Looks good to me.

You need to supply Guam with a valid X.509 certificate (issued by Let's Encrypt, for example) and adapt the tls_config section of /etc/guam/sys.config accordingly.

Guam should be listening on port 993, so please check if the Guam service is up and running.

Worked fine, I could't reproduce the issue. Closing this.

Closing this task then.

Looks good to me.

If you feel courageous enough, I would say it's ready for field testing. Should you encounter any remaining rough edges, please report them so they can be ironed out.

Ouch, good catch!

I believe this was already fixed back in June with https://obs.kolabsys.com/package/rdiff/Kolab:Winterfell/kolab?linkrev=base&rev=37.

Done. Thanks for reporting this!

I'm working on providing Debian 10 packages for Kolab 16.

Oh dear. Thanks for pinpointing the problem!
I've pushed out an urgent hotfix; updated packages should be available in a few minutes.

If only things were that easy. :-/

Good spot, that may very well be the reason. 👍

I can confirm this issue. See here for a workaround: https://git.kolab.org/T4049#60227

Unfortunately I don't have the permissions to delete or edit that page, even with my admin account. Assigning to @vanmeeuwen.

Sorry, I cannot easily downgrade to 1.3.8 to try stuff out on my system.
May I ask which distro you are on and which version of Kolab you're using?

Weird - I cannot seem to reproduce this issue on my Debian Stretch box with up-to-date Kolab 16 packages (roundcubemail 1.4-0~kolab53, roundcubemail-plugins-kolab 3.4-0~kolab57) and the Elastic skin.

A fix has been pushed by @pokorra: https://obs.kolabsys.com/request/show/2366

Duplicate caused by Phabricator dying.

Duplicate caused by Phabricator dying.

Duplicate caused by Phabricator dying.

This change has already found its way into the repository.

\o/

One last item to fix: the link behind the download button.

Confirmed.

The channel mode has been set to +C +r +s, which should put an end to the spamming.

Bumping priority. Sorry, but this is ridiculous and needs to be resolved NOW, along with T4067 and T4262.

Bumping priority. This is ridiculous - there are currently approximately 300-400 automated registrations, obviously from bots, every week.

Just FYI, this is still going on.

Raising priority. Come on, please fix this - it's ridiculous!

This is now a work in progress. The repository is there (in Winterfell), but not all packages build correctly so far.

And here come the spammers: https://obs.kolabsys.com/project/show/home:{hairweavingbangalore,elegantitservices} (link not clickable)

As far as I can tell, the main problem now appears to be resolved. However, the key distributed at https://ssl.kolabsys.com/community.asc is still the old one.

The current signing-key mixup is not intended - it's an artefact from the upgrade of the OBS software that was performed recently. Unfortunately, the upgrade didn't go as smoothly as hoped for. Most of the resulting fallout has already been cleared without anybody even noticing, but the key issue still remains open at the moment.

Fixed. Thanks for the report.

On RPM-based distributions, this can be worked around by using the --nogpgcheck flag.
On Debian and derivatives, the signature check can be disabled by marking the repository as [trusted=yes] and removing /var/lib/apt/lists/obs.kolabsys.com_repositories_*.

Duplicate of T4049.

As suggested by Jeroen on IRC, I have created a separate account @sicherha-admin. Please give that account permission to battle the bad guys. ;-)

See above for a patch that implements option 2.