Skip to Main Content
Apache Events The Apache Software Foundation
Apache 20th Anniversary Logo

This was extracted (@ 2024-03-20 23:10) from a list of minutes which have been approved by the Board.
Please Note The Board typically approves the minutes of the previous meeting at the beginning of every Board meeting; therefore, the list below does not normally contain details from the minutes of the most recent Board meeting.

WARNING: these pages may omit some original contents of the minutes.
This is due to changes in the layout of the source minutes over the years. Fixes are being worked on.

Meeting times vary, the exact schedule is available to ASF Members and Officers, search for "calendar" in the Foundation's private index page (svn:foundation/private-index.html).

SpamAssassin

20 Mar 2024 [Sidney Markowitz / Jean-Baptiste]

Report was filed, but display is awaiting the approval of the Board minutes.

20 Dec 2023 [Sidney Markowitz / Sander]

Apache SpamAssassin report to Board for December 2023

## Description:

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

## Project Status:

Project state: Ongoing with low to moderate activity

Primary focus for development is now ongoing maintenance bug fixes to the
recently released 4.0.0.

Preparation of a bug fix release 4.0.1 is in progress.

Issues for the board: None

## Membership Data:

Apache SpamAssassin was founded 2004-06-01 (19 years ago) There are currently
32 committers and 14 PMC members in this project. The Committer-to-PMC ratio
is roughly 2:1.

Community changes, past quarter:

- No new PMC members. Last addition was Paul Stead on 2021-03-23.
- No new committers. Last addition was Paul Stead on 2018-09-12.

## Project Activity:

Last release: Apache SpamAssassin version 4.0.0 on 17 December 2022.

We maintain online rule updates that are continuously updated through a
combination of developer contributions and automated processing via our
mass-check facility.

## Community Health:

Maintenance of our rule update infrastructure, developer community submissions
for rule update testing, and our dev and user mailing lists, are continuing
smoothly.

20 Sep 2023 [Sidney Markowitz / Craig]

## Description:
SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

## Project Status:
Project state: Ongoing with low to moderate activity

Primary focus for development is now ongoing maintenance bug fixes to the
recently released 4.0.0.

Preparation has begun of a bug fix release 4.0.1.

Issues for the board: None

## Membership Data:
Apache SpamAssassin was founded 2004-06-01 (19 years ago)
There are currently 32 committers and 14 PMC members in this project.
The Committer-to-PMC ratio is roughly 2:1.

Community changes, past quarter:
- No new PMC members. Last addition was Paul Stead on 2021-03-23.
- No new committers. Last addition was Paul Stead on 2018-09-12.

## Project Activity:
Last release: Apache SpamAssassin version 4.0.0 on 17 December 2022.

We maintain online rule updates that are continuously updated through a
combination of developer contributions and automated processing via our
mass-check facility.

## Community Health:
Maintenance of our rule update infrastructure, developer community submissions
for rule update testing, and our dev and user mailing lists, are continuing
smoothly.

21 Jun 2023 [Sidney Markowitz / Shane]

Apache SpamAssassin report to Board for June 2023

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing
nature of spam email seen in the wild. Updated rules are generated
through a combination of hand crafted contributions and automated
processing of spam and anonymized processed non-spam that are
contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

Primary focus for development is now ongoing maintenance bug fixes to
the recently released 4.0.0.

Releases:

Last release: Apache SpamAssassin version 4.0.0 on 17 December 2022.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated
processing via our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

22 Mar 2023 [Sidney Markowitz / Shane]

Apache SpamAssassin report to Board for March 2023

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing
nature of spam email seen in the wild. Updated rules are generated
through a combination of hand crafted contributions and automated
processing of spam and anonymized processed non-spam that are
contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

Primary focus for development is now ongoing maintenance bug fixes to
the recently released 4.0.0.

Releases:

Last release: Apache SpamAssassin version 4.0.0 on 17 December 2022.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated
processing via our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

21 Dec 2022 [Sidney Markowitz / Rich]

Apache SpamAssassin report to Board for December 2022

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

Primary focus for development is now targeting version 4.0.0.

On 14 December 2022 we called for a vote on releasing 4.0.0 on 17 December.

