ARM64 Version

@DerLinkman I just read your blog post. I’m running a small Debian 12 server at home and wanted to verify your statement concerning your theory regarding openssl 3.x.
So I copied the encryption private/public keypair over to my Debian 12 machine along with an encrypted mail from a Maildir directory.
I had no problems decrypting the message on my Debian 12 machine using doveadm:

> doveadm fs get compress lz4:1:crypt:private_key_path=ecprivkey.pem:public_key_path=ecpubkey.pem:posix:prefix=/ /tmp/1687331436.M945249P470123.d22e087f8e4a\,S\=9501\,W\=9680\:2\,S 
Return-Path: <XXX@XXXXXX.XX>
Delivered-To: YYY@YYYYYY.de
Received: from ZZZ.ZZZZZZZ.ZZZZZ([dfgsdfgsdfgsdfgsdfg])
...
...

The mail was decrypted successfully. The openssl and dovecot version:

> dpkg -l openssl
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version          Architecture Description
+++-==============-================-============-====================================================
ii  openssl        3.0.11-1~deb12u1 amd64        Secure Sockets Layer toolkit - cryptographic utility

> dpkg -l dovecot-core
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version              Architecture Description
+++-==============-====================-============-====================================
ii  dovecot-core   1:2.3.19.1+dfsg1-2.1 amd64        secure POP3/IMAP server - core files

Do I have to test it another way?

OK, I was really restless because of this issue, so I installed a new ARM server in my Hetzner cloud. I setup a new nightly mailcow installation and created one of my live domains with a mailbox.
Then I imported the crypt and vmail backup from my current mailcow, logged into Sogo and voila, dovecot complained about not being able to decrypt the mails

I tried to set the compression of dovecot to LZ4, but unfortunately it wasn’t compiled wit LZ4 support…

Error: zlib_save: Support not compiled in for handler: lz4

So I went along and used the doveadm commands from Mail crypt - mailcow: dockerized documentation

to decrypt the mails in my mailbox, and then encrypted them again. (I had to remove the regex parameters as the busybox find doesn’t regognize them)

Result:

I guess it would be much easier to use a dovecot image compiled with LZ4, otherwise all mailcow admins will have to do the above decrypting and recrypting if zstd is used. And that could take a very long time if you have GBs of mails…

Ah sorry, I forgot to mention that I had to install the ‘dovecot-common’ package in the host system and perform the decryption directly in the docker vmail volume under /var/docker/volumes/ because lz4 wasn’t compiled in the docker dovecot image. You have to adjust the path of the find command accordingly!

But if you have mixed compression mails in your maildir I think you have to be careful and ONLY do this for the LZ4 compressed mails!

But if you have mails with mixed compression in your maildir I think you have to be careful and ONLY do this for the LZ4 compressed mails!

asoprano you could wrap the doveadm command in another if, so that it only continues when the decryption worked with LZ4 compression. Something like

find /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do
if [[ $(head -c7 "$file") == "CRYPTED" ]]; then
  if doveadm fs get compress lz4:1:crypt:private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \
    "$file" > "/tmp/$(basename "$file")"; then
    if [[ -s "/tmp/$(basename "$file")" ]]; then
      chmod 600 "/tmp/$(basename "$file")"
      chown 5000:5000 "/tmp/$(basename "$file")"
      mv "/tmp/$(basename "$file")" "$file"
    else
      rm "/tmp/$(basename "$file")"
    fi
  fi
fi
done

This should decrypt all LZ4 compressed mails. If you then switch ‘lz4’ with ‘zstd’ in the third line it should decrypt the zstd compressed mails only. Now that all your mails are decrypted you can go ahead and run the ‘doveadm fs put’ loop

Ah, you don’t even need the extra if, as in line 4 the loop checks if doveadm created an output file

So just run the original loop with lz4 first and afterwards use zstd, thats all