunately, I haven't been able to find a suitable looking change
from the 2.4.4..2.4.5 range upstream. I have also been unable to come
up with a way to reproduce the failure.
>From your description, as well as the mailing list discussion, it seems
like issue is that when a dovecot program is run as a user that does not
have permission to access some file referenced in the configuration,
typically a TLS key. So, to try to reproduce this failure, I've set up
the following and tested it with the dovecot 1:2.4.1+dfsg1-6 packages
from the original trixie release. I have not encountered any errors,
though, so something must be missing. Can you tell from here what's
missing? If you can provide a minimal repro configuration, that would
be helpful.
Certificates are locked down:
# ls -l /etc/dovecot/private/tls/
total 8
-r-------- 1 1000 1000 1529 May 8 2025 example.net.crt
-r-------- 1 1000 1000 1704 May 8 2025 example.net.key
And what I think are the relevant parts of `doveconf -n`:
dovecot_config_version = 2.4.0
dovecot_storage_version = 2.4.0
mail_gid = vmail
mail_uid = vmail
mail_home = /home/vmail/users/%{user | username}/mail
mail_path = /home/vmail/users/%{user | username}/mail
mail_privileged_group = mail
ssl_server {
cert_file = /etc/dovecot/private/tls/example.net.crt
key_file = /etc/dovecot/private/tls/example.net.key
}
protocol lda {
mail_plugins {
sieve = yes
}
sieve_script personal {
driver = file
path = /home/vmail/users/%{user | username}/mail.sieve
}
}
protocol lmtp {
auth_username_format = %{user | username | lower}
mail_plugins {
sieve = yes
}
sieve_script personal {
path = /home/vmail/users/%{user | username}/mail.sieve
}
}
I've then created a virtual user with a sieve script that does some
simple filtering:
root@94faf4d30408:/home/vmail/users/testuser# cat mail.sieve
require ["fileinto", "envelope"];
if header :is "X-Sieve-Test" "yes" {
fileinto "incoming/filtered";
} else {
keep;
}
And sent mail to that user using /usr/lib/dovecot/deliver:
root@94faf4d30408:/home/vmail/users/testuser# cat | runuser -u vmail -g vmail
-- /usr/lib/dovecot/deliver -e -f mailer-daemon -a testuser -d testuser
From: mailer-daemon
To: noahm <noahm@localhost>
Subject: test message
X-Sieve-Test: yes
Message-ID: <[email protected]>
testing delivery
lda(testuser)<113><6YMTBeF31mpxAAAA1oRN5w>: Info: sieve:
msgid=<[email protected]>: fileinto action:
stored mail into mailbox 'incoming/filtered'
