feat: take key flags and expiration into account when selecting the key

Test keys were generated with GnuPG 2.4.9 from Arch Linux. The script that was used to generate the key for test_select_pk_for_encryption: ``` export GNUPGHOME="$PWD/gnupghome" rm -fr "$GNUPGHOME" mkdir -p "$GNUPGHOME" chmod 700 "$GNUPGHOME" # --faked-system-time example is from the gpg man page GPG="gpg --batch --quiet --faked-system-time 20070924T154812" USERID='Alice <alice@example.org>' # Generate the primary key. # "default" means certification+signing primary key # "never" to make the key not expire, otherwise gpg generates expiring key by default. $GPG --passphrase '' --quick-generate-key "$USERID" ed25519 default never # --quick-add-key requires that keys are referred to by the fingerprint. # Output of --with-colons is described in /usr/share/doc/gnupg/DETAILS FINGERPRINT="$($GPG --list-secret-keys --with-colons | awk -F: '$1 == "fpr" { print $10 }')" # Authentication-only RSA key, should not be used for encryption. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" rsa auth never # Expired (considering the fake date) subkey. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr 1d # Signing subkey. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" ed25519 sign never # Usable encryption subkey. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr never # Expiring subkey that is not expired in the beginning of 2008. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr 1y # Another encryption subkey that should not be used because the first one is preferred. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr never $GPG --armor --export "$FINGERPRINT" > alice.tpk.asc ``` Key for test_select_only_expired_subkey was generated with: ``` #!/bin/sh set -e export GNUPGHOME="$PWD/gnupghome" rm -fr "$GNUPGHOME" mkdir -p "$GNUPGHOME" chmod 700 "$GNUPGHOME" GPG="gpg --batch --quiet --faked-system-time 20070924T154812" USERID='Alice <alice@example.org>' $GPG --passphrase '' --quick-generate-key "$USERID" ed25519 default never FINGERPRINT="$($GPG --list-secret-keys --with-colons | awk -F: '$1 == "fpr" { print $10 }')" $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr 1y $GPG --armor --export "$FINGERPRINT" > alice.tpk.asc ``` Key for test_expiring_subkey_selection was generated with: ``` #!/bin/sh set -e export GNUPGHOME="$PWD/gnupghome" rm -fr "$GNUPGHOME" mkdir -p "$GNUPGHOME" chmod 700 "$GNUPGHOME" GPG="gpg --batch --quiet" USERID='Alice <alice@example.org>' $GPG --passphrase '' --faked-system-time 20250101T000000 --quick-generate-key "$USERID" ed25519 default never FINGERPRINT="$($GPG --list-secret-keys --with-colons | awk -F: '$1 == "fpr" { print $10 }')" $GPG --passphrase '' --faked-system-time 20250101T000000 --quick-add-key "$FINGERPRINT" cv25519 encr never $GPG --passphrase '' --faked-system-time 20260601T000000 --quick-add-key "$FINGERPRINT" cv25519 encr 1m $GPG --passphrase '' --faked-system-time 20260601T000000 --quick-add-key "$FINGERPRINT" cv25519 encr 2w $GPG --passphrase '' --faked-system-time 20260608T000000 --quick-add-key "$FINGERPRINT" cv25519 encr 2w $GPG --armor --export "$FINGERPRINT" > alice.tpk.asc ```
refactor: remove Context argument from secret_key_to_public_key()
2026-10-09 14:40:16 +03:00 · 2026-10-08 16:58:11 +00:00 · 2026-10-07 19:23:41 +00:00 · 2026-10-07 17:32:42 +02:00 · 2026-10-07 14:26:09 +00:00 · 2026-10-06 23:52:19 +02:00
27 changed files with 485 additions and 249 deletions
@@ -20,7 +20,7 @@ permissions: {}

 env:
  RUSTFLAGS: -Dwarnings
-  RUST_VERSION: 1.98.1
+  RUST_VERSION: 1.99.0

  # Minimum Supported Rust Version
  MSRV: 1.89.0
@@ -30,6 +30,9 @@ jobs:
    name: Lint Rust
    runs-on: ubuntu-latest
    timeout-minutes: 60
+    env:
+      # Tests always unwind: match it so dependencies are only checked once.
+      CARGO_PROFILE_DEV_PANIC: unwind
    steps:
      - uses: actions/checkout@v7
        with:
@@ -48,8 +51,6 @@ jobs:
        run: cargo fmt --all -- --check
      - name: Run clippy
        run: scripts/clippy.sh
-      - name: Check with all features
-        run: cargo check --workspace --all-targets --all-features
      - name: Check with only default features
        run: cargo check --all-targets

@@ -139,12 +140,12 @@ jobs:
      - name: Tests
        env:
          RUST_BACKTRACE: 1
-        run: cargo nextest run --workspace --locked
+        run: cargo nextest run --workspace --exclude deltachat-jsonrpc-bindings --locked

      - name: Doc-Tests
        env:
          RUST_BACKTRACE: 1
-        run: cargo test --workspace --locked --doc
+        run: cargo test --workspace --exclude deltachat-jsonrpc-bindings --locked --doc

      - name: Test cargo vendor
        run: cargo vendor
@@ -194,9 +194,9 @@ dependencies = [

 [[package]]
 name = "astral-tokio-tar"
-version = "0.6.4"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b18457efd137254e016bbde5e1d88df61c4e1a5ae2223746e56123bac6af2463"
+checksum = "6f2e989b33246fe9240d39accf4dd9a01e0b6c1f3ce9dd095e0a47fa02505523"
 dependencies = [
 "futures-core",
 "libc",
@@ -205,6 +205,7 @@ dependencies = [
 "rustix 1.1.4",
 "tokio",
 "tokio-stream",
+ "zerocopy 0.8.59",
 ]

 [[package]]
@@ -1405,7 +1406,6 @@ dependencies = [
 "tokio-stream",
 "tokio-util",
 "toml",
- "tracing",
 "url",
 "uuid",
 "walkdir",
@@ -4246,9 +4246,9 @@ dependencies = [

 [[package]]
 name = "pgp"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfa4743b28656065ff4c0ba09e46b357a65e8c00fc2341e89084b82f87cbdf1"
+checksum = "ae70f4d9325a391db30d115d6191a7bb67cec856aa0bba131290f0c4e09a532a"
 dependencies = [
 "aead",
 "aes",
@@ -4595,7 +4595,7 @@ version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
 dependencies = [
- "zerocopy",
+ "zerocopy 0.7.35",
 ]

 [[package]]
@@ -5812,7 +5812,7 @@ dependencies = [
 "sha3",
 "signature",
 "typenum",
- "zerocopy",
+ "zerocopy 0.7.35",
 ]

 [[package]]
@@ -7582,7 +7582,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
 "byteorder",
- "zerocopy-derive",
+ "zerocopy-derive 0.7.35",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6df92bf3d9227be3d53173901ddbffac2babc27ae50f397776ffd6dc33f800cb"
+dependencies = [
+ "zerocopy-derive 0.8.59",
 ]

 [[package]]
@@ -7596,6 +7605,17 @@ dependencies = [
 "syn 2.0.118",
 ]

+[[package]]
+name = "zerocopy-derive"
+version = "0.8.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac4f328cf2f05d084e496c3e9c3f33ed0a183656a16e1fcec4d464d8373aec82"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "zerofrom"
 version = "0.1.5"
@@ -77,7 +77,7 @@ num-derive = "0.4"
 num-traits = { workspace = true }
 parking_lot = "0.12.4"
 percent-encoding = "2.3"
-pgp = { version = "0.20.0", features = ["draft-pqc"], default-features = false }
+pgp = { version = "0.21.0", features = ["pqc"], default-features = false }
 pin-project = "1"
 qrcodegen = "1.7.0"
 quick-xml = { version = "0.41", features = ["escape-html"] }
@@ -100,11 +100,10 @@ thiserror = { workspace = true }
 tokio-io-timeout = "1.2.1"
 tokio-rustls = { version = "0.26.2", default-features = false, features = ["tls12", "brotli"] }
 tokio-stream = { version = "0.1.17", features = ["fs"] }
-astral-tokio-tar = { version = "0.6.3", default-features = false }
+astral-tokio-tar = { version = "0.7.0", default-features = false }
 tokio-util = { workspace = true }
 tokio = { workspace = true, features = ["fs", "rt-multi-thread", "macros"] }
 toml = "0.9"
-tracing = "0.1.41"
 url = "2"
 uuid = { version = "1", features = ["serde", "v4"] }
 walkdir = "2.5.0"
@@ -3543,28 +3543,6 @@ uint32_t         dc_chatlist_get_msg_id      (const dc_chatlist_t* chatlist, siz
 dc_lot_t*        dc_chatlist_get_summary     (const dc_chatlist_t* chatlist, size_t index, dc_chat_t* chat);