Releases:

The last release was Apache SpamAssassin version 3.4.6 on 12 April 2021. The
release of version 4.0.0 on 17 December 2022 is currently up for vote.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

21 Sep 2022 [Sidney Markowitz / Roman]

Apache SpamAssassin report to Board for September 2022

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

Primary focus for development is now targeting version 4.0.0.

On 10 September 2022 we produced our second release candidate of 4.0.0, as
part of the final steps towards a full release.

Releases:

The last release was Apache SpamAssassin version 3.4.6 on 12 April 2021.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

15 Jun 2022 [Sidney Markowitz / Roy]

Apache SpamAssassin report to Board for June 2022

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

Primary focus for development is now targeting version 4.0.0.

On 31 May 2022 we produced our second pre-release of 4.0.0, containing all the
major changes and new features that we intend for 4.0.0, for testing in
production environments as part of the final steps towards a full release.

Releases:

The last release was Apache SpamAssassin version 3.4.6 on 12 April 2021.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

16 Mar 2022 [Sidney Markowitz / Christofer]

Apache SpamAssassin report to Board for March 2022

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

Primary focus for development is now targeting version 4.0.0

Releases:

The last release was Apache SpamAssassin version 3.4.6 on 12 April 2021.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

15 Dec 2021 [Sidney Markowitz / Bertrand]

Apache SpamAssassin report to Board for December 2021

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing
nature of spam email seen in the wild. Updated rules are generated
through a combination of hand crafted contributions and automated
processing of spam and anonymized processed non-spam that are
contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

Primary focus for development is now targeting version 4.0.0

Releases:

The last release was Apache SpamAssassin version 3.4.6 on 12 April 2021.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated
processing via our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

15 Sep 2021 [Sidney Markowitz / Sheng]

Apache SpamAssassin report to Board for September 2021

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

Primary focus for development is now targeting version 4.0.0

Releases:

The last release was Apache SpamAssassin version 3.4.6 on 12 April 2021.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer: Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

16 Jun 2021 [Sidney Markowitz / Justin]

Apache SpamAssassin report to Board for June 2021

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

SpamAssassin 3.4.5 was released on 24 March, 2021, as a security update,
fixing one CVE.

SpamAssassin 3.4.6 was released on 12 April, 2021 to fix two bugs that were
regressions introduced in 3.4.5.

We intend to return our primary focus to development of version 4.0.0, with no
further development in the 3.4 branch expected.

One new member was added to the PMC this quarter.

Releases:

The last release was Apache SpamAssassin version 3.4.6 on 12 April 2021.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Paul Stead (pds) 23 March 2021

17 Mar 2021 [Sidney Markowitz / Justin]

Apache SpamAssassin report to Board for March 2021

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

SpamAssassin 3.4.4 was released on 28 January, 2020. It was primarily a
security release, fixing two CVEs, all then known outstanding open security
issues on the project.

Previous reports to the Board have described the release of SpamAssassin 3.4.5
as "imminent", fixing a CVE obtained in February, 2020. That should have
triggered a process resulting in a release with 90 days. The last publicly
released build for it was 3.4.5 Pre-Release 1 built on June 21, 2020.
Development continued after that, without a formal release yet. We recognize
that this has been unacceptable. There do not appear to be any issues blocking
the release at this time. We intend to run the release process as soon as
possible on the current 3.4 branch. After that we will look at how to modify
our development and release processes to better conform to modern CI
practices, further automate releases, and add time targets to our process
steps.

We intend to return our primary focus to development of version 4.0.0 once
3.4.5 is released.

Releases:

The last release was Apache SpamAssassin version 3.4.4 on 28 January 2020.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018

Henrik Krohns (hege) 25 Sep 2018

16 Dec 2020 [Sidney Markowitz / Shane]

Apache SpamAssassin report to Board for December 2020

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

SpamAssassin 3.4.4 was released on 28 January, 2020. It was primarily a
security release, fixing two CVEs, all then known outstanding open security
issues on the project.

Release of SpamAssassin 3.4.5 is imminent, fixing a subsequently reported CVE
level security issue.  3.4.5 Pre-Release 1 was built on June 21, 2020.

