Re: Implementation certification procedure

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stefano Bagnara wrote:
> Julian Mehnle ha scritto:
> > More precisely, you have to convince someone who is able to edit the
> > SPF project's website that the implementation passes the test suite.
>
> That's unfair. IMHO.
> You didn't have to convince anyone that pyspf and Mail::SPF pass the
> test suite.

Right, I didn't _have_ to.  I could have easily faked my test suite
results or simply edited the website and declared Mail::SPF as compliant
without any proof whatsoever.

However, it should be trivial for anyone who doesn't trust me to follow
  http://search.cpan.org/src/JMEHNLE/Mail-SPF-v2.006/INSTALL
and check whether I have lied.

The same was, and still is, NOT true for jSPF, however:

I just gave it another try.  I installed Sun Java 6 and Maven 2 on my
Debian machine, downloaded and unpacked apache-jspf-0.9.6-src.tar.gz, and
tried following BUILDING.txt in the hope that it would automatically run
tests during building (there was no other documentation to be found in the
tarball on how to run the tests).

I do not have the James source installed, so I edited pom.xml as per
BUILDING.txt (see the attached diff), and then ran `mvn -Plocal package`.
It downloaded a lot of packages, and then this is what I got:

- ----------8<----------8<----------8<----------8<----------8<----------
...
[INFO] Setting property: classpath.resource.loader.class 
=> 'org.codehaus.plexus.velocity.ContextClassLoaderResourceLoader'.
[INFO] Setting property: velocimacro.messages.on => 'false'.
[INFO] Setting property: resource.loader => 'classpath'.
[INFO] Setting property: resource.manager.logwhenfound => 'false'.
[INFO] [remote-resources:process {execution: default}]
Downloading: 
file:///home/julian/tmp/apache-jspf-0.9.6/stage/org.apache/jars/apache-jar-resource-bundle-1.2.jar
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD ERROR
[INFO] ------------------------------------------------------------------------
[INFO] Resources JAR cannot be found.

Embedded error: Requested download does not exist.
Unable to download the artifact from any repository
- ---------->8---------->8---------->8---------->8---------->8----------

Conversely, _I_ can easily convince anyone who wants to know that
Mail::SPF passes the test suite, and I'm sure I have already convinced at
least one or two other participants of the SPF project.

> > That's good, but unfortunately it was too difficult (for me, who had
> > first given it a try) to verify that.  See my previous mail.
>
> The same difficulties I find with Mail::SPF testsuites and pyspf
> testsuites..

What difficulties?  I'd very much like to make testing Mail::SPF as easy
as possible.

> So you simply tell me that to be listed in the certification you want
> need a perl or python test suite or you won't list it?

No.

> What happens if I create an implementation for an operative system you
> don't have access to? No certification??

No, in that case I (or someone else on the project) will first try to get
access to a platform where it can be run (you could provide such access). 
If all fails, I (or they) will probably certify compliance based on some
cursory evidence (such as a log file demonstrating that the implemen-
tation passed the test suite).

My personal view aside on the requirements for listing on the website an
implementation as fully compliant, I am not the owner of the SPF project.
It's very much possible that someone else capabable of editing the website
is less demanding.

See my next, separate message for my comments on building a live-DNS
testing infrastructure.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkisAxQACgkQwL7PKlBZWjs/YgCeKak2l30QLcGSEhr9t1UsBJ2c
Ga0An2OMIBF+CdMCgNgGKDOVVmQw7oym
=BtYX
-----END PGP SIGNATURE-----