| To: users, dev, announce |
| Subject: ANNOUNCE: Apache SpamAssassin 3.4.2 available |
| |
| Release Notes -- Apache SpamAssassin -- Version 3.4.2 |
| |
| Introduction |
| ------------ |
| |
| Apache SpamAssassin 3.4.2 contains numerous tweaks and bug fixes over the |
| past three and 1/2 years. As we release 3.4.2, we are preparing 4.0.0 which |
| will move us into a full UTF-8 environment. We expect one final 3.4.3 |
| release. |
| |
| As with any release there are a number of functional patches, improvements as |
| well as security reasons to upgrade to 3.4.2. In this case we have over 3 |
| years of issues being resolved at once. And we are laying thr groundwork for |
| version 4.0 which is is designed to more natively handle UTF-8. |
| |
| However, there is one specific pressing reason to upgrade. Specifically, we |
| will stop producing SHA-1 signatures for rule updates. This means that while |
| we produce rule updates with the focus on them working for any release from |
| v3.3.2 forward, they will start failing SHA-1 validation for sa-update. |
| |
| *** If you do not update to 3.4.2, you will be stuck at the last ruleset |
| with SHA-1 signatures in the near future. *** |
| |
| Many thanks to the committers, contributors, rule testers, mass checkers, |
| and code testers who have made this release possible. |
| |
| Thanks to David Jones for stepping up and helping us found our SpamAssassin |
| SysAdmin's group. |
| |
| And thanks to cPanel for helping making this release possible and contributing |
| to the continued development of SpamAssassin. Please visit support.cpanel.net |
| with any issues involving cPanel & WHM's integration with SpamAssassin. |
| |
| Notable features: |
| ================= |
| |
| New plugins |
| ----------- |
| There are four new plugins added with this release: |
| |
| Mail::SpamAssassin::Plugin::HashBL |
| |
| The HashBL plugin is the interface to The Email Blocklist (EBL). |
| The EBL is intended to filter spam that is sent from IP addresses |
| and domains that cannot be blocked without causing significant |
| numbers of false positives. |
| |
| Mail::SpamAssassin::Plugin::ResourceLimits |
| |
| This plugin leverages BSD::Resource to assure your spamd child processes |
| do not exceed specified CPU or memory limit. If this happens, the child |
| process will die. See the BSD::Resource for more details. |
| |
| Mail::SpamAssassin::Plugin::FromNameSpoof |
| |
| This plugin allows for detection of the From:name field being used to mislead |
| recipients into thinking an email is from another address. The man page |
| includes examples and we expect to put test rules for this plugin into |
| rulesrc soon! |
| |
| Mail::SpamAssassin::Plugin::Phishing |
| |
| This plugin finds uris used in phishing campaigns detected by |
| OpenPhish (https://openphish.com) or PhishTank (https://phishtank.com) feeds. |
| |
| These plugins are disabled by default. To enable, uncomment |
| the loadplugin configuration options in file v342.pre, or add it to |
| some local .pre file such as local.pre . |
| |
| Notable changes |
| --------------- |
| |
| For security reasons SSLv3 support has been removed from spamc(1). |
| |
| The spamd(1) daemon now is faster to start, thanks to code optimizations. |
| |
| Four CVE security bug fixes are included in this release for PDFInfo.pm and |
| the SA core: |
| CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 |
| |
| In sa-update script, optional support for SHA-256 / SHA-512 in addition |
| to or instead of SHA1 has been added for better validation of rules. |
| See https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7614 for information |
| on the end of SHA-1 signatures which will be the end of rule updates for |