We intend to return our primary focus to development of version 4.0.0.  A
Pre-Release 1 of 4.0.0 is planned.

Releases:

The last release was Apache SpamAssassin version 3.4.4 on 28 January 2020.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018

Henrik Krohns (hege) 25 Sep 2018

16 Sep 2020 [Sidney Markowitz / Shane]

Apache SpamAssassin report to Board for September 2020

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

SpamAssassin 3.4.4 was released on 28 January, 2020. It was primarily a
security release, fixing two CVEs, all then known outstanding open security
issues on the project.

Release of SpamAssassin 3.4.5 is imminent, fixing a subsequently reported CVE
level security issue.  3.4.5 Pre-Release 1 was built on June 21, 2020.

We intend to return our primary focus to development of version 4.0.0.  A
Pre-Release 1 of 4.0.0 is planned.

Releases:

The last release was Apache SpamAssassin version 3.4.4 on 28 January 2020.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018

Henrik Krohns (hege) 25 Sep 2018

17 Jun 2020 [Sidney Markowitz / Shane]

Apache SpamAssassin report to Board for June 2020

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

SpamAssassin 3.4.4 was released on 28 January, 2020. It was primarily a
security release, fixing two CVEs, all then known outstanding open security
issues on the project.

Release of SpamAssassin 3.4.5 is imminent, fixing a subsequently reported CVE
level security issue.

We intend to return our primary focus to development of version 4.0.0.

We voted to replace use of "blacklist" and "whitelist" with words such as
block/deny/allow, after seeing similar action by UK National Cyber Security
Centre and Chromium. The changes will be phased to avoid breaking existing
installations, with technical details now to be worked out in our normal
development process.

Releases:

The last release was Apache SpamAssassin version 3.4.4 on 28 January 2020.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018

Henrik Krohns (hege) 25 Sep 2018

18 Mar 2020 [Sidney Markowitz / Myrle]

Apache SpamAssassin report to Board for March 2020

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running our rule update infrastructure and
our dev and user mailing lists, are continuing smoothly.

SpamAssassin 3.4.4 was released on 28 January, 2020. It was primarily a
security release, fixing two CVEs, all then known outstanding open security
issues on the project.

Release of SpamAssassin 3.4.5 is imminent, fixing a subsequently reported CVE
level security issue.

We intend to return our primary focus to development of version 4.0.0.

Releases:

The last release was Apache SpamAssassin version 3.4.4 on 28 January 2020.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018

Henrik Krohns (hege) 25 Sep 2018

18 Dec 2019 [Sidney Markowitz / Daniel]

Apache SpamAssassin report to Board for December 2019

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running of our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

SpamAssassin 3.4.3 was released on 11 December, 2019, somewhat over a year
since our previous release. We now intend to return our development focus to
our main branch for 4.0.

We are having disruption to our automated processing due to denial of service
attacks against the SVN resources.  Thank you to infra for fighting this
attack.

Releases:

The last release was Apache SpamAssassin version 3.4.3 on 11 December 2019.
It contained two CVE fixes and resolves all known outstanding open security
issues on the project.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018

Henrik Krohns (hege) 25 Sep 2018

16 Oct 2019 [Sidney Markowitz / Rich]

Apache SpamAssassin report to Board for October 2019

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running of our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

Our wiki was successfully migrated by Infra in July from the deprecated
MoinMoin host to Confluence.

SpamAssassin 3.4.3 release candidate 4 was released August 31. We will need an
rc5 for a minor change, but are hopeful that will be our final release for
3.4.x and letting us focus on 4.0.

Our GSOC 2019 student, Shreyansh Shrivastava, successfully completed the
project in August. Thanks to Moaz Reyad and Wang Wei, representing Apache
Singa, for joining in to provide guidance and mentoring with regards to
statistical classification models. Shreyansh has been blogging about the
experience:
https://medium.com/@shreyansh25.shrivastava/gsoc19-work-submission-4699662d99f5

Among those representing ASF at WebPros Summit 2019 in September were
SpamAssassin PMC members Sidney Markowitz and Kevin A. McGrail, who helped
staff the ASF booth in "Open Source Alley" and presented some talks about
SpamAssassin and Open Source.

