MAS-WP-0004: Postfix integration profile, corpus probe in pytest, Exim notes

Profile in integrations/postfix (install.sh + README), now used by the
live deployment. Probe runs every conformance-corpus local-part and the
relay negatives against it; tests/test_postfix_profile.py runs it where
Docker is available.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5787@bnt-lap001
Assistant-Session: 5db26b82-138b-40cc-9856-4d5eb0f752fd
This commit is contained in:
tegwick 2026-10-19 09:25:03 +02:00
parent 082d4c39eb
commit d766d61e7f
12 changed files with 1029 additions and 98 deletions

View file

@ -7,14 +7,20 @@ probe can tell whether Postfix rewrote anything.
```bash
docker build -t mas-postfix-probe experiments/postfix-probe
python3 experiments/postfix-probe/probe.py --profile mas-profile --corpus # the shipped profile
python3 experiments/postfix-probe/probe.py --profile defaults # relay domain
python3 experiments/postfix-probe/probe.py --profile local-domain # domain in mydestination
python3 experiments/postfix-probe/probe.py --profile local-domain-safe # + swap_bangpath/percent_hack off
```
The other profiles are `defaults-local` and `mas-safe-local`. The repo is
mounted read-only. In `results/` a `=` mark means the address arrived
unchanged and `!` means it was rewritten. Findings are in
`mas-profile` runs the shipped integration profile
(`integrations/postfix/`) with `--corpus` (every conformance-corpus
local-part), plus relay attempts that must be refused. `pytest` runs it as
`tests/test_postfix_profile.py` when Docker is available. The other
experiment profiles are `defaults-local` and `mas-safe-local`. The repo is
mounted read-only. In the output, `=` means the address arrived unchanged,
`~` means only its RFC 5321 quoting changed, `!` means it was rewritten, and
`R` means a relay attempt was refused. Findings are in
`docs/experiment-review.md` under *Email infrastructure*.
The Postfix side is the `master.cf` entry in `entrypoint.sh`: