jcoffey-dev
17426f6d60
The server fetched upstream's latest published rules from GitHub at run time: a version nobody here tested, code-like expressions from an account we don't control, and the upstream name as a default in the admin form. The published rules of spam-filter v3.0.2 are now embedded (resources/spam-filter/, MIT, in THIRD-PARTY.md) and used whenever no other source is configured. An empty setting and upstream's old default both mean the bundled rules, so existing installs switch without a settings change; the URL stays an operator override (https:// or file://). The schema default is dropped and its description says what empty means, and the strip's rename pass does the same to each import. Rules load on first boot as before, and again whenever the bundled version differs from the last one loaded, which only adds missing rules and tags. That brings the AI classifier's LLM_* scores to installs that predate them: production has none today. upstream-watch now also opens an issue when spam-filter publishes a newer release; resources/spam-filter/README.md says how to take it. The antispam test now runs on the bundled rules, the path production takes; SPAM_RULES_URL tests another set. Unit tests cover the URL handling and that the bundled rules parse and score the AI tags as the AI spec says.
1.5 KiB
Bundled spam filter rules
spam-filter-rules.json.gz is the published rules file of
spam-filter v3.0.2,
unmodified. The server embeds it (crates/common/src/manager/spam_rules.rs)
and loads it whenever no other rules source is configured, so a release
scores mail with the rules it was tested with, offline and with nothing to
fetch. The rules URL setting stays an operator override.
The rules are dual-licensed MIT or Apache-2.0, Copyright (C) 2024, Stalwart
Labs LLC; the fork takes them under MIT, with the notice in THIRD-PARTY.md.
They include the scores for the AI classifier's tags (LLM_*, 3.0 for the
high-confidence spam categories, −3.0 for legitimate), which match
docs/spec/features/ai-spam-classification.md.
Updating
The upstream-watch workflow opens an issue when spam-filter publishes a
newer release. To take it:
- Download
spam-filter-rules.json.gzfrom that release, pinned by tag (releases/download/vX.Y.Z/…, notlatest), over this file. - Set
BUNDLED_SPAM_RULES_VERSIONinspam_rules.rsand the version in this README and inTHIRD-PARTY.md. - Run the antispam test (
STORE=RocksDb RUST_MIN_STACK=16777216 cargo test -p tests --lib -- smtp::inbound::antispam::antispam --exact) and fix expectations the new rules change, knowingly.
On the next start each server loads the new version once. Loading only adds rules and tags that are missing; it never changes an existing one, so an operator's own adjustments survive.