| releases prior to 3.4.2. |
| |
| Security updates include security improvements for TxRep, tmp file creation |
| was hardened, the group list and setuid is hardened for spamd workers, |
| eval tests have been hardened (Thanks to the cPanel Security Team!), |
| a bug in earlier Perl versions that caused URIs to be skipped has been |
| identified, and UTF-16 support is improved. |
| |
| GeoIP2 support has been added to RelayCountry and URILocalBL plugins due |
| to GeoIP legacy API deprecations. |
| |
| New configuration options |
| ------------------------- |
| |
| A new template tag _DKIMSELECTOR_ that maps to the DKIM selector (the 's' tag) |
| from valid signatures has been added. |
| |
| A 'uri_block_cont' option to URILocalBL plugin to score uris per continent has been added. |
| Possible continent codes are: |
| af, as, eu, na, oc, sa for Africa, Asia, Europe, North America, |
| Oceania and South America. |
| |
| The 'country_db_type' and 'country_db_path' options has been added to be able |
| to choose in RelayCountry plugin between GeoIP legacy |
| (discontinued from 04/01/2018), GeoIP2, IP::Country::Fast |
| and IP::Country::DB_File. |
| GeoIP legacy is still the default option but it will be deprecated |
| in future releases. |
| |
| A config option 'uri_country_db_path' has been added to be able to choose |
| in URILocalBL plugin between GeoIP legacy and new GeoIP2 api. |
| |
| A config option 'resource_limit_cpu' (default: 0 or no limit) has been added |
| to configure how many cpu cycles are allowed on a child process before it dies. |
| |
| A config option 'resource_limit_mem' (default: 0 or no limit) has been added |
| to configure the maximum number of bytes of memory allowed both for |
| (virtual) address space bytes and resident set size. |
| |
| A new config option 'report_wrap_width' (default: 70) has been added |
| to set the wrap width for description lines in the X-Spam-Report header. |
| |
| Notable Internal changes |
| ------------------------ |
| |
| SpamAssassin can cope with new Net::DNS module versions. |
| The "bytes" pragma has been remove from both core modules and plugins for |
| better utf-8 compatibility, there has been also some other utf-8 related fixes. |
| The spamc(1) client can now be build against OpenSSL 1.1.0. |
| The test framework has been switched to Test::More module. |
| |
| Other updates |
| ------------- |
| |
| Documentation was updated or enhanced. Project's testing and evaluation |
| hosts and tools running on the ASF infrastructure were updated. |
| |
| A list of top-level domains in registrar boundaries was updated. |
| |
| Optimizations |
| ------------- |
| |
| Faster startup of the SpamAssassin daemon. |
| Spamc client now correctly free(3) all the memory it uses. |
| |
| Downloading and availability |
| ---------------------------- |
| |
| Downloads are available from: |
| |
| https://spamassassin.apache.org/downloads.cgi |
| |
| sha256sum of archive files: |
| |
| cf03045a4991752145eed007e75737f3e4c7f34cf225db411ce3fd359280e8da Mail-SpamAssassin-3.4.2.tar.bz2 |
| 8a1c139ee08f140d3d3fdf13e03d98cf68a5cae27a082c4a614d154565a3c34f Mail-SpamAssassin-3.4.2.tar.gz |
| c76841929fa53cf0adeb924797195c66da207ab6739553fd62634f94f2dcd875 Mail-SpamAssassin-3.4.2.zip |
| 8d481a2081f1e62a2579238f66b58d2124f7a2e9f3cfa3d4aa2b03fe7b0199bb Mail-SpamAssassin-rules-3.4.2.r1840640.tgz |
| |
| sha512sum of archive files: |
| |
| fe3d9d1d7b9fed3063549afd071066729f1f4d998be91ded1e5afc29bb37c7a298dc5f8f99a282b75435d317b5b5072a81393134ccfe059a73d953e26a9c3885 Mail-SpamAssassin-3.4.2.tar.bz2 |
| 85e3d78bb885ad1d0bf2066d1bc919d6ad5e9f86795069397e7c28cc1ba02870566ec014c08c81f68e7ed03b7f60d2de0b9730b3415b35d848abde2c8920a28f Mail-SpamAssassin-3.4.2.tar.gz |