Releases:

The last release was Apache SpamAssassin version 3.4.2 on 16 September 2018

We are close to releasing version 3.4.3 to address some issues that were
deferred, in part so we could quickly release security fixes in 3.4.2. After
we release 3.4.3 we expect to resume development in our main branch for 4.0.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer: Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018

Henrik Krohns (hege) 25 Sep 2018

18 Sep 2019 [Sidney Markowitz / Ted]

No report was submitted.

@Kevin: pursue a report for SpamAssassin

19 Jun 2019 [Sidney Markowitz / Ted]

Apache SpamAssassin report to Board for June 2019

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running of our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

We are still making slow progress to a release of SpamAssassin 3.4.3. We have
posted a release candidate, but there are a number of remaining issues we want
to complete for the actual release.

Our GSOC 2019 student is doing well. Apache Singa has joined to help with
statistical classification models. Thanks to Moaz Reyad and Wang Wei for
joining Kevin A. McGrail to guide Shreyansh Shrivastava.
Shreyansh has been blogging about the experience:
https://medium.com/@shreyansh25.shrivastava/spamassassin-singa-and-me-7927dbaa16d0

Releases:

The last release was Apache SpamAssassin version 3.4.2 on 16 September 2018.
We are close to releasing version 3.4.3 to address some issues that were
deferred, in part so we could quickly release security fixes in 3.4.2. After
we release 3.4.3 we expect to resume development in our main branch for 4.0.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018
Henrik Krohns (hege) 25 Sep 2018

20 Mar 2019 [Sidney Markowitz / Bertrand]

Apache SpamAssassin report to Board for March 2019

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running of our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

We are close to releasing SpamAssassin version 3.4.3, although we missed
releasing it in the last quarter.

We have one mentored project for GSOC 2019, and are still soliciting
proposals.

Releases:

The last release was Apache SpamAssassin version 3.4.2 on 16 September 2018.
We are close to releasing version 3.4.3 to address some issues that were
deferred, in part so we could quickly release security fixes in 3.4.2. After
we release 3.4.3 we expect to resume development in our main branch for 4.0.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

Most recent new PMC members:

Giovanni Bechis (gbechis) 24 Sep 2018
Henrik Krohns (hege) 25 Sep 2018

19 Dec 2018 [Sidney Markowitz / Isabel]

Apache SpamAssassin report to Board for Dec 2018

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Status and health report:

The project activities, including running of our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

We are close to releasing SpamAssassin version 3.4.3.

We have added two new PMC members.

Releases:

The last release was Apache SpamAssassin version 3.4.2 on 16 September 2018.
We are close to releasing version 3.4.3 to address some issues that were
deferred, in part so we could quickly release security fixes in 3.4.2. After
we release 3.4.3 we expect to resume development in our main branch for 4.0.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Committer/PMC changes:

Most recent new committer:

Paul Stead (pds) 12 September 2018

New PMC members this quarter:

Giovanni Bechis (gbechis) 24 Sep 2018 Henrik Krohns (hege) 25 Sep 2018

19 Sep 2018 [Sidney Markowitz / Rich]

Apache SpamAssassin report to Board for Sep 2018

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Request to the Board for variance from new release policy:

We are requesting a variance from the Board regarding the new release policy
that disallows new artifacts from using SHA-1.

Apache SpamAssassin publishes rules updates that are cryptographically signed
using GPG, and have SHA-1, SHA-256, and SHA-512 hashes that are intended to
protect against data corruption in transit. The updates we publish can be used
by people who are still running the previous version of SpamAssassin, 3.3.2,
as well as the current version 3.4.1, which only recognize the GPG signature
and SHA-1 hash checksum. The recently released 3.4.2 drops the use of SHA-1
completely. We would like a variance to continue to publish SHA-1 hashes with
the rule updates until some date that we will specify as end of life for
SpamAssassin 3.3.2. We would then stop including SHA-1 hashes with the rule
updates, requiring everyone to upgrade to at least SpamAssassin 3.4.2 or stop
updating their rules. The exact date will depend in part on the response from
the Board regarding this request. Please note that the security of the
downloads come from the use of GPG signatures, not the hashes.