-/**
- * Create a chatlist summary item when the chatlist object is already unref()'d.
- *
- * This function is similar to dc_chatlist_get_summary(), however,
- * it takes the chat ID and the message ID as returned by dc_chatlist_get_chat_id() and dc_chatlist_get_msg_id()
- * as arguments. The chatlist object itself is not needed directly.
- *
- * This maybe useful if you convert the complete object into a different representation
- * as done e.g. in the node-bindings.
- * If you have access to the chatlist object in some way, using this function is not recommended,
- * use dc_chatlist_get_summary() in this case instead.
- *
- * @memberof dc_context_t
- * @param context The context object.
- * @param chat_id The chat ID to get a summary for.
- * @param msg_id The message ID to get a summary for.
- * @return The summary as an dc_lot_t object, see dc_chatlist_get_summary() for details.
- *     Must be freed using dc_lot_unref(). NULL is never returned.
- */
-dc_lot_t*        dc_chatlist_get_summary2    (dc_context_t* context, uint32_t chat_id, uint32_t msg_id);
-
-
 /**
 * Get info summary for a chat, in JSON format.
 *
@@ -47,7 +47,6 @@ mod dc_array;
 mod lot;

 mod string;
-use deltachat::chatlist::Chatlist;

 use self::string::*;

@@ -2844,34 +2843,6 @@ pub unsafe extern "C" fn dc_chatlist_get_summary(
    Box::into_raw(Box::new(summary.into()))
 }

-#[unsafe(no_mangle)]
-pub unsafe extern "C" fn dc_chatlist_get_summary2(
-    context: *mut dc_context_t,
-    chat_id: u32,
-    msg_id: u32,
-) -> *mut dc_lot_t {
-    if context.is_null() {
-        eprintln!("ignoring careless call to dc_chatlist_get_summary2()");
-        return ptr::null_mut();
-    }
-    let ctx = unsafe { &*context };
-    let msg_id = if msg_id == 0 {
-        None
-    } else {
-        Some(MsgId::new(msg_id))
-    };
-    let summary = block_on(Chatlist::get_summary2(
-        ctx,
-        ChatId::new(chat_id),
-        msg_id,
-        None,
-    ))
-    .context("get_summary2 failed")
-    .log_err(ctx)
-    .unwrap_or_default();
-    Box::into_raw(Box::new(summary.into()))
-}
-
 // dc_chat_t

 /// FFI struct for [dc_chat_t]
@@ -31,8 +31,6 @@ pub enum ChatListItemFetchResult {
        summary_text1: String,
        summary_text2: String,
        summary_status: u32,
-        /// showing preview if last chat message is image
-        summary_preview_image: Option<String>,

        /// True if the chat is encrypted.
        /// This means that all messages in the chat are encrypted,
@@ -103,8 +101,6 @@ pub(crate) async fn get_chat_list_item_by_id(
    let summary_text1 = summary.prefix.map_or_else(String::new, |s| s.to_string());
    let summary_text2 = summary.text.to_owned();

-    let summary_preview_image = summary.thumbnail_path;
-
    let visibility = chat.get_visibility();

    let avatar_path = chat
@@ -157,7 +153,6 @@ pub(crate) async fn get_chat_list_item_by_id(
        summary_text1,
        summary_text2,
        summary_status: summary.state.to_u32().expect("impossible"), // idea and a function to transform the constant to strings? or return string enum
-        summary_preview_image,
        is_encrypted: chat.is_encrypted(ctx).await?,
        is_group: chat.get_type() == Chattype::Group,
        fresh_message_counter,
@@ -149,7 +149,10 @@ class Rpc:
    def close(self) -> None:
        """Terminate RPC server process and wait until the reader loop finishes."""
        self.closing = True
-        self.stop_io_for_all_accounts()
+        # JSON-RPC error may happen if RPC server process has crashed already.
+        # We still want to shutdown all threads in this case.
+        with contextlib.suppress(JsonRpcError):
+            self.stop_io_for_all_accounts()
        # Let `events_loop` stop cleanly on `closing` before the pipe goes away,
        # otherwise it might exit through an "RPC server closed" error instead.
        self.events_thread.join()
@@ -35,6 +35,19 @@ def test_sleep(rpc) -> None:
        assert sleep_5_future in pending


+def test_shutdown(rpc) -> None:
+    """Test RPC client shutdown if RPC server process is terminated.
+
+    This is a regression test, at the time of adding it RPC client
+    did not terminate all threads and python process did not exit.
+    Shutting down all threads is tested implicitly by pytest-timeout.
+    """
+    rpc.process.kill()
+    rpc.process.wait()
+    with pytest.raises(JsonRpcError):
+        rpc.get_system_info()
+
+
 def test_email_address_validity(rpc) -> None:
    valid_addresses = [
        "email@example.com",
@@ -113,6 +113,8 @@ skip = [
     { name = "windows_x86_64_gnu" },
     { name = "windows_x86_64_gnullvm" },
     { name = "windows_x86_64_msvc" },
+     { name = "zerocopy-derive", version = "0.7.35" },
+     { name = "zerocopy", version = "0.7.35" },
 ]


@@ -456,6 +456,21 @@ CREATE TABLE smtp_status_updates (
    descr TEXT NOT NULL -- text to send along with the updates
 );

+-- Table to record the successful usage transports for sending.
+-- Sorting the table by rowid in descending order
+-- returns most recently successfully used transport first.
+CREATE TABLE smtp_success (
+    -- Sequentially increasing ID of the success.
+    -- Transport with the highest ID is to be used first.
+    id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+
+    -- ID of the transport that was used to send a message.
+    transport_id INTEGER UNIQUE NOT NULL,
+
+    -- Delete `smtp_success` rows when the transport is deleted.
+    FOREIGN KEY(transport_id) REFERENCES transports(id) ON DELETE CASCADE
+) STRICT;
+
 -- Table of "sync items" to be grouped into sync messages
 -- and sent to own devices.
 CREATE TABLE multi_device_sync (
@@ -6,4 +6,4 @@
 #
 # To automatically fix warnings, run
 #   scripts/clippy.sh --fix --allow-dirty
-cargo clippy --locked --workspace --all-targets --all-features "$@" -- -D warnings
+cargo clippy --locked --workspace --exclude deltachat-jsonrpc-bindings --all-targets --all-features "$@" -- -D warnings
@@ -76,12 +76,8 @@ impl Accounts {
        Accounts::open(events, dir, writable).await
    }

-    /// Get the ID used to log events.
-    ///
-    /// Account manager logs events with ID 0
-    /// which is not used by any accounts.
-    fn get_id(&self) -> u32 {
-        0
+    fn log_info(&self, file: &str, line: u32, msg: String) {
+        self.emit_event(EventType::Info(format!("{file}:{line}: {msg}")));
    }

    /// Ensures the accounts directory and config file exist.
@@ -395,11 +391,6 @@ impl Accounts {
                "Starting background fetch for {n_accounts} accounts."
            )),
        });
-        ::tracing::event!(
-            ::tracing::Level::INFO,
-            account_id = 0,
-            "Starting background fetch for {n_accounts} accounts."
-        );
        let mut set = JoinSet::new();
        for account in accounts {
            set.spawn(async move {
@@ -415,11 +406,6 @@ impl Accounts {
                "Finished background fetch for {n_accounts} accounts."
            )),
        });
-        ::tracing::event!(
-            ::tracing::Level::INFO,
-            account_id = 0,
-            "Finished background fetch for {n_accounts} accounts."
-        );
    }

