108 lines
5.2 KiB
Markdown
108 lines
5.2 KiB
Markdown
# RustBox 0.0.4 — remaining roadmap gaps
|
|
|
|
Snapshot after the OpenPGP/key-lifecycle and unbounded Sieve action/condition work in this iteration.
|
|
|
|
## OpenPGP status
|
|
|
|
OpenPGP is functionally complete for the scope defined in `RUSTBOX_PLAN.md` §9:
|
|
|
|
- generate/import/export/delete public and private keys;
|
|
- per-user protected keyring and identity assignment;
|
|
- passphrase validation and passphrase change (GnuPG is used only for secret-packet re-wrapping; passphrases are sent via stdin/status-fd, never argv or database);
|
|
- sign, encrypt, sign+encrypt, PGP/MIME and inline OpenPGP;
|
|
- verify/decrypt with signer fingerprint, trust and invalid-signature warning;
|
|
- recipient-key checks, public-key attachment, WKD and optional HTTPS HKP discovery;
|
|
- private-key filesystem isolation and export policy.
|
|
|
|
`RUSTBOX_PGP_GPG_BINARY` may override the `gpg` executable used by the passphrase-change operation. Other cryptographic operations use rPGP directly.
|
|
|
|
## Remaining functional items — 45
|
|
|
|
### Advanced IMAP / shared folders / ACL — 11
|
|
|
|
- [ ] Namespace/shared/global folder browser driven by NAMESPACE.
|
|
- [ ] GETACL read path.
|
|
- [ ] SETACL rights editor.
|
|
- [ ] DELETEACL entry removal.
|
|
- [ ] Inherited/default rights presentation where the server exposes it.
|
|
- [ ] Clear own/shared/global folder distinction in the folder tree.
|
|
- [ ] Full production QRESYNC resynchronization path.
|
|
- [ ] Server-side SORT when advertised.
|
|
- [ ] Server-side THREAD when advertised.
|
|
- [ ] LIST-EXTENDED production behavior when advertised.
|
|
- [ ] Complete UTF8/UTF8=ACCEPT behavior across mailbox/message edge cases.
|
|
|
|
### Contacts / calendars — 12
|
|
|
|
- [ ] CardDAV discovery.
|
|
- [ ] Multiple CardDAV address books.
|
|
- [ ] CardDAV sync-token + ETag synchronization.
|
|
- [ ] CardDAV conflict/retry/delete synchronization.
|
|
- [ ] LDAP address-book adapter (RO/RW policy-driven).
|
|
- [ ] CalDAV discovery.
|
|
- [ ] Multiple and shared CalDAV calendars.
|
|
- [ ] CalDAV sync-token + ETag synchronization.
|
|
- [ ] Recurrence expansion, exceptions and edit semantics.
|
|
- [ ] Full timezone correctness behavior.
|
|
- [ ] iTIP invitation parsing/delivery workflow.
|
|
- [ ] Accept / Decline / Tentative invitation responses.
|
|
|
|
### Core mail / composer / Sieve — 7
|
|
|
|
- [ ] Full SMTP DSN negotiation.
|
|
- [ ] TNEF / `winmail.dat` decoding.
|
|
- [ ] Complete identity/signature default policy for every new/reply/forward edge case.
|
|
- [ ] Persistent multi-step Undo history beyond the current safe single MOVE undo.
|
|
- [ ] Arbitrarily branching visual Sieve groups, e.g. `(A AND (B OR C))`; the builder now supports an unlimited left-nested AND/OR chain.
|
|
- [ ] Full capability-aware Sieve condition/action matrix for all advertised extensions.
|
|
- [ ] Visual editing of existing non-RustBox/raw Sieve rules without falling back to raw text.
|
|
|
|
### Spam / password / account integration — 11
|
|
|
|
- [ ] rspamd HTTP spam adapter.
|
|
- [ ] SpamAssassin adapter.
|
|
- [ ] Custom spam-command adapter.
|
|
- [ ] Password-change API adapter.
|
|
- [ ] Password-change LDAP adapter.
|
|
- [ ] Password-change SQL adapter.
|
|
- [ ] Password-change PAM/command adapter.
|
|
- [ ] Persistent session inventory/device metadata across process restarts.
|
|
- [ ] Administrator-facing autologout/remember-me policy controls.
|
|
- [ ] New-user/onboarding identity workflow.
|
|
- [ ] Optional login → mailbox/address mapping (virtuser equivalent).
|
|
|
|
### Search / notifications / diagnostics — 4
|
|
|
|
- [ ] Complete attachment content/metadata indexing policy and limits.
|
|
- [ ] Background/service-worker notifications while the page is inactive, if retained for 0.0.4.
|
|
- [ ] Richer per-account notification policy beyond global/per-folder controls.
|
|
- [ ] Background task/queue status plus recent-error/repair workflows.
|
|
|
|
## UI / i18n work still required (not counted as separate functional features)
|
|
|
|
- Final Settings information architecture: General, Message view, separate Signatures, Autoresponder, Contacts, Calendar, Encryption, Privacy, Security and Sessions.
|
|
- Complete keyboard-only/focus-order/accessibility audit.
|
|
- Remaining hard-coded EN/PL strings moved to locale files.
|
|
- Missing-key detection/fallback audit.
|
|
- Locale-aware date/time/number formatting audit.
|
|
- Documentation/structure for additional languages.
|
|
|
|
## Release/security/acceptance work (not counted in the 45 functional items)
|
|
|
|
- complete HTML/CSS/SVG sanitizer regression matrix;
|
|
- tracking-pixel/data-URI/CID matrix;
|
|
- malformed/nested MIME and huge-message tests;
|
|
- CRLF/header injection, CSRF, XSS and cross-account authorization matrix;
|
|
- session fixation/hijacking and secure-cookie verification;
|
|
- archive/ZIP-bomb and dangerous-filename tests;
|
|
- temporary-storage cleanup verification;
|
|
- OpenPGP key-isolation/passphrase/PGP-MIME regression matrix;
|
|
- `cargo fmt --check`, `cargo clippy --all-targets`, `cargo test`, release build;
|
|
- Dovecot/Postfix/ManageSieve real-server matrix;
|
|
- SMTPUTF8/IDN real-server compatibility;
|
|
- large mailbox/large attachment/performance tests;
|
|
- long-running IDLE/reconnect storm/UIDVALIDITY/index-consistency tests;
|
|
- memory stability and restart/resume tests.
|
|
|
|
OpenPGP is no longer a functional blocker. The largest remaining feature blockers are shared folders/ACL, CardDAV/CalDAV+iTIP and integration adapters. The release remains blocked by the real Rust/server/security/performance gate until those tests are executed successfully.
|