It can be argued that the use of SHA-1 in our rule updates does not fall under
the release policy, as we are not using it as part of the distribution of new
package releases. We do owe it to our users to be reasonable about how we
expect them to transition to the new SpamAssassin version 3.4.2. We would like
confirmation from the Board that we can proceed with the orderly transition to
dropping use of SHA-1 in our rule update system by setting a reasonable end of
life date.

We have a discussion of our request in
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7618

Status and health report:

The project activities, including running of our rule update infrastructure
and our dev and user mailing lists, are continuing smoothly.

Major news is that we have produced our first release in over three years.

We have added a new committer.

Releases:

The last release was Apache SpamAssassin version 3.4.2 on 16 September 2018.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Version 3.4.2 includes several security fixes, including four for which CVEs
have been issued. We expect to produce a version 3.4.3 in the near future to
address some issues that were deferred, in part so we could quickly release
the security fixes. Our main development branch is for a version 4.0.

Committer/PMC changes:

New committer this quarter:

Paul Stead (pds) 11 September 2018

Most recent new PMC member:

Bill Cole (billcole) 5 March 2018

20 Jun 2018 [Sidney Markowitz / Rich]

Apache SpamAssassin report to Board for June 2018

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

The project activities are continuing smoothly with nothing that is both new
and notable to report.

We had one project proposal for GSoc 2018 accepted and started, but it failed
when no code was submitted to a repository in time for a hard deadline imposed
by the GSoc rules. The mentor and student intend to continue work on the
project outside of GSoc 2018.

Releases:

The last release was Apache SpamAssassin version 3.4.1 on 30 April 2015.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

A release candidate for version 3.4.2 is imminent. At the time of writing of
this report, the rc is scheduled for release before the meeting of the Board.

We have previously said that this should be the last release of the 3.4 branch
before moving on with work towards 4.0, but a future 3.4.3 release is now
looking more likely in the balance of priorities to get 3.4.2 released.

Committer/PMC changes (none this quarter):

Most recent new committer:

Giovanni Bechis (gbechis) 15 February 2018

Most recent new PMC member:

Bill Cole (billcole) 5 March 2018

21 Mar 2018 [Sidney Markowitz / Mark]

Apache SpamAssassin report to Board for March 2018

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

This has been another good quarter for the project.

We added one new committer and had one committer join the PMC.

Our mass-check system is running smoothly.

The users, dev, and sysadmins mailing lists have been active and healthy.

We had one member of the PMC volunteer to be a mentor and have a project
proposal for GSoC 2018. We have posted a call for applicants.

Releases:

The last release was Apache SpamAssassin version 3.4.1 on 30 April 2015.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

In last quarterly report we said that we were resuming work on a version 3.4.2
after having put it aside to complete an update of the mass-check system
infrastructure. Our expectation that we would complete the release in January
proved to be overly optimistic. We have been making steady progress on closing
the issues that are targeted for 3.4.2, with some increase in participation by
committers. Our current hope is to have a release by mid-June.

We have previously said that this should be the last release of the 3.4 branch
before moving on with work towards 4.0, but a future 3.4.3 release is now
looking more likely in the balance of priorities to get 3.4.2 released.

Committer/PMC changes:

One new committer this quarter:

Giovanni Bechis (gbechis) 15 February 2018

One new PMC member this quarter:

Bill Cole (billcole) 5 March 2018

20 Dec 2017 [Sidney Markowitz / Jim]

Apache SpamAssassin report to Board for December 2017

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

This has been a good quarter for the project.

We added one new committer and had one committer join the PMC.

There are new contributors in bugzilla, both with patches and bug grooming.
Our sysadmin team, especially davej and merijnvdk, completed the rebuild of
the mass check / rule update system.

We have a new PC online.

Work on our new release had been shelved until we completed infrastructure
work on mass check. During this time we did make progress updating the release
process, which had not worked on a modern distro, and rolled out a few
pre-release packages.

Work on the release has resumed, with hope expressed for a January release,
though a firm date has not yet been set.

The users, dev, and sysadmins mailing lists have been active and healthy.

Issues:

Mass check and rule update issues appear to have been resolved. We are
resuming work towards our next release.

Releases:

The last release was Apache SpamAssassin version 3.4.1 on 30 April 2015.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Work on a new 3.4.2 release has been resumed, with an as yet tentative goal of
releasing some time in January.