    /// Auxiliary function for [Accounts::background_fetch].
@@ -462,11 +448,6 @@ impl Accounts {
                id: 0,
                typ: EventType::Warning("Background fetch timed out.".to_string()),
            });
-            ::tracing::event!(
-                ::tracing::Level::WARN,
-                account_id = 0,
-                "Background fetch timed out."
-            );
        }
        events.emit(Event {
            id: 0,
@@ -549,7 +530,7 @@ impl Accounts {
        }
    }

-    /// Emits a single event.
+    /// Emits a single event with ID 0, which is not used by any accounts.
    pub fn emit_event(&self, event: EventType) {
        self.events.emit(Event { id: 0, typ: event })
    }
@@ -350,24 +350,7 @@ impl<'a> BlobObject<'a> {
                *vt = Viewtype::Image;
                return Ok(name);
            }
-
-            let mut img = match fmt {
-                image::ImageFormat::WebP => {
-                    // `with_guessed_format()` restores file position,
-                    // so `buf_reader` is at the beginning of the file.
-                    let buf_reader = imgreader.into_inner();
-                    let webp_decoder = image::codecs::webp::WebPDecoder::new(buf_reader)
-                        .context("Failed to create WebP decoder")?;
-
-                    // If WebP has animation, do not try to recode it.
-                    // Recoding into JPEG will result in losing the animation.
-                    if !is_avatar && webp_decoder.has_animation() {
-                        return Ok(name);
-                    }
-                    DynamicImage::from_decoder(webp_decoder)?
-                }
-                _ => imgreader.decode().context("Failed to decode image")?,
-            };
+            let mut img = imgreader.decode().context("image decode failure")?;
            let orientation = exif
                .as_ref()
                .map(|exif| exif_orientation(exif, context))
@@ -4,9 +4,7 @@ use super::*;
 use crate::message::{Message, Viewtype};
 use crate::param::Param;
 use crate::sql;
-use crate::test_utils::{
-    self, AVATAR_64x64_BYTES, AVATAR_64x64_DEDUPLICATED, TestContext, TestContextManager,
-};
+use crate::test_utils::{self, AVATAR_64x64_BYTES, AVATAR_64x64_DEDUPLICATED, TestContext};
 use crate::tools::SystemTime;

 fn check_image_size(path: impl AsRef<Path>, width: u32, height: u32) -> image::DynamicImage {
@@ -740,66 +738,6 @@ async fn test_send_gif_as_sticker() -> Result<()> {
    Ok(())
 }

-/// Tests that animated WebP is sent without reencoding.
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn test_send_animated_webp_as_image() -> Result<()> {
-    let bytes = include_bytes!("../../test-data/image/animated.webp");
-    let (width, height) = (1280u32, 531u32);
-    let mut tcm = TestContextManager::new();
-    let alice = &tcm.alice().await;
-    let bob = &tcm.bob().await;
-    alice
-        .set_config(
-            Config::MediaQuality,
-            Some(&(MediaQuality::Worse as i32).to_string()),
-        )
-        .await?;
-    let file = alice.get_blobdir().join("file").with_extension("gif");
-    fs::write(&file, &bytes)
-        .await
-        .context("Failed to write file")?;
-    let mut msg = Message::new(Viewtype::Image);
-    msg.set_file_and_deduplicate(alice, &file, Some("file.webp"), None)?;
-
-    let chat = alice.create_chat(bob).await;
-    let sent = alice.send_msg(chat.id, &mut msg).await;
-    let bob_msg = bob.recv_msg(&sent).await;
-    assert_eq!(bob_msg.get_viewtype(), Viewtype::Image);
-    assert_eq!(bob_msg.get_width() as u32, width);
-    assert_eq!(bob_msg.get_height() as u32, height);
-    assert_eq!(
-        bob_msg.get_filebytes(bob).await?.unwrap(),
-        bytes.len() as u64
-    );
-    Ok(())
-}
-
-/// Tests that if user sets animated WebP as an avatar, it may be recoded.
-///
-/// We don't want to recode animated WebPs into JPEG and lose animation,
-/// but for avatars we don't want animation and transparency anyway.
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn test_recode_animated_webp_avatar() -> Result<()> {
-    let mut tcm = TestContextManager::new();
-    let t = &tcm.alice().await;
-
-    let avatar_src = t.dir.path().join("avatar.webp");
-    let avatar_bytes = include_bytes!("../../test-data/image/animated.webp");
-    fs::write(&avatar_src, avatar_bytes).await.unwrap();
-
-    t.set_config(Config::Selfavatar, Some(avatar_src.to_str().unwrap()))
-        .await?;
-    let avatar_blob = t.get_config(Config::Selfavatar).await?.unwrap();
-    assert!(avatar_blob.ends_with(".jpg"));
-
-    let scaled_avatar_size = fs::metadata(&avatar_blob).await.unwrap().len();
-    assert!(
-        scaled_avatar_size < avatar_bytes.len() as u64,
-        "Animated WebP avatar must be recoded"
-    );
-    Ok(())
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn test_create_and_deduplicate() -> Result<()> {
    let t = TestContext::new().await;
@@ -125,14 +125,11 @@ pub trait DcKey: Serialize + Deserializable + Clone {

 /// Converts secret key to public key.
 pub(crate) fn secret_key_to_public_key(
-    context: &Context,
    mut signed_secret_key: SignedSecretKey,
    timestamp: u32,
    addr: &str,
    relay_addrs: &str,
 ) -> Result<SignedPublicKey> {
-    info!(context, "Converting secret key to public key.");
-
    // Make sure timestamp of created signatures
    // is not in the past compared to the primary key timestamp.
    let timestamp = std::cmp::max(
@@ -305,7 +302,7 @@ pub(crate) async fn load_self_public_key_opt(context: &Context) -> Result<Option
    let addr = context.get_primary_self_addr().await?;
    let all_addrs = context.get_self_addrs().await?.join(",");
    let signed_public_key =
-        secret_key_to_public_key(context, signed_secret_key, timestamp, &addr, &all_addrs)?;
+        secret_key_to_public_key(signed_secret_key, timestamp, &addr, &all_addrs)?;
    *lock = Some(signed_public_key.clone());

    Ok(Some(signed_public_key))
@@ -3,6 +3,7 @@
 #![allow(missing_docs)]

 use crate::context::Context;
+use crate::events::EventType;

 mod stream;

@@ -12,15 +13,9 @@ macro_rules! info {
    ($ctx:expr,  $msg:expr) => {
        info!($ctx, $msg,)
    };
-    ($ctx:expr, $msg:expr, $($args:expr),* $(,)?) => {{
-        let formatted = format!($msg, $($args),*);
-        let full = format!("{file}:{line}: {msg}",
-                           file = file!(),
-                           line = line!(),
-                           msg = &formatted);
-        ::tracing::event!(::tracing::Level::INFO, account_id = $ctx.get_id(), "{}", &formatted);
-        $ctx.emit_event($crate::EventType::Info(full));
-    }};
+    ($ctx:expr, $msg:expr, $($args:expr),* $(,)?) => {
+        $ctx.log_info(file!(), line!(), format!($msg, $($args),*))
+    };
 }

