MarsSeed [1] filed a deletion request for smtp-git [2]: Upstream is barely maintained: had 2 minor commits in 2018, and one in 2019, 2020 and 2021 each. [a]
The package also has 0 votes/comments. Its name is too generic. /usr/bin/smtp is also carried by extra/opensmtpd. The package also does not align with smtp package conventions of Arch repo - namely, to virtually provide 'smtp-server' and/or 'smtp- forwarder', whichever is relevant. But the main reason for deletion is that no one should use this application. Upstream is brazenly amateurish in their coding practices. The source of the server executable uses sprintf to write unsanitized input strings to a buffer whose allocated memory is shorter than the allowed string. This is the kind of basic vulnerability that is the prime target of even script-kiddies for remote code execution. (Or if the build is enhanced with PIE and RELRO, which currently it isn't, then such overflow will just result in a crash, hence a denial-of-service vulnerability.) On top of all this, upstream requires hard-coded plaintext username, password, email address, server address and port in the config.h header file, to be baked-in to the executable at build-time. (Coupled with the above-mentioned remote code execution vulnerability, one's server authentication credentials could easily be retrieved by online adversaries.) All this clearly indicates that this was never intended to be taken seriously, nor for using it in any kind of deployment. Nor has it received any scrutiny from anyone whatsoever. The code also depends on mbedtls, but it does not clarify which API version it requires. (Only one commit in 2020 adapted the former polarssl code to use some unversioned header entries of mbedtls.) Upstream also lacks a bug tracking system, a security vulnerability reporting contact, and the code is not signed electronically. I see zero reason to keep this. Repo has many smtp-servers and smtp- forwarders, and AUR carries additional ones. [a]: http://repo.or.cz/w/smtp.git [1] https://aur.archlinux.org/account/MarsSeed/ [2] https://aur.archlinux.org/pkgbase/smtp-git/