This should be the last release of the 3.4 branch before moving on with work
towards 4.0.

Committer/PMC changes:

One new committer this quarter:

Merijn van den Kroonenberg (merijnvdk) 28 November 2017

One new PMC member this quarter:

Dave Jones (davej) 28 November 2017

20 Sep 2017 [Sidney Markowitz / Jim]

Apache SpamAssassin report to Board for September 2017

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

There has been little change from the previous quarter. Bug reports have been
at a steady slow pace, with responses and fixes keeping up. Most technical
activity has been on the mass-check/rule update infrastructure.

The users list has been quite active and fairly technical for a user oriented
list. There is a regular presence of some committers/PMC answering questions
and participation in the discussions.

Issues:

Our mass-check system / rule update services have been migrated to its new VM.
We have been dealing with instability problems including hangs. Infra has been
responsive, increasing the RAM and number of cores in the VM. We have enabled
additional logging to better track root causes of problems if they persist
even with the increase in resources.

The mass-check seems to be operational again, leaving problems with the output
of rule update still to be resolved. Much thanks to Infra for their
assistance. We continue to debug rule updates.

Releases:

The last release was Apache SpamAssassin version 3.4.1 on 30 April 2015.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Our new	3.4.2 release is close to ready for a release candidate but that will
be held	until the the resurrection of the mass-check / rule update system on
the new platform is successful.

Committer/PMC changes:

Most recent new committers:

Dave Jones (davej) 26 April 2017
Bryan Vest (bvest) 7 May, 2017

Most recent new PMC member:

John Hardin (jhardin) 18 October 2016

21 Jun 2017 [Sidney Markowitz / Mark]

Apache SpamAssassin report to Board for June 2017

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

Project activity has picked up quite a bit in the past quarter with work
proceeding on a new release and the addition of two new committers who are
working on our sysadmin/infrastructure needs to resurrect the mass check
facility on a new machine. We have set up a new public mailing list sysadmins@
for the latter activity,

The users list has been quite active and fairly technical for a user oriented
list. There is a regular presence of some committers/PMC answering questions
and participation in the discussions.

Issues:

The board feedback to the last report brought to our attention a private key
that was stored on a shared server. There is no reason to believe that
anything has been compromised. The key was encrypted and on a private
directory. We asked to have the file deleted. We will generate a new signing
key for our next release and make sure that we follow best practices in how we
secure it.

Our old VM was decommissioned before the new machine was running, but we
restored essential services fairly quickly and without it being a crisis
situation. Most importantly we now have better documentation and an active
sysadmin team as a subset of our committer/PMC team.

Releases:

The last release was Apache SpamAssassin version 3.4.1 on 30 April 2015.

Note that we maintain online rule updates that are continuously updated
through a combination of developer contributions and automated processing via
our mass-check facility.

Work has been steadily proceeding this year, and at a faster pace this
quarter, on the upcoming 3.4.2 release, however most work has been on
completing the migration of the ruleqa/mass-check facility to the new
infrastructure. We have completed a triage of issues and port of commits from
trunk to the 3.4.2 branch.

We expect the release to follow soon after the infrastructure work is
completed.

Committer/PMC changes:

New Committers this quarter:

Dave Jones (davej) 26 April 2017 Bryan Vest (bvest) 7 May, 2017

PMC, most recent new member:

John Hardin (jhardin) 18 October 2016

15 Mar 2017 [Sidney Markowitz / Rich]

Apache SpamAssassin report to board for March 2017

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

The status of the project is basically unchanged from the last report, a
mature project that is not in rapid development. The users mailing list is
active with user level questions and responses from people with expertise in
SpamAssassin. There is moderate activity on the developer mailing list and
Bugzilla. Questions are answered in a timely fashion and bug reports are being
addressed.

We have had a modest increase in the number of volunteers who submit sample
mail to our mass-check rule generation system.

Issues:

Two computers that the project has been using to support our mass-check rule
generation and updates are scheduled to be shut down soon (mid-March). Kevin
McGrail (KAM) has been working on getting the replacement VM ready and moving
data and processes to it. We expect a report from him soon on the
de-provisioning of the old machines.