 // Workaround for <https://github.com/rust-lang/rust/issues/133708>.
@@ -30,15 +25,9 @@ mod warn_macro_mod {
        ($ctx:expr, $msg:expr) => {
            warn_macro!($ctx, $msg,)
        };
-        ($ctx:expr, $msg:expr, $($args:expr),* $(,)?) => {{
-            let formatted = format!($msg, $($args),*);
-            let full = format!("{file}:{line}: {msg}",
-                               file = file!(),
-                               line = line!(),
-                               msg = &formatted);
-            ::tracing::event!(::tracing::Level::WARN, account_id = $ctx.get_id(), "{}", &formatted);
-            $ctx.emit_event($crate::EventType::Warning(full));
-        }};
+        ($ctx:expr, $msg:expr, $($args:expr),* $(,)?) => {
+            $ctx.log_warn(file!(), line!(), format!($msg, $($args),*))
+        };
    }

    pub(crate) use warn_macro;
@@ -50,15 +39,25 @@ macro_rules! error {
    ($ctx:expr, $msg:expr) => {
        error!($ctx, $msg,)
    };
-    ($ctx:expr, $msg:expr, $($args:expr),* $(,)?) => {{
-        let formatted = format!($msg, $($args),*);
-        ::tracing::event!(::tracing::Level::ERROR, account_id = $ctx.get_id(), "{}", &formatted);
-        $ctx.set_last_error(&formatted);
-        $ctx.emit_event($crate::EventType::Error(formatted));
-    }};
+    ($ctx:expr, $msg:expr, $($args:expr),* $(,)?) => {
+        $ctx.log_error(format!($msg, $($args),*))
+    };
 }

 impl Context {
+    pub(crate) fn log_info(&self, file: &str, line: u32, msg: String) {
+        self.emit_event(EventType::Info(format!("{file}:{line}: {msg}")));
+    }
+
+    pub(crate) fn log_warn(&self, file: &str, line: u32, msg: String) {
+        self.emit_event(EventType::Warning(format!("{file}:{line}: {msg}")));
+    }
+
+    pub(crate) fn log_error(&self, msg: String) {
+        self.set_last_error(&msg);
+        self.emit_event(EventType::Error(msg));
+    }
+
    /// Set last error string.
    /// Implemented as blocking as used from macros in different, not always async blocks.
    pub fn set_last_error(&self, error: &str) {
@@ -116,12 +115,6 @@ impl<T, E: std::fmt::Display> LogExt<T, E> for Result<T, E> {
            );
            // We can't use the warn!() macro here as the file!() and line!() macros
            // don't work with #[track_caller]
-            tracing::event!(
-                ::tracing::Level::WARN,
-                account_id = context.get_id(),
-                "{}",
-                &full
-            );
            context.emit_event(crate::EventType::Warning(full));
        };
        self
@@ -93,11 +93,6 @@ impl<S: SessionStream> AsyncRead for LoggingStream<S> {
                "Read error on stream {peer_addr:?} after reading {} and writing {} bytes: {err}.",
                this.metrics.total_read, this.metrics.total_written
            );
-            tracing::event!(
-                ::tracing::Level::WARN,
-                account_id = *this.account_id,
-                log_message
-            );
            this.events.emit(Event {
                id: *this.account_id,
                typ: EventType::Warning(log_message),
@@ -366,7 +366,6 @@ async fn test_mdn_sent_to_all_relays() -> Result<()> {
    // Bob's key gets a second relay address and Alice merges the newer key.
    let bob_secret_key = load_self_secret_key(bob).await?;
    let bob_public_key = secret_key_to_public_key(
-        bob,
        bob_secret_key,
        u32::try_from(time())? + 100,
        "bob@example.net",
@@ -1,5 +1,6 @@
 //! OpenPGP helper module using [rPGP facilities](https://github.com/rpgp/rpgp).

+use std::cmp::Ordering;
 use std::collections::{HashMap, HashSet};
 use std::io::Cursor;

@@ -83,13 +84,64 @@ pub(crate) fn create_keypair(addr: EmailAddress) -> Result<SignedSecretKey> {

 /// Selects a subkey of the public key to use for encryption.
 ///
-/// Returns `None` if the public key cannot be used for encryption.
+/// The key is selected according to
+/// <https://www.ietf.org/archive/id/draft-autocrypt-openpgp-v2-cert-03.html#section-4.3-4>.
+/// If multiple keys are available, the one that will expire sooner is selected.
 ///
-/// TODO: take key flags and expiration dates into account
-fn select_pk_for_encryption(key: &SignedPublicKey) -> Option<&SignedPublicSubKey> {
+/// Returns `None` if the public key cannot be used for encryption.
+fn select_pk_for_encryption(now: u32, key: &SignedPublicKey) -> Option<&SignedPublicSubKey> {
    key.public_subkeys
        .iter()
-        .find(|subkey| subkey.algorithm().can_encrypt())
+        .filter(|subkey| subkey.algorithm().can_encrypt())
+        .filter_map(|subkey| {
+            // We take arbitrary signature here and don't try to select the newest one.
+            // Filtering out outdated and invalid signatures should happen during certificate merging.
+            let signature = subkey.signatures.first()?;
+
+            let key_flags = signature.key_flags();
+            if !key_flags.encrypt_comms() {
+                return None;
+            }
+
+            if let Some(expiration_duration) = signature
+                .key_expiration_time()
+                .filter(|duration| duration.as_secs() != 0)
+                && now
+                    > subkey
+                        .created_at()
+                        .as_secs()
+                        .saturating_add(expiration_duration.as_secs())
+            {
+                // Key is expired.
+                return None;
+            }
+            Some((subkey, signature))
+        })
+        .min_by(|(subkey1, signature1), (subkey2, signature2)| {
+            match (
+                signature1
+                    .key_expiration_time()
+                    .filter(|duration| duration.as_secs() != 0),
+                signature2
+                    .key_expiration_time()
+                    .filter(|duration| duration.as_secs() != 0),
+            ) {
+                (None, None) => Ordering::Equal,
+                (None, Some(_)) => Ordering::Greater,
+                (Some(_), None) => Ordering::Less,
+                (Some(expiration1), Some(expiration2)) => (subkey1
+                    .created_at()
+                    .as_secs()
+                    .saturating_add(expiration1.as_secs()))
+                .cmp(
+                    &(subkey2
+                        .created_at()
+                        .as_secs()
+                        .saturating_add(expiration2.as_secs())),
+                ),
+            }
+        })
+        .map(|(subkey, _signature)| subkey)
 }

 /// Version of SEIPD packet to use.
@@ -151,10 +203,11 @@ pub fn pk_encrypt(
 ) -> Result<String> {
    tokio::task::block_in_place(|| {
        let mut rng = thread_rng();
+        let now = pgp::types::Timestamp::now();

        let pkeys = public_keys_for_encryption
            .iter()
-            .filter_map(select_pk_for_encryption);
+            .filter_map(|key| select_pk_for_encryption(now.as_secs(), key));

        let msg = MessageBuilder::from_bytes("", plain);
        let encoded_msg = match seipd_version {
@@ -485,7 +538,8 @@ pub(crate) fn relay_addrs(public_key: &SignedPublicKey, addr: &str) -> Vec<Strin

 /// Returns true if the key can be encrypted to, i.e. has an encryption subkey.
 pub(crate) fn pubkey_can_encrypt(public_key: &SignedPublicKey) -> bool {
-    select_pk_for_encryption(public_key).is_some()
+    let now = pgp::types::Timestamp::now();
+    select_pk_for_encryption(now.as_secs(), public_key).is_some()
 }

 /// Returns true if public key advertises SEIPDv2 feature.
@@ -11,6 +11,7 @@ use crate::{
    test_utils::{TestContext, TestContextManager, alice_keypair, bob_keypair},
    token,
 };
+use chrono::{TimeZone as _, Utc};
 use pgp::composed::{Esk, Message};
 use pgp::packet::PublicKeyEncryptedSessionKey;

