Oh dear. Thanks for pinpointing the problem!
I've pushed out an urgent hotfix; updated packages should be available in a few minutes.

If only things were that easy. :-/

Good spot, that may very well be the reason. 👍

I can confirm this issue. See here for a workaround: https://git.kolab.org/T4049#60227

Unfortunately I don't have the permissions to delete or edit that page, even with my admin account. Assigning to @vanmeeuwen.

Sorry, I cannot easily downgrade to 1.3.8 to try stuff out on my system.
May I ask which distro you are on and which version of Kolab you're using?

Weird - I cannot seem to reproduce this issue on my Debian Stretch box with up-to-date Kolab 16 packages (roundcubemail 1.4-0~kolab53, roundcubemail-plugins-kolab 3.4-0~kolab57) and the Elastic skin.

A fix has been pushed by @pokorra: https://obs.kolabsys.com/request/show/2366

Duplicate caused by Phabricator dying.

Duplicate caused by Phabricator dying.

Duplicate caused by Phabricator dying.

This change has already found its way into the repository.

\o/

One last item to fix: the link behind the download button.

Confirmed.

The channel mode has been set to +C +r +s, which should put an end to the spamming.

Bumping priority. Sorry, but this is ridiculous and needs to be resolved NOW, along with T4067 and T4262.

Bumping priority. This is ridiculous - there are currently approximately 300-400 automated registrations, obviously from bots, every week.

Just FYI, this is still going on.

Raising priority. Come on, please fix this - it's ridiculous!

This is now a work in progress. The repository is there (in Winterfell), but not all packages build correctly so far.

And here come the spammers: https://obs.kolabsys.com/project/show/home:{hairweavingbangalore,elegantitservices} (link not clickable)

As far as I can tell, the main problem now appears to be resolved. However, the key distributed at https://ssl.kolabsys.com/community.asc is still the old one.

The current signing-key mixup is not intended - it's an artefact from the upgrade of the OBS software that was performed recently. Unfortunately, the upgrade didn't go as smoothly as hoped for. Most of the resulting fallout has already been cleared without anybody even noticing, but the key issue still remains open at the moment.

Fixed. Thanks for the report.

On RPM-based distributions, this can be worked around by using the --nogpgcheck flag.
On Debian and derivatives, the signature check can be disabled by marking the repository as [trusted=yes] and removing /var/lib/apt/lists/obs.kolabsys.com_repositories_*.

Duplicate of T4049.

As suggested by Jeroen on IRC, I have created a separate account @sicherha-admin. Please give that account permission to battle the bad guys. ;-)

See above for a patch that implements option 2.

The above patch was the simple part; now we need a script that gets called when the package is upgraded and drops the respective tables. I assume it's okay to drop the tables whenever the PyKolab package gets an update - please veto if you disagree.

Okay, so we have to modify the database schema. In https://kolab.org/hub/topic/260/google-mails-rejected/4 it is suggested that the statistic table should also be altered, which looks plausible to me.

Raising priority because this bug causes data loss: emails are getting rejected.

... aaand the next wave has hit.