Releases:

KAM has volunteered to be release manager for SpamAssassin 3.4.2. We will
start the formal release process after he has completed the machine migration
and de-provisioning that we mentioned in the previous section.

Committer/PMC changes:

There were no changes in membership in committers or PMC in the last quarter.
However we are very pleased to welcome Kevin McGrail back to active
participation in the project.

21 Dec 2016 [Sidney Markowitz / Isabel]

Apache SpamAssassin report to board for December 2016

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

The status of the project is basically unchanged from the last report, a
mature project that is not in rapid development. The users mailing list is
active with user level questions and responses from people with expertise in
SpamAssassin. Traffic on the developers mailing list is much quieter, showing
mostly the results of our automated processes and regular bug fix activity by
developers on our Bugzilla issues. Much of the ongoing developer level
activity is around the maintenance of the rule-generation facility that runs
as a service for the users of SpamAssassin.

Issues:

The problems with the mailing list mentioned last quarter seem to have been
successfully resolved by the banning of one person from the list. There are no
new issues to mention.

Releases:

Last quarter’s report stated the intention to produce a 3.4.2 release, as did
the previous quarter’s report. We still have not selected a release manager
and triggered the release process but have closed a number of our Bugzilla
issues that would go into a 3.4.2 release. It would be a good idea to get the
release process started in January.

Committer/PMC changes:

John Hardin (jhardin) joined the PMC two months ago.

21 Sep 2016 [Sidney Markowitz / Greg]

Apache SpamAssassin report to board for September 2016

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

The status of the project is basically unchanged from the last report, where
it was described as healthy for a mature project that is not in rapid
development. That said, there are some areas of concern that are raised in the
issues section below.

Issues raised in last report:

The problems with access to the “mass-check” infrastructure have been
resolved. There are now multiple people with root access to the machines that
are still being used, and others have been identified as having been
decommissioned. The issue with “zones2 deprecation” turned out to be already
resolved once we understood what the mention of it referred to and the details
of the VM resource that infra has made available to us.

Issues:

Support for the mass-check facility is still a concern. That is a facility
that we provide for people to upload statistics processed from their curated
spam and ham streams. When we receive sufficient volume we are able to use it
to update SpamAssassin’s rule system to tune it to the ever-changing tactics
of spammers. The previous Chair was a SPOF of processing requests for access
to upload to the mass-check system. With his sudden and unexpected absence
that was not immediately filled, there is a backlog in processing those
requests. The mass-check system is operational, but would function better with
a higher volume of quality input. What is most immediately needed is
documentation of the procedures and ensuring that multiple members of the PMC
are responsible for the necessary tasks.

There was an issue with a disruptive member of the SpamAssassin users mailing
list that resulted in the member being banned from the list. This is a
difficult problem that did not result in a consensus among the members of the
PMC. Some of the factors that are involved are: 1) One person was clearly at
the root of the problem, but several other people ended up violating the ASF
Code of Conduct after getting into flame wars with him. That makes it more
difficult to justify banning just one person even if that would be enough to
calm everything down. 2) The facilities provided by the ezmlm mailing list
software are not up to the task of handling moderation in these circumstances.
The only choices are to allow someone full access to the mailing list or to
ban their email address from both sending and receiving. It would have been a
lot easier to achieve a compromise with this person if he could have been put
into moderation where his posts could be manually allowed through, only
blocking his periodic slips. 3) The user’s email address was banned. He soon
returned with a different email address. It was obvious that it was the same
person, he made basically no attempt to hide it, and a number of people posted
to the mailing list to point out that he was the same person who had just been
banned. However, he has so far not repeated the behavior that got him banned.
It does not seem right to at this point escalate to an arms race just to try
to show that we are in charge and that our bans must not be circumvented.

Infra:

It was pointed out to us that the spamassassin.org domain is hosted on non-ASF
name servers, and that perhaps it should be moved. We opened a ticket with
infra and got a response, but let the ticket lapse. Our current hosting is
stable and redundant. Now that we have learned from infra what will be
involved we can pursue it some time in the future when some member of the PMC
has sufficient time and interest.

