Version 3.2.5
17 September 2004

  -SECURITY: previous versions of getmail were vulnerable if the administrator 
  chose to run getmail as root and deliver to maildirs under the 
  control of a local malicious user.  By exploiting a race condition, getmail 
  could be made to create files in a directory of the local user's choosing. Not 
  exploitable if root did not deliver messages to maildirs/mboxes under the 
  control of an untrusted user.  Not exploitable remotely.  Thanks: David 
  Watson.  My gratitude to David for his work on finding this problem.
  Version 3.2.5 will now refuse to deliver as root.  If you need to deliver to 
  untrusted local users, do it with groups or upgrade to getmail 4.2.0, which 
  delivers messages in child processes after dropping privileges.
Version 4.0.0a1
14 June 2004

  -first alpha release of getmail version 4


Changes since getmail version 3
-------------------------------

-complete rewrite
-switch to Python version 2.3.3:
  -increased code readability (augmented assignment, list comprehensions,
    string methods, etc)
  -eliminate external modules (ConfParser, timeoutsocket)
  -use standard library modules which have come up to reasonable levels
    of quality and functionality over old custom code (optparse,
    ConfigParser)
  -no longer require workarounds for older, broken standard library modules/
    functions
-modular, object-oriented framework for retrievers, destinations, filters
  allows extensibility
-make more platform-agnostic (transparently support system EOL convention,
  etc)
-support for multiple retriever/account types:
  -POP (single-user, multidrop, SDPS)
  -IMAPv4 (single-user, multidrop)
-full native support for POP3-over-SSL and IMAP-over-SSL.
-configuration (rc) file format changes:
  -support multiple rc files per invocation
  -one mail account per rc file
Version 4.0.0a2
14 June 2004

  -fix default/'default' in filters module.  Thanks: Andrew Raines.
  -add the mix-in classes for SSL support with POP3 classes.  Meant small
  rewrites to the POP3 classes, but the design should be even cleaner now.
Version 4.0.0a3
15 June 2004

  -fix typo in processing filters.  Thanks: K. Shantanu.
  -fix typo in processing non-default parameters.  Thanks: Andrew Raines.
  -document SSL retrievers
  -move retrievers.py configuration functionality into ConfigurableBase class
  -convert filters.py to use ConfigurableBase
  -convert destinations.py to use ConfigurableBase
Version 4.0.0a4
15 June 2004

  -fix default values in three classes' parameters which previously relied
  on type conversion.  Thanks: Andrew Raines.
  -fix default port for POP3-over-SSL and "username" parameter in documentation.
  Thanks: Frankye Fattarelli.
  -enable delete and read_all in [options] of rc file.  Change handling of
  verbose.
Version 4.0.0a5
16 June 2004

  -document tuple syntax.  Thanks:  Frankye Fattarelli.
  -fix "filters" name collision in script.  Thanks:  Frankye Fattarelli.
Version 4.0.0a6
16 June 2004

  -add pseudofile class to implement readline() and sslwrapper to implement
  sendall() on ssl objects.
  ssl objects in Python don't behave like a file, or like a socket; they're just
  ... broken. It's a deficiency in the Python standard library.
  This might make POP3-over-SSL work, or it might need more work yet.  I've
  got it talking some SSL, but it hangs at the moment.  Might be blocking
  in read().
  -move Mboxrd file locking to _deliver_message().  Thanks:  Frankye Fattarelli.
  -make --trace more useful and add extra debug info to main script.
  -eliminate noise from defaults in non-[options] section processing
  -found Python's ConfigParser .getboolean() method failed when the passed-in
  default was a non-string.  Maybe I should have stayed with my own
  replacement configuration parser, as it properly handled this case ...
  submitted a patch to the Python bug tracker and added a workaround to
  getmail for the moment.
  -/really/ enable delete and read_all in [options] of rc file.
Version 4.0.0a7
17 June 2004

  -debug and rewrite POP3-over-SSL functionality.  Involved writing around
  some ugly limitations and kludges in Python's socket.ssl and poplib.POP3
  code.  But POP3-over-SSL actually works now, and is fairly clean.
  Let me know if it hangs; I might need to change the way blocking mode is
  handled on the underlying socket.
Version 4.0.0a8
18 June 2004

  -fix 6 instances of getmailConfirurationError typo in retrievers.py
  -finish basics of IMAP support -- i.e., it successfully retrieves mail.
  delete might not work yet.  IMAP-over-SSL /might/, but the server I was
  testing against wasn't working with SSL (no connection).
  -handle email.Utils.getaddresses returning None.  Thanks:  Frankye Fattarelli.
  -fix default port for MultidropPOP3SSLRetriever.
Version 4.0.0a9
19 June 2004