@@ -423,3 +424,212 @@ async fn test_securejoin_pqc_joiner() {

    tcm.execute_securejoin(bob, pqc).await;
 }
+
+/// Tests that public subkey selection for encryption respects key flags and prefers expring subkeys.
+///
+/// Non-encryption subkeys such as RSA subkey for authentication are ignored.
+#[test]
+fn test_select_pk_for_encryption() {
+    // Public key generated with GnuPG 2.4.9 with the following subkeys:
+    // 1. Auth-only RSA subkey (92E762B9084CA740).
+    // 2. Expired Curve25519 encryption subkey with 1-day expiration (C8F382BD0F35C49E)
+    // 3. Ed25519 signing subkey (F177AC3118F923CC).
+    // 4. Curve25519 encryption subkey with fingerprint (36188C6FFC8E267B)
+    // 5. Curve25519 encryption subkey with 1 year expiration, valid in the beginning of 2008, with key ID 9223FCEE7546CDE7
+    // 6. Curve25519 encryption subkey with no expiration (FD2C0567967223D8).
+    // Primary key is an Ed25519 not expiring key.
+    // Key 4 is the one that should be selected.
+
+    // Subkey 4 fingerprint.
+    let expected_fallback_fingerprint = "cdeb3ba3999bf7880f0ee1f536188c6ffc8e267b";
+
+    // Subkey 5 fingerprint, should be preferred to fallback when not expired.
+    let expected_expiring_fingerprint = "5133fab157c4a46ca41f6dc39223fcee7546cde7";
+
+    let alice_tpk_asc = "
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMERvfcPBYJKwYBBAHaRw8BAQdAimvPsr7NdJ4dBoFPySwhpTQqoYOoHL3AzfE7
+mGWQOOC0GUFsaWNlIDxhbGljZUBleGFtcGxlLm9yZz6IkAQTFgoAOBYhBCi19Yqv
+ugVVkhyHgicqAms0FFoiBQJG99w8AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
+AAoJECcqAms0FFoiUGEA/3VZMBCoRq0ZpHarzmvzgdZCoL3r3m9en/eZScFzxITx
+AP42Mn27r0SOKwIln0VcPTdAQCk49mBW/EX3CMOlLPU3DLkBjQRG99w8AQwArsYe
+Jkdl6sSM/hfoEw0vgx/RdUBQ6QRYi1uc0UUNlIGy8mlczLFdkD3JF/hGocjPvt45
+XAQoK110zAkZlfpFRqNT1M/IC68Er8rLkYPC4OeFh6W4Iyn17fcUanP0lf8em/jh
+Vffvgy8sFOMdO235lvFA3txNA98s4fHdmU3PScyd1hc3C4M0yP83LnYyWt4X59Xc
+E/Om5Dm458eKCSeYkLI6752W0mXsBxSi3/dLn0XeuNRpgmKxSkm562FHOFaLbKtR
+Y5hobAI9PkNcVgRxZZvWQls5PHTZWjqngF21lKlaLfdqZ/Uae1i2hzZOihgitL43
+Le00qwNBi5hKYMeuDnHaQrLmb+A+0/IAEE4Ub+TkZhzI+2ZP2k1cAT0qZmZi0w+q
+xqP9INk0hY/oZFCnV2wkHN7zvQmVlUIcQ2rmfbafK1yiEL1qeGT96zyjbdXeGPqJ
+3O9h+YIG38JMRJBijsFujUN34Z546zS/kzOPXsz/WlGUMjwu8n5s5uf2TFyFABEB
+AAGIeAQYFgoAIBYhBCi19YqvugVVkhyHgicqAms0FFoiBQJG99w8AhsgAAoJECcq
+Ams0FFoiCOUBAPafRLDpWN9iT4hcCXjESf1Hw5KNVkJpwfzPfu2H9BkMAQCaHhKg
+pq9ywH4pyOHZCPV8P2ywkyn+EsjBC3fG+GBBBbg4BEb33DwSCisGAQQBl1UBBQEB
+B0DfI8AJFT3nWa6ZXLkHSf7W8W7S6AWIO7LAcjoyHwb8CwMBCAeIfgQYFgoAJhYh
+BCi19YqvugVVkhyHgicqAms0FFoiBQJG99w8AhsMBQkAAVGAAAoJECcqAms0FFoi
+U5EA/3G74HRwIMJlNOEW5gkYYV5KJW2qgtMfxHCUjoHvNWU1AQCHt/bLU2aviAiS
+of1R43qojxKUqzzoi8lYRQ+1sYhvB7gzBEb33DwWCSsGAQQB2kcPAQEHQKZXUJ7s
+xqH3kVcMnhasw6DrFMwCxHDdj+qvkg8r/DvtiO8EGBYKACAWIQQotfWKr7oFVZIc
+h4InKgJrNBRaIgUCRvfcPAIbAgCBCRAnKgJrNBRaInYgBBkWCgAdFiEEI8hstnVQ
+9sgylIYg8XesMRj5I8wFAkb33DwACgkQ8XesMRj5I8xo6QEAu4o/TyEZwFcyqZpw
+LEo9vTLCsc7fo0nx0ssiP6FyV5cBAOWal1DznDhsXWCNt+U8UaafXsU2DTV51KaD
+VBOVFo4CyeQBAMirIjXV5PbUV674TNLhYl2s0jTtNz+GKtOjSdZuRm1mAPwPG6ya
+K1b7iMRdBT92gNZMw30LbtcXmttCxpZAwr9lBLg4BEb33DwSCisGAQQBl1UBBQEB
+B0C5fFb4WTHoIoI6ou/31+1N1wn8ghsSkUVzpbtv/aTkegMBCAeIeAQYFgoAIBYh
+BCi19YqvugVVkhyHgicqAms0FFoiBQJG99w8AhsMAAoJECcqAms0FFoi8z8BALPL
+7V0ICLEY5YSUa4lQ2rjiXOcVTlWkG3h4TATPrr08AP9tIAQIE0o50IGdQAcKJoTn
+Lyxnf2wfjZ16vL3JLLjSBrg4BEb33DwSCisGAQQBl1UBBQEBB0DXDrcGrnuLjAUO
+eo/t8MQNOe+ZKYSDPGTkO7iM5IloSAMBCAeIfgQYFgoAJhYhBCi19YqvugVVkhyH
+gicqAms0FFoiBQJG99w8AhsMBQkB4TOAAAoJECcqAms0FFoivQIA/2PcZ1vcImAa
+7ldPY00JkcW6WlSSd6yOIZsVa4TdA1FiAP42gOji+4RrLps2+NX6L1znSc8EJBXo
+RMbND/CZQWXfA7g4BEb33DwSCisGAQQBl1UBBQEBB0BHxCvo5zuygw2XiluYNobx
+7iFJqlmCkjekKyoVFquKHQMBCAeIeAQYFgoAIBYhBCi19YqvugVVkhyHgicqAms0
+FFoiBQJG99w8AhsMAAoJECcqAms0FFoirSMA/0gVP98sPFga+UhQ3uJxJw5bO2Rs
+7hxVk6aPREWgBYg1AQCT7AE8m7j17SP/1fl8OjpxsQQmCJyv2wNcP48OfKGOCA==
+=AXAi
+-----END PGP PUBLIC KEY BLOCK-----
+    ";
+
+    let alice_tpk = SignedPublicKey::from_asc(alice_tpk_asc).unwrap();
+    let now = pgp::types::Timestamp::now();
+    let encryption_subkey = select_pk_for_encryption(now.as_secs(), &alice_tpk).unwrap();
+    assert_eq!(
+        encryption_subkey.fingerprint().to_string().as_str(),
+        expected_fallback_fingerprint
+    );
+
+    // If we pass 1199149200 as the `now` argument, which was in the beginning of 2008,
+    // then the expiring subkey is not yet expired and should be used.
+    let encryption_subkey = select_pk_for_encryption(1199149200, &alice_tpk).unwrap();
+    assert_eq!(
+        encryption_subkey.fingerprint().to_string().as_str(),
+        expected_expiring_fingerprint
+    );
+}
+
+/// Tests that key selection fails if there is only an expired subkey.
+#[test]
+fn test_select_only_expired_subkey() {
+    let alice_tpk_asc = "
+    -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMERvfcPBYJKwYBBAHaRw8BAQdAUz6AZXIRE8T04Vh8RReFiP3tEV8UfSs2EiYs
+8b8i4ce0GUFsaWNlIDxhbGljZUBleGFtcGxlLm9yZz6IkAQTFgoAOBYhBNRG3w/A
+qWyPitBaqkGLyqDx3CaUBQJG99w8AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
+AAoJEEGLyqDx3CaUMjIA/Rq9/iORLP360s6EsIDe9qSmlmSCggtivafH+uVBWa0X
+AP0Wb+kailDwISq2O9Ef/jceZw7ozyzDLeDskKpCYiL3A7g4BEb33DwSCisGAQQB
