debian bug mail will not appear on mailing lists if sender is not known to Launchpad

[Matthias Klose]

Since a while, debian bug mail isn't accepted anymore on ppa mailing lists, seen for the openjdk team.

This is a regression for some time now.

https://lists.launchpad.net/openjdk/
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=638548

[Deryck Hodge (deryck)]

Thanks for the bug report, doko.

Can you point me at a mail in the archive that represents the kind of mail you used to get but now are not getting? The mailing list itself shouldn't ever have been able to get mail from debbugs. I wonder if this is via a bug watch and we've messed up the sending of bug watch mail.

At any rate, point me a sample mail from the past that was good, and I can likely figure out if this is really a bug, and if so, how to triage it.

Cheers,
deryck

[Matthias Klose (doko)]

On 08/31/2011 05:25 PM, Deryck Hodge wrote:
> Thanks for the bug report, doko.
>
> Can you point me at a mail in the archive that represents the kind of
> mail you used to get but now are not getting?

I did. See the Debian bug in the original report. This one didn't show up on the
launchpad list.

> The mailing list itself
> shouldn't ever have been able to get mail from debbugs. I wonder if
> this is via a bug watch and we've messed up the sending of bug watch
> mail.

The mailing list is used in the maintainer field of the package. So why
shouldn't it get email from debbugs?

> At any rate, point me a sample mail from the past that was good, and I
> can likely figure out if this is really a bug, and if so, how to triage
> it.

[Deryck Hodge (deryck)]

The mailing list doesn't accept mail from non-subscribers except when it's LP sending the mail and the mailing list is a contact for a team. So I don't see how debbugs could have ever sent mail to the list.

And sorry I wasn't clear.... I'd like to see a link to an email in the Launchpad mailing list archive or a copy of an email as received by the list, just to work out how the emails were getting through originally. Not just a link to an email that should have made it through.

Thanks!

[Matthias Klose (doko)]

On 08/31/2011 06:44 PM, Deryck Hodge wrote:
> The mailing list doesn't accept mail from non-subscribers except when
> it's LP sending the mail and the mailing list is a contact for a team.
> So I don't see how debbugs could have ever sent mail to the list.

so how do you explain this one?
https://lists.launchpad.net/openjdk/msg06392.html

> And sorry I wasn't clear.... I'd like to see a link to an email in the
> Launchpad mailing list archive or a copy of an email as received by the
> list, just to work out how the emails were getting through originally.
> Not just a link to an email that should have made it through.

ok, the above one.

[Deryck Hodge (deryck)]

So it took me some time to work out what was happening. The issue is that people send mail to the Debian bug tracker and if we know about the sender in Launchpad we will allow the mail through to a mailing list for moderation, when the mailing list is a contact for the Debian bug tracker. When we don't know about the sender in LP we discard the email. This has always worked this way, and it's really just luck of the sender that email got through to doko's list before.

barry confirmed this on IRC with:

barry> if the email is from an address that is not validated with launchpad, the message is summarily discarded. if the address is validated, but the person is not a member of the team, the message is held for approval (iirc, on the +moderate page or somesuch). once such a message is approved for the list, all subsequent postings by that address will be allowed. if they get three such approvals launchpad-wide, then they can post to any list
<barry> without being held

So I don't think this is a bug. But I recognize that this is not optimal for people wishing to use Launchpad mailing lists as contact addresses in the Debian bug tracker. I'm not sure if we want to change this, but will preserve the bug to track the issue.

[Barry Warsaw (barry)]

There are several possible ways to improve the collaboration between LP and BTS here. The simplest (from an implementation standpoint) would be to just allow any message with this header:

Resent-sender: Debian BTS

which doko says the BTS uses. The problem with that is that it opens up a huge hole that spammers could exploit. You could mitigate that for the majority of mailing lists by making it a configuration option, defaulted to off. For the few lists that are used as BTS contacts, you'd accept the possibility of more spam, in exchange for allowing BTS generated email. Of course, if the BTS signed its messages, or used SPF/DKIM or some other standard signing technology, we could build that into our validation rules. The different approaches might require coordination with IS though (e.g. to configure our Exim to check SPF).

Another thought is to build a backdoor into LP's Mailman instance - or even LP itself - for posting messages that only the BTS could use. I can think of several ways to make that work, e.g. an XMLRPC interface that is locked down except from the BTS IP address, or some shared secret, etc. Each of those would require some coordination with the BTS maintainers, but OTOH I think it's a great idea to get BTS and LP working better together.

[Barry Warsaw (barry)]

I'm not sure it's appropriate to dup this to bug 772000. The scope of this request is much narrower than 772000. Here, we just want to allow BTS to email mailing lists.