  -accidentally edited initialize() in the wrong class; it broke POP3.
  This update should fix it.
Version 4.0.0a10
19 June 2004

  -fix the retrieve-every-other-message bug when delete == True.
  -move base classes out of retrievers.py into _retrieverbases.py
  -fix exception when retrieving mail from an empty IMAP account
Version 4.0.0a11
21 June 2004

  -add MultidropIMAPRetriever and MultidropIMAPSSLRetriever
  -add move_on_delete parameter to all IMAP retrievers.
  -add and document delete_after and max_message_size options
  -document read_all and delete options
  -rename pop3ssl.py
  -fix --quiet.  i.e., getmail should again operate truly silently if you
  want it to.
  -retrievers' quit() method wasn't getting called.  Fix.  Thanks: Frankye
  Fattarelli.
Version 4.0.0a12
21 June 2004

  -slight change to quit() to ensure old connections are closed
  and garbage-collected before trying to make new ones.  Thanks:  Frankye
  Fattarelli.
  -move default documentation directory to /usr/local/share/doc/ .
  -filters.py now checks that the filtered message is at least basically
  sane in that it has a header no shorter than the message it was supplied.
  Let me know if this causes problems.
  -add and document max_messages_per_session
Version 4.0.0a13
21 June 2004

  -add missing default for max_messages_per_session.  Thanks:  Frankye
  Fattarelli.
Version 4.0.0a14
22 June 2004

  -fix IMAP-over-SSL.  socket.ssl objects are apparently incompatible with
  socket timeouts, even in the IMAP_SSL class.
  -ensure --trace debugging output doesn't output passwords.
  Thanks: Julian Gomez.
  -IMAP classes would stop indexing mailboxes when they hit an empty one.
  Fixed.  Thanks: Julian Gomez.
Version 4.0.0a15
22 June 2004

  -add summary "Retrieved X messages for ..." for each rc file at program
  close.  Thanks: Frankye Fattarelli.
  -add explicit delete of retriever after quit() to try to force writing
  oldmail file immediately instead of at garbage collection.  Python makes
  no guarantees about when garbage collection takes place, so this won't be
  perfect.  Thanks: Julian Gomez.
  -add message_log
  -add traceback formatting on exception
  -change --dump to include filters.  Change order of operations.
Version 4.0.0a16
23 June 2004

  -add user and group, and allow_root_commands parameters to MDA_external
  destination and Filter_external filter classes.
  -make import pwd fail gracefully for Windows, etc.
  -add allow_root_commands parameter to MDA_external destination and
  Filter_external filter classes to force overriding of running external
  commands as root.
  -pass reference to configparser to retriever, destination, and filters
  -add MultiSorter destination of "[section]" which invokes another
  destination from the same getmail rc file.  Use this to deliver to programs
  by including an MDA_external destination in a section named [foo] in the
  rc file, then specify that section name in the MultiSorter in the locals
  part, i.e.
    [destination]
    type = MultiSorter
    postmaster = /path/to/maildir/
    locals = joe /path/to/maildir/
      sam /path/to/mbox/
      chris [myprogram]
    [myprogram]
    type = MDA_external
    path = /usr/local/bin/mymda
    arguments = ("--strip-attachments", "-f%(sender)", "--fast")
  Don't try to cause a loop using this to point to itself.  You have been
  warned.
  -MultiSorter is now a little stricter about destination names.  A maildir
  (after any tilde expansion, if applicable) must start with "." or "/" and
  end with "/".  An mboxrd (after any tilde expansion, if applicable) must
  start with "." or "/".  This means if you previous had something like:
    locals = sam@example.net subdir/maildir/
  You'll need to change it to:
    locals = sam@example.net ./subdir/maildir/
  Of course,
    locals = sam@example.net ~sam/maildir/
  is already okay if sam is a valid user and has a valid home directory.
  -add message_log_syslog
Version 4.0.0a17
23 June 2004

  -add exitcodes_keep and exitcodes_drop parameters to Filter_external.
  Thanks: Frankye Fattarelli.
Version 4.0.0a18
24 June 2004

  -add msg_flatten(), msg_lines() and use them exclusively to prevent
  .as_string() from changing header fields for spurious reasons.
  Thanks: Andrew Raines.
  -remove code doing From_-escaping in Mboxrd and let the email module do it.
  -fix copy & paste errors in change_uidgid().  Thanks: Andrew Raines.
  -catch timeouts
Version 4.0.0a19
24 June 2004

  -bring some docstrings, comments, and documentation up to date.
  -add Filter_classifier filter module, to support adding information
  to the message header from programs that don't provide the original message
  back on stdout (like clamscan/clamdscan, apparently).  Thanks: Frankye
  Fattarelli.
  -missed seek(0) in msg_flatten().  Add missing imports.
  Thanks: Andrew Raines.