Releases:

Last quarter’s report stated the intention to produce a 3.4.2 release. We have
not yet formally started a release cycle (naming a release manager, a
schedule, etc.) but have made some progress on identifying and closing bugs on
the 3.4.2 branch. It may be possible to get the release out this year.

Committer/PMC changes:

Joe Quinn (jquinn) joined the PMC three months ago.
Bill Cole (billcole) was added as committer two and a half months ago.

15 Jun 2016

Change the Apache SpamAssassin Project Chair

 WHEREAS, the Board of Directors heretofore appointed Kevin A. McGrail
 (kmcgrail) to the office of Vice President, Apache SpamAssassin, and

 WHEREAS, the Board of Directors has been notified that Kevin A.
 McGrail is not able to fulfill the duties and responsibilities of the
 office of Vice President, Apache SpamAssassin, and

 WHEREAS, the Project Management Committee of the Apache SpamAssassin
 project has chosen by vote to recommend Sidney Markowitz (sidney) as
 the successor to the post;

 NOW, THEREFORE, BE IT RESOLVED, that Kevin A. McGrail is relieved and
 discharged from the duties and responsibilities of the office of Vice
 President, Apache SpamAssassin, and

 BE IT FURTHER RESOLVED, that Sidney Markowitz be and hereby is
 appointed to the office of Vice President, Apache SpamAssassin, to
 serve in accordance with and subject to the direction of the Board of
 Directors and the Bylaws of the Foundation until death, resignation,
 retirement, removal or disqualification, or until a successor is
 appointed.

 Special Order 7B, Change the Apache SpamAssassin Project
 Chair, was approved by Unanimous Vote of the directors
 present.

15 Jun 2016 [Kevin A. McGrail / Bertrand]

SpamAssassin is a mail filter to identify spam. The project provides a
framework/engine and regular rule updates that reflect the changing nature of
spam email seen in the wild. Updated rules are generated through a combination
of hand crafted contributions and automated processing of spam and anonymized
processed non-spam that are contributed by volunteers.

Health report:

The project is mature in that it has not seen rapid development of its
software component. SpamAssassin is widely used, and users do make use of the
regular updates of the rules.  There has not been much new development of the
code. Bug reports are being looked at and handled. There is active discussion
on the user list. Rule updates happen regularly.

Issues:

The project chair became unexpectedly unavailable last March. The PMC did not
determine the full circumstances until recently. The PMC has voted to nominate
Sidney Markowitz as the new chair. One issue with the sudden transition is
that the chair had set up the infrastructure for our “mass-check” that accepts
submissions of spam and non-spam email and drives our automated rule update
system. We are still trying to determine if anyone else knows the details or
at least has access to the infrastructure. The mass-check system itself has
been running smoothly, but lack of access for moving, changing, or fixing it
is a major concern.

Infra:

The last report that was submitted stated that Zones2 deprecation was stalled
due to disk space requirements. Now the status is that it is stalled until the
new chair can find out what that means and finish the task.

Releases:

The last release was version 3.4.1 on April 30, 2015. Last November the
project agreed that there are sufficient bug fixes in the 3.4 branch and it is
sufficiently stable to justify releasing 3.4.2 “soon”. There has been
development in the main (4.0) branch, but no discussion of a release schedule
for it. We need to close some remaining issues for 3.4.2 and sweep through
issues in the 4.0 branch to check for any fixed ones that should be ported or
open ones that really ought to be fixed in 3.4.2, then get the 3.4.2 release
out the door.

Committer/PMC changes:

The last new committer was added over two years ago. The last new member of
the PMC was three and a half years ago. The new chair has stated concern over
the stagnation that implies and will see if there is anything we can do about
it.

18 May 2016 [Kevin A. McGrail / Shane]

No report was submitted.

Mark to follow up on his existing action; and recommend that the PMC nominate a (possibly temporary) new chair.

20 Apr 2016 [Kevin A. McGrail / Mark]

No report was submitted.

@Mark: pursue a report for SpamAssassin

16 Mar 2016 [Kevin A. McGrail / Rich]

No report was submitted.

16 Dec 2015 [Kevin A. McGrail / Shane]

## Description:
SpamAssassin is a mail filter to identify spam.


## Health Report:
 - Mature project that could always use more invigoration but there are no