+l1UBBQEBB0BXhbrks9iskW1GfT3B022W3KhJCgz8gw81z9lAWv7OZgMBCAeIfgQY
+FgoAJhYhBNRG3w/AqWyPitBaqkGLyqDx3CaUBQJG99w8AhsMBQkB4TOAAAoJEEGL
+yqDx3CaU6/YA/jaYJsZMXvu5grrMq1wq3Z/yzGXd15zeWp+alY/6UYxoAQCmSrBC
+SOtE3ODLZN9tC3F7k1N9clme1cHXyUiH3EliBQ==
+=zWPq
+-----END PGP PUBLIC KEY BLOCK-----
+";
+
+    let alice_tpk = SignedPublicKey::from_asc(alice_tpk_asc).unwrap();
+    let now = pgp::types::Timestamp::now();
+
+    assert_eq!(select_pk_for_encryption(now.as_secs(), &alice_tpk), None);
+}
+
+/// Tests that the key with the closest expiration date is selected.
+#[test]
+fn test_expiring_subkey_selection() {
+    // The key has the following keys:
+    // 1. Primary non-expiring Ed25519 key created on 2025-01-01
+    // 2. Non-expiring subkey CE5FC3FD479E41F08069DCE6F6CAD4ADB9AF47F1 created on 2025-01-01
+    // 3. Subkey 10493EF4DBA7EE4D55C826A7634684D9BFEEB890 created on 2026-06-01 and expiring on 2026-07-01
+    // 4. Subkey 477650C13FA4842BAF2831BC41C2D560BE27B38D created on 2026-06-01 and expiring on 2026-06-15
+    // 5. Subkey AB92F4AFD46DDD7D31FB05151BE08A8089F67CA2 created on 2026-06-08 and expiring on 2026-06-22
+    let alice_tpk_asc = "
+    -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEZ3SFgBYJKwYBBAHaRw8BAQdAOrjYsxkYNvVtjbZwvglXk94Rd8S3F0YlIgcQ
+SSp45ni0GUFsaWNlIDxhbGljZUBleGFtcGxlLm9yZz6IkAQTFgoAOBYhBGV3iWZU
+bA6WJh3MR00wvB0X57PiBQJndIWAAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
+AAoJEE0wvB0X57PiAr0A/0qzulPRXZR1+D1fUeW6/C3BRP+8qRZTlOvF0XEnxPOV
+AQD7oePZ/QI6AuDMFmnJ5HQJ6cQSSOp/FwyucD8yiAoABrg4BGd0hYASCisGAQQB
+l1UBBQEBB0DBBk+BdzyTu3Hys6dewzd0L5AFeYMRIOC99XosMBLZYwMBCAeIeAQY
+FgoAIBYhBGV3iWZUbA6WJh3MR00wvB0X57PiBQJndIWAAhsMAAoJEE0wvB0X57Pi
+BxYA+gOtDVtb9p9vVaKyAuYCG7LdJ63Bqu0OtrVxmZEQvHQbAQDJmJX/yOX5QSkh
+cRtM1qoiY7OUjcT8ERnaoAcw2suFBLg4BGocy4ASCisGAQQBl1UBBQEBB0AgEDSA
+muuqS2iyi7aZeV608Xx2qdVqYKjREgiC3cu4YQMBCAeIfgQYFgoAJhYhBGV3iWZU
+bA6WJh3MR00wvB0X57PiBQJqHMuAAhsMBQkAJ40AAAoJEE0wvB0X57Pi9KgA/2vW
+4yNU1EF/WRCKmr87mJtmYR5Xf9Jps54Tv4BexNGgAQDxxx9lKvwW4U9/8UkrSF28
+HrGdWES4wAa9N9HvJzuOD7g4BGocy4ASCisGAQQBl1UBBQEBB0CK1TifDqKtFzks
+4E8gNmF90OkIYVriZxdY3QFSwowILQMBCAeIfgQYFgoAJhYhBGV3iWZUbA6WJh3M
+R00wvB0X57PiBQJqHMuAAhsMBQkAEnUAAAoJEE0wvB0X57PiZ+UA/0+s3fM/8OOb
+8Ft21QMFM/7Ce1P/ovKgkxsYWjk8q7zYAP9HYm/vcWBGzQw08mn3X26UFB9UfCF3
+qc1yyltDEeERDrg4BGomBgASCisGAQQBl1UBBQEBB0AvGvgG8Wkwx/KklkUHdLuC
+UKKSqTp4xsjocWXJs69rSwMBCAeIfgQYFgoAJhYhBGV3iWZUbA6WJh3MR00wvB0X
+57PiBQJqJgYAAhsMBQkAEnUAAAoJEE0wvB0X57PibzQA/A0qT23pcdenNJJ5QZN/
+ecs08p2pbiipv+adPeojVGZIAP47Pyr8Hj0o3qhrEhhFZkIhTxxDxS/jAsq2v4UG
+JGp8Ag==
+=RzZZ
+-----END PGP PUBLIC KEY BLOCK-----
+";
+
+    let alice_tpk = SignedPublicKey::from_asc(alice_tpk_asc).unwrap();
+
+    // Two-week subkey that was generated earlier is selected
+    // because it expires earlier, on 2026-06-15.
+    {
+        let ts = u32::try_from(
+            Utc.with_ymd_and_hms(2026, 6, 9, 0, 0, 0)
+                .unwrap()
+                .timestamp(),
+        )
+        .unwrap();
+        let subkey = select_pk_for_encryption(ts, &alice_tpk).unwrap();
+        assert_eq!(
+            subkey.fingerprint().to_string().as_str(),
+            "477650c13fa4842baf2831bc41c2d560be27b38d",
+        );
+    }
+
+    // Now both 477650C13FA4842BAF2831BC41C2D560BE27B38D expires
+    // and we switch to another subkey that expires on 2026-06-22.
+    {
+        let ts = u32::try_from(
+            Utc.with_ymd_and_hms(2026, 6, 16, 0, 0, 0)
+                .unwrap()
+                .timestamp(),
+        )
+        .unwrap();
+        let subkey = select_pk_for_encryption(ts, &alice_tpk).unwrap();
+        assert_eq!(
+            subkey.fingerprint().to_string().as_str(),
+            "ab92f4afd46ddd7d31fb05151be08a8089f67ca2",
+        );
+    }
+
+    // Now both two-week subkeys have expired and we switch to expiring subkey that expires on 2026-07-01.
+    {
+        let ts = u32::try_from(
+            Utc.with_ymd_and_hms(2026, 6, 23, 0, 0, 0)
+                .unwrap()
+                .timestamp(),
+        )
+        .unwrap();
+        let subkey = select_pk_for_encryption(ts, &alice_tpk).unwrap();
+        assert_eq!(
+            subkey.fingerprint().to_string().as_str(),
+            "10493ef4dba7ee4d55c826a7634684d9bfeeb890",
+        );
+    }
+
+    // All expiring subkeys are expired, switching to non-expiring subkey.
+    {
+        let ts = u32::try_from(
+            Utc.with_ymd_and_hms(2026, 7, 2, 0, 0, 0)
+                .unwrap()
+                .timestamp(),
+        )
+        .unwrap();
+        let subkey = select_pk_for_encryption(ts, &alice_tpk).unwrap();
+        assert_eq!(
+            subkey.fingerprint().to_string().as_str(),
+            "ce5fc3fd479e41f08069dce6f6cad4adb9af47f1",
+        );
+    }
+}
@@ -1032,7 +1032,6 @@ Content-Disposition: reaction\n\
        assert_eq!(summary.timestamp, bob_msg1.get_timestamp()); // time refers to message, not to reaction
        assert_eq!(summary.state, MessageState::InFresh); // state refers to message, not to reaction
        assert!(summary.prefix.is_none());
-        assert!(summary.thumbnail_path.is_none());
        assert_summary(&alice, "BOB reacted 👍 to \"Party?\"").await;

