jSPF 0.9.6 passing RFC 4408 test suite 2007.05; no more "reference implementations"!

Julian Mehnle <[email protected]> Wed, 20 Aug 2008 19:01:50 +0000
Newsgroups gmane.mail.spam.spf.discuss,gmane.mail.spam.spf.devel
Message-ID <[email protected]>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stefano Bagnara wrote:
> with 2008.08 jSPF 0.9.6 fails the macromania test because %- and %_ are
> incorrectly expanded to - and _.
> I fixed that as soon as I saw the macromania test in openspf testsuite.
> 
> [...]
> 
> jSPF 0.9.6 conforms to (and includes) rfc4408-tests-2007.05.yml
> The next release will pass the current specification. The only known
> issue with jSPF 0.9.6 is the macro expansion above.

Got it.  I listed jSPF as compliant with 2007.05 since 0.9.6:

  http://www.openspf.org/Implementations

In the process, I removed the entire "reference implementations" section.  
It was controversial from the beginning, and its entire purpose was to 
get the old Mail::SPF::Query deprecated gracefully, which once upon a 
time actually _was_ the reference implementation.  It would have been 
hard to overcome M:S:Q's "reference implementation" character without 
serving any replacement, however now that we do have a number of high 
quality implementations as well as a solid compliance testing concept 
(the test suite with its release scheme), there isn't a need for having 
dedicated "reference implementations" anymore.

> [...]
> At ASF (Apache Software Foundation) we have a strict release process
> and we never recommend the use of snapshots and we never point users to
> nightlies or snapshots.

So let's NOT say anything like "2008.08: trunk" in addition to "2007.05: 
since 0.9.6".

> If you tell me that it won't take 2 more years to update the page I'll
> ask a new run as soon as we'll release 0.9.7.  We'll probably wait a bit 
> more because we want to include newer dns libraries so to fix any
> Kaminsky DNS vulnerability and a race issue in the asynchronous version
> of our resolver.

Please do.  Now that we've reasonably established that 0.9.6 passes 
2007.05, there's little speaking against giving you the benefit of the 
doubt and _right_away_ listing 0.9.7 as passing 2008.08, but that might 
confuse users who then go looking for 0.9.7 despite it not having been 
released yet.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkisah4ACgkQwL7PKlBZWjvT2QCgsqFgM5daXjdBchiLW5p4we2e
7vUAn0qlhJnhRa5j4b94i4hVbIwye6c5
=21mZ
-----END PGP SIGNATURE-----