From 9fe72921afcf0194dfd496d292e2c0355282407e Mon Sep 17 00:00:00 2001
From: Mikhail Novosyolov <m.novosyolov@rosa.ru>
Date: Fri, 11 Sep 2026 20:18:14 +0300
Subject: [PATCH 1/2] Fix build with GCC >= 10: declare globals extern in
 email.h

GCC 10+ defaults to -fno-common, so the tentative definitions of
table, conf_file and Mopts in email.h (included by every .c file)
now collide at link time ("multiple definition of ...").

Declare them extern in the header and define them once in email.c.

Co-authored-by: Z.AI GLM <glm@z.ai>
---
 include/email.h | 10 ++++++----
 src/email.c     |  5 +++++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/include/email.h b/include/email.h
index 5800265..a8ec3e2 100644
--- a/include/email.h
+++ b/include/email.h
@@ -60,9 +60,9 @@ struct addr {
 typedef enum { GPG_SIG=0x01, GPG_ENC=0x02 } GpgCallType;
 
 
-/* Globally defined vars */
-dhash table;
-char *conf_file;
+/* Globally defined vars (defined in email.c) */
+extern dhash table;
+extern char *conf_file;
 
 struct mailer_options {
 	bool verbose;
@@ -78,7 +78,9 @@ struct mailer_options {
 	dlist to;
 	dlist cc;
 	dlist bcc;
-} Mopts;
+};
+
+extern struct mailer_options Mopts;
 
 void usage(void);
 
diff --git a/src/email.c b/src/email.c
index 524e9be..d62f65d 100644
--- a/src/email.c
+++ b/src/email.c
@@ -40,6 +40,11 @@
 #include "error.h"
 #include "mimeutils.h"
 
+/* Global variables declared in email.h */
+dhash table;
+char *conf_file;
+struct mailer_options Mopts;
+
 static void
 defaultDestr(void *ptr)
 {

From 55b784c9892b916fb22a553c4fda83c13cd6c156 Mon Sep 17 00:00:00 2001
From: Mikhail Novosyolov <m.novosyolov@rosa.ru>
Date: Fri, 11 Sep 2026 20:18:14 +0300
Subject: [PATCH 2/2] Abort when the TLS upgrade fails after STARTTLS

dnetUseTls() can fail (e.g. SSL_CTX_new() error on OpenSSL 3.x, or a
failed handshake), and its return value was ignored.  The code then
sent EHLO in plaintext right after STARTTLS, the server dropped the
connection, and the user saw a confusing "Lost connection with SMTP
server" instead of the real TLS error.

Check the return value and report the OpenSSL error text via
dnetGetErr() before aborting the send.

Co-authored-by: Z.AI GLM <glm@z.ai>
---
 src/processmail.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/processmail.c b/src/processmail.c
index 88f708d..e4e8b9c 100644
--- a/src/processmail.c
+++ b/src/processmail.c
@@ -173,7 +173,12 @@ processRemote(const char *smtp_serv, int smtp_port, dstrbuf *msg)
 #endif
 	if (use_tls && strcasecmp(use_tls, "true") == 0) {
 		if (smtpStartTls(sd) != ERROR) {
-			dnetUseTls(sd);
+			if (dnetUseTls(sd) == ERROR) {
+				fatal("Could not establish TLS connection: %s\n",
+					dnetGetErr(sd));
+				retval = ERROR;
+				goto end;
+			}
 			dnetVerifyCert(sd);
 			if (smtpInitAfterTLS(sd, nodename) == ERROR) {
 				printSmtpError();