        // Alice reacts to own message as well
@@ -54,6 +54,39 @@ pub(crate) struct Smtp {
    pub(crate) last_send_error: Option<String>,
 }

+/// Returns transports with their IDs in the order in which they should be tried.
+async fn sorted_transports(context: &Context) -> Result<Vec<(u32, ConfiguredLoginParam)>> {
+    context
+        .sql
+        .query_map_vec(
+            "SELECT transports.id, configured_param FROM transports
+             LEFT JOIN smtp_success ON smtp_success.transport_id=transports.id
+             ORDER BY IFNULL(smtp_success.id, 0) DESC, transports.id ASC",
+            (),
+            |row| {
+                let id: u32 = row.get(0)?;
+                let json: String = row.get(1)?;
+                let param = ConfiguredLoginParam::from_json(&json)?;
+                Ok((id, param))
+            },
+        )
+        .await
+}
+
+/// Records successful use of SMTP transport so it is tried first next time we connect to SMTP.
+async fn record_success(context: &Context, transport_id: u32) -> Result<()> {
+    // INSERT OR REPLACE essentially replaces rowid of the row
+    // if the row exists already, so it becomes the highest rowid in the table.
+    context
+        .sql
+        .execute(
+            "INSERT OR REPLACE INTO smtp_success (transport_id) VALUES (?)",
+            (transport_id,),
+        )
+        .await?;
+    Ok(())
+}
+
 impl Smtp {
    /// Create a new Smtp instances.
    pub fn new() -> Self {
@@ -68,6 +101,8 @@ impl Smtp {
            // separate task to avoid waiting for reply or timeout.
            task::spawn(async move { transport.quit().await });
        }
+        self.transport_id = None;
+        self.from = None;
        self.last_success = None;
    }

@@ -99,13 +134,7 @@ impl Smtp {

        self.connectivity.set_connecting(context);
        let proxy_config = ProxyConfig::load(context).await?;
-        let transports = ConfiguredLoginParam::load_all(context).await?;
-
-        // Try to connect to the newest transport first. If sending is unreliable,
-        // user can configure a new transport and it will be the one used.
-        // Conversely, if user just added a new transport and sending got less reliable,
-        // user can restore old state by removing the just added transport.
-        for (transport_id, lp) in transports.into_iter().rev() {
+        for (transport_id, lp) in sorted_transports(context).await? {
            info!(context, "Trying to connect to transport {transport_id}.");
            match self
                .connect(
@@ -325,6 +354,18 @@ pub(crate) async fn smtp_send(
        Ok(()) => SendResult::Success,
    };

+    if matches!(status, SendResult::Success) {
+        debug_assert!(smtp.transport_id.is_some());
+        if let Some(transport_id) = smtp.transport_id
+            && let Err(err) = record_success(context, transport_id).await
+        {
+            warn!(
+                context,
+                "Failed to record successful use of transport {transport_id} in smtp_success table: {err:#}."
+            );
+        }
+    }
+
    if let SendResult::Failure(err) = &status
        && let Some(msg_id) = msg_id
    {
@@ -856,3 +897,6 @@ pub(crate) async fn add_self_recipients(

    Ok(())
 }
+
+#[cfg(test)]
+mod smtp_tests;
@@ -0,0 +1,49 @@
+use anyhow::Result;
+
+use crate::test_utils::TestContextManager;
+use crate::transport;
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_smtp_candidates() -> Result<()> {
+    let mut tcm = TestContextManager::new();
+    let t = &tcm.unconfigured().await;
+
+    transport::add_pseudo_transport(t, "foo@example.net").await?;
+    transport::add_pseudo_transport(t, "bar@example.net").await?;
+    transport::add_pseudo_transport(t, "baz@example.net").await?;
+
+    let transports = super::sorted_transports(t).await?;
+    let [
+        (transport_id1, ref transport1),
+        (transport_id2, ref transport2),
+        (transport_id3, ref transport3),
+    ] = transports[..]
+    else {
+        panic!("Unexpected number of transports");
+    };
+
+    // By default first added transport is used first.
+    assert_eq!(transport1.addr, "foo@example.net");
+    assert_eq!(transport2.addr, "bar@example.net");
+    assert_eq!(transport3.addr, "baz@example.net");
+
+    super::record_success(t, transport_id3).await?;
+    let transports2 = super::sorted_transports(t).await?;
+    assert_eq!(transports2[0].0, transport_id3);
+    assert_eq!(transports2[1].0, transport_id1);
+    assert_eq!(transports2[2].0, transport_id2);
+
+    super::record_success(t, transport_id2).await?;
+    let transports3 = super::sorted_transports(t).await?;
+    assert_eq!(transports3[0].0, transport_id2);
+    assert_eq!(transports3[1].0, transport_id3);
+    assert_eq!(transports3[2].0, transport_id1);
+
+    super::record_success(t, transport_id3).await?;
+    let transports4 = super::sorted_transports(t).await?;
+    assert_eq!(transports4[0].0, transport_id3);
+    assert_eq!(transports4[1].0, transport_id2);
+    assert_eq!(transports4[2].0, transport_id1);
+
+    Ok(())
+}
@@ -2672,6 +2672,21 @@ CREATE TABLE smtp2 (
            .await?;
    }

+    inc_and_check(&mut migration_version, 168)?;
+    if dbversion < migration_version {
+        sql.execute_migration(
+            "
+CREATE TABLE smtp_success (
+    id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+    transport_id INTEGER UNIQUE NOT NULL,
+    FOREIGN KEY(transport_id) REFERENCES transports(id) ON DELETE CASCADE
+) STRICT;
+",
+            migration_version,
+        )
+        .await?;
+    }
+
    let new_version = sql
        .get_raw_config_int(VERSION_CFG)
        .await?
@@ -56,9 +56,6 @@ pub struct Summary {

    /// Message state.
    pub state: MessageState,
-
-    /// Message preview image path
-    pub thumbnail_path: Option<String>,
 }

 impl Summary {
@@ -83,7 +80,6 @@ impl Summary {
                text: msg_reacted(context, reaction_contact_id, &reaction, &summary).await,
                timestamp: msg.get_timestamp(), // message timestamp (not reaction) to make timestamps more consistent with chats ordering
                state: msg.state, // message state (not reaction) - indicating if it was me sending the last message
-                thumbnail_path: None,
            });
        }
        Self::new(context, msg, chat, contact).await
@@ -127,24 +123,11 @@ impl Summary {
            text = stock_str::reply_noun(context)
        }

-        let thumbnail_path = if msg.viewtype == Viewtype::Image
-            || msg.viewtype == Viewtype::Gif
-            || msg.viewtype == Viewtype::Sticker
-        {
-            msg.get_file(context)
-                .and_then(|path| path.to_str().map(|p| p.to_owned()))
-        } else if msg.viewtype == Viewtype::Webxdc {
-            Some("webxdc-icon://last-msg-id".to_string())
-        } else {
-            None
-        };
-
        Ok(Summary {
            prefix,
            text,
            timestamp: msg.get_timestamp(),
            state: msg.state,
-            thumbnail_path,
        })
    }

@@ -1664,7 +1664,6 @@ async fn test_webxdc_chatlist_summary() -> Result<()> {
    assert_eq!(chatlist.len(), 1);
    let summary = chatlist.get_summary(&t, 0, None).await?;
    assert_eq!(summary.text, "📱 nice app!".to_string());
-    assert_eq!(summary.thumbnail_path.unwrap(), "webxdc-icon://last-msg-id");

