3 Commits

Include renames

Author	SHA1	Message	Date
jcoffey-dev	17426f6d60	Bundle the spam filter rules with the server ... The server fetched upstream's latest published rules from GitHub at run time: a version nobody here tested, code-like expressions from an account we don't control, and the upstream name as a default in the admin form. The published rules of spam-filter v3.0.2 are now embedded (resources/spam-filter/, MIT, in THIRD-PARTY.md) and used whenever no other source is configured. An empty setting and upstream's old default both mean the bundled rules, so existing installs switch without a settings change; the URL stays an operator override (https:// or file://). The schema default is dropped and its description says what empty means, and the strip's rename pass does the same to each import. Rules load on first boot as before, and again whenever the bundled version differs from the last one loaded, which only adds missing rules and tags. That brings the AI classifier's LLM_* scores to installs that predate them: production has none today. upstream-watch now also opens an issue when spam-filter publishes a newer release; resources/spam-filter/README.md says how to take it. The antispam test now runs on the bundled rules, the path production takes; SPAM_RULES_URL tests another set. Unit tests cover the URL handling and that the bundled rules parse and score the AI tags as the AI spec says.	2026-09-22 22:01:30 -07:00
jcoffey-dev	f32992ca36	Fix the antispam test: pin the rules it scores against, stop live Pyzor ... It failed everywhere but upstream's machines, for two reasons: - The spam rules, which carry every score, came from a path on an upstream developer's own disk. Without SPAM_RULES_URL none loaded, every score was 0.00 and the combined case came out ham instead of spam at 13.70. The published rules of spam-filter v3.0.2 are now pinned beside the test cases (Apache-2.0 or MIT, taken as MIT; in THIRD-PARTY.md). SPAM_RULES_URL still overrides. - The first combined case expects a Pyzor hit, and its digest (that of an empty body) wasn't among the three the test mode answers, so it went to a public Pyzor server: it failed offline and would drift with that server's counts. Test mode now answers every digest from a fixed table, with the empty body's added, and never reaches the network. The test passes online and offline, alone and with the rest of the SMTP tests. queue_retry, unrelated, still fails when it runs after the others in one process, though it passes alone every time.	2026-09-22 20:22:29 -07:00
jcoffey-dev	9f444d2458	Fork tooling: the third-party code upstream carries, listed and checked ... A few of upstream's dual-licensed files carry code from other projects under MIT or BSD terms. The fork redistributes it, so their licenses require the notices to travel with it. THIRD-PARTY.md reproduces them. strip.py now reads the stripped tree's comments for another copyright holder, another license, or a note that code came from somewhere else, and names any file THIRD-PARTY.md doesn't cover. It reports, never fails: the notice goes in with the merge that brings the release in. On v0.16.22 it finds 14 files, all of them covered. The rest of the report is byte-for-byte what the committed one says, so the scan disturbs nothing it already did.	2026-09-19 16:59:36 -07:00