tegwick d766d61e7f MAS-WP-0004: Postfix integration profile, corpus probe in pytest, Exim notes

Profile in integrations/postfix (install.sh + README), now used by the
live deployment. Probe runs every conformance-corpus local-part and the
relay negatives against it; tests/test_postfix_profile.py runs it where
Docker is available.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5787@bnt-lap001
Assistant-Session: 5db26b82-138b-40cc-9856-4d5eb0f752fd

2026-10-19 09:25:03 +02:00

1.6 KiB

Raw Blame History

Postfix probe

A real Postfix delivers MAS addresses through the pipe transport to mas-gateway and on to the reference ticket service. A capture proxy (capture.py) records the envelope recipient each event carried, so the probe can tell whether Postfix rewrote anything.

docker build -t mas-postfix-probe experiments/postfix-probe
python3 experiments/postfix-probe/probe.py --profile mas-profile --corpus  # the shipped profile
python3 experiments/postfix-probe/probe.py --profile defaults            # relay domain
python3 experiments/postfix-probe/probe.py --profile local-domain        # domain in mydestination
python3 experiments/postfix-probe/probe.py --profile local-domain-safe   # + swap_bangpath/percent_hack off

mas-profile runs the shipped integration profile (integrations/postfix/) with --corpus (every conformance-corpus local-part), plus relay attempts that must be refused. pytest runs it as tests/test_postfix_profile.py when Docker is available. The other experiment profiles are defaults-local and mas-safe-local. The repo is mounted read-only. In the output, = means the address arrived unchanged, ~ means only its RFC 5321 quoting changed, ! means it was rewritten, and R means a relay attempt was refused. Findings are in docs/experiment-review.md under Email infrastructure.

The Postfix side is the master.cf entry in entrypoint.sh:

mas  unix  -  n  n  -  -  pipe
  flags=Rq user=mas argv=/usr/local/bin/mas-gateway --statute <statute>
  pipe --app-url http://127.0.0.1:8024/mas-events --recipient ${recipient}

Set mas_destination_recipient_limit = 1 so each pipe invocation handles one recipient.

1.6 KiB Raw Blame History

Postfix probe

1.6 KiB

Raw Blame History