    Ok(())
 }
Author	SHA1	Message	Date
link2xt	2fe1d35193	feat: take key flags and expiration into account when selecting the key Test keys were generated with GnuPG 2.4.9 from Arch Linux. The script that was used to generate the key for test_select_pk_for_encryption: ``` export GNUPGHOME="$PWD/gnupghome" rm -fr "$GNUPGHOME" mkdir -p "$GNUPGHOME" chmod 700 "$GNUPGHOME" # --faked-system-time example is from the gpg man page GPG="gpg --batch --quiet --faked-system-time 20070924T154812" USERID='Alice <alice@example.org>' # Generate the primary key. # "default" means certification+signing primary key # "never" to make the key not expire, otherwise gpg generates expiring key by default. $GPG --passphrase '' --quick-generate-key "$USERID" ed25519 default never # --quick-add-key requires that keys are referred to by the fingerprint. # Output of --with-colons is described in /usr/share/doc/gnupg/DETAILS FINGERPRINT="$($GPG --list-secret-keys --with-colons \| awk -F: '$1 == "fpr" { print $10 }')" # Authentication-only RSA key, should not be used for encryption. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" rsa auth never # Expired (considering the fake date) subkey. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr 1d # Signing subkey. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" ed25519 sign never # Usable encryption subkey. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr never # Expiring subkey that is not expired in the beginning of 2008. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr 1y # Another encryption subkey that should not be used because the first one is preferred. $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr never $GPG --armor --export "$FINGERPRINT" > alice.tpk.asc ``` Key for test_select_only_expired_subkey was generated with: ``` #!/bin/sh set -e export GNUPGHOME="$PWD/gnupghome" rm -fr "$GNUPGHOME" mkdir -p "$GNUPGHOME" chmod 700 "$GNUPGHOME" GPG="gpg --batch --quiet --faked-system-time 20070924T154812" USERID='Alice <alice@example.org>' $GPG --passphrase '' --quick-generate-key "$USERID" ed25519 default never FINGERPRINT="$($GPG --list-secret-keys --with-colons \| awk -F: '$1 == "fpr" { print $10 }')" $GPG --passphrase '' --quick-add-key "$FINGERPRINT" cv25519 encr 1y $GPG --armor --export "$FINGERPRINT" > alice.tpk.asc ``` Key for test_expiring_subkey_selection was generated with: ``` #!/bin/sh set -e export GNUPGHOME="$PWD/gnupghome" rm -fr "$GNUPGHOME" mkdir -p "$GNUPGHOME" chmod 700 "$GNUPGHOME" GPG="gpg --batch --quiet" USERID='Alice <alice@example.org>' $GPG --passphrase '' --faked-system-time 20250101T000000 --quick-generate-key "$USERID" ed25519 default never FINGERPRINT="$($GPG --list-secret-keys --with-colons \| awk -F: '$1 == "fpr" { print $10 }')" $GPG --passphrase '' --faked-system-time 20250101T000000 --quick-add-key "$FINGERPRINT" cv25519 encr never $GPG --passphrase '' --faked-system-time 20260601T000000 --quick-add-key "$FINGERPRINT" cv25519 encr 1m $GPG --passphrase '' --faked-system-time 20260601T000000 --quick-add-key "$FINGERPRINT" cv25519 encr 2w $GPG --passphrase '' --faked-system-time 20260608T000000 --quick-add-key "$FINGERPRINT" cv25519 encr 2w $GPG --armor --export "$FINGERPRINT" > alice.tpk.asc ```	2026-10-08 16:58:11 +00:00
link2xt	afec5a139b	refactor: remove Context argument from secret_key_to_public_key()	2026-10-07 19:23:41 +00:00
biørn	0bee156449	api! remove unused `dc_chatlist_get_summary2()` (#8812 ) `dc_chatlist_get_summary2()` was introduced for desktop that time, but then replaced by jsonrpc's `get_chat_list_item_by_id()`. outside desktop, the cffi function seems to be never used in the past nor is today. @adbenitez @Amzd - can you confirm it is not used? similar for `summaryPreviewImage` - that was used on desktop, and is now unused member of jsonrpc's ChatListItemFetchResult. question here: i assume that it is fine to remove the member, and that desktop (maybe after rebuilding) is fine with that. @WofWca @nicodh - can you confirm, desktop is fine with the removal of the member? for general cleanup, in an anyway complex area, it makes sense to remove these APIs.	2026-10-07 17:32:42 +02:00
link2xt	9ce20d7763	chore: update rPGP from 0.20.0 to 0.21.0 Main updates are security fix (fixed panic on short session keys) and stabilized PQC (feature renamed from "draft-pqc" to "pqc").	2026-10-07 14:26:09 +00:00
holger krekel	d7376e32b2	refactor: reduce macro-generated lines by >70%, and drop tracing Every `info!`, `warn!` and `error!` call expanded a complete `tracing::event!` to mirror its message into `tracing` (#6919), and that mirror made up most of core's macro output, now removed: it's down from 219k to 54k lines using RUSTC_BOOTSTRAP=1 cargo rustc -p deltachat --lib \ --profile check -- -Zmacro-stats A warm build and `touch src/lib.rs` with rustc 1.99.0, CARGO_INCREMENTAL=0 RUSTC_WRAPPER= /usr/bin/time -v \ cargo check -p deltachat takes about a third less time and 0.37 GiB less peak memory, `cargo build -p deltachat` about a tenth less time and 0.36 GiB less. The release binary from `nix build .#deltachat-rpc-server-x86_64-linux` gets 2.7% smaller. If we want to use tracing events to integrate better with iroh-debugging, for example when we move to iroh 1.X, we could introduce some iroh-relevant tracing events in core.	2026-10-06 23:52:19 +02:00
holger krekel	6378533b6a	ci: speedup lint job and the Rust test builds Since #8350 (2026-09-09) deltachat-jsonrpc-bindings build-depends on deltachat-jsonrpc, so clippy, nextest and the doctests, which select the whole workspace, compiled core and its whole dependency tree a second time for the host. The lint job also checked every dependency twice, once per panic strategy, and repeated clippy's checks in a separate all-features `cargo check`. With a warm cache on 4 CPUs on my machine, the lint job drops from 150 to 60 seconds and the tests build from 100 to 75 seconds. Peak memory falls for lint from 5.1 to 3.5 GiB and for tests 7.5 to 5.4 GiB.	2026-10-06 21:17:34 +02:00
link2xt	1451478911	feat: connect to the most recently successfully used SMTP transport first When connecting to SMTP, transports are now tried from the most recently successfully used transport to the least recently used. Transports that were never used for sending are tried in the order of increasing ID because init_transports() tries to select the fastest transport for the first one. This solves the problem of having to wait for timeout each time if the first tried transport is down.	2026-10-06 16:54:09 +00:00
link2xt	8468f5b5dd	ci: update Rust to 1.99.0	2026-10-03 16:49:16 +00:00
link2xt	dbba555a63	chore: update astral-tokio-tar from 0.6.4 to 0.7.0	2026-10-03 16:46:40 +00:00
link2xt	8cedea1958	fix(deltachat-rpc-client): shutdown all threads after RPC server crash RPC server subprocess may exit for various reasons, e.g. because of panic or because of debug_assert! during testing, or because the process is killed manually or by OOM killer. We still want to shutdown all threads cleanly in this case and not fail in Rpc.close(). Otherwise Python process cannot exit as it waits forever for all threads to terminate. Without the fix, when added test is run in pytest, pytest prints "ERROR at teardown of test_shutdown" and gets stuck. When pytest is manually terminated with ^C, the following error is printed: ``` Exception ignored while joining a thread in _thread._shutdown(): Traceback (most recent call last): File "/usr/lib/python3.14/threading.py", line 1583, in _shutdown _thread_shutdown() KeyboardInterrupt: ``` _thread_shutdown() is the function waiting for all non-daemon threads to finish.	2026-10-03 16:46:12 +00:00
Hocuri	70730490b2	fix: In SMTP loop, reset `transport_id` and `from` when disconnecting (#8797 ) Previously, when we disconnected from the current transport, we forgot to reset the `transport_id` and `from`. I couldn't find any bug that is caused by this today, but it was a lingering problem.	2026-10-02 19:04:18 +00:00