| 9545c1cd55c31f23ba8f8421f78306657a068004a27cab8cd094eb9bc7c8d94cdb4803089318f2c0cefb9b817fa3f1cfb7cb817913027c0c93b5d639937ee05c Mail-SpamAssassin-3.4.2.zip |
| 38b5f4dc6e6776937e787123c265ecd9a0a2f60aca1b57d6ed4a8f78cf81550478eddd0829b1255e9e8ce64421e06cc13ae82f1a597e893b65f0d07ba8c53a7f Mail-SpamAssassin-rules-3.4.2.r1840640.tgz |
| |
| Note that the *-rules-*.tgz files are only necessary if you cannot, |
| or do not wish to, run "sa-update" after install to download the latest |
| fresh rules. |
| |
| See the INSTALL and UPGRADE files in the distribution for important |
| installation notes. |
| |
| |
| GPG Verification Procedure |
| -------------------------- |
| The release files also have a .asc accompanying them. The file serves |
| as an external GPG signature for the given release file. The signing |
| key is available via the wwwkeys.pgp.net key server, as well as |
| https://www.apache.org/dist/spamassassin/KEYS |
| |
| The key information is: |
| |
| pub 4096R/F7D39814 2009-12-02 |
| Key fingerprint = D809 9BC7 9E17 D7E4 9BC2 1E31 FDE5 2F40 F7D3 9814 |
| uid SpamAssassin Project Management Committee <private@spamassassin.apache.org> |
| uid SpamAssassin Signing Key (Code Signing Key, replacement for 1024D/265FA05B) <dev@spamassassin.apache.org> |
| sub 4096R/7B3265A5 2009-12-02 |
| |
| To verify a release file, download the file with the accompanying .asc |
| file and run the following commands: |
| |
| gpg --verbose --keyserver wwwkeys.pgp.net --recv-key F7D39814 |
| gpg --verify Mail-SpamAssassin-3.4.1.tar.bz2.asc |
| gpg --fingerprint F7D39814 |
| |
| Then verify that the key matches the signature. |
| |
| Note that older versions of gnupg may not be able to complete the steps |
| above. Specifically, GnuPG v1.0.6, 1.0.7 & 1.2.6 failed while v1.4.11 |
| worked flawlessly. |
| |
| See https://www.apache.org/info/verification.html for more information |
| on verifying Apache releases. |
| |
| |
| About Apache SpamAssassin |
| ------------------------- |
| |
| Apache SpamAssassin is a mature, widely-deployed open source project |
| that serves as a mail filter to identify spam. SpamAssassin uses a |
| variety of mechanisms including mail header and text analysis, Bayesian |
| filtering, DNS blocklists, and collaborative filtering databases. In |
| addition, Apache SpamAssassin has a modular architecture that allows |
| other technologies to be quickly incorporated as an addition or as a |
| replacement for existing methods. |
| |
| Apache SpamAssassin typically runs on a server, classifies and labels |
| spam before it reaches your mailbox, while allowing other components of |
| a mail system to act on its results. |
| |
| Most of the Apache SpamAssassin is written in Perl, with heavily |
| traversed code paths carefully optimized. Benefits are portability, |
| robustness and facilitated maintenance. It can run on a wide variety of |
| POSIX platforms. |
| |
| The server and the Perl library feels at home on Unix and Linux platforms |
| and reportedly also works on MS Windows systems under ActivePerl. |
| |
| For more information, visit https://spamassassin.apache.org/ |
| |
| |
| About The Apache Software Foundation |
| ------------------------------------ |
| |
| Established in 1999, The Apache Software Foundation provides |
| organizational, legal, and financial support for more than 100 |
| freely-available, collaboratively-developed Open Source projects. The |
| pragmatic Apache License enables individual and commercial users to |
| easily deploy Apache software; the Foundation's intellectual property |
| framework limits the legal exposure of its 2,500+ contributors. |
| |
| For more information, visit https://www.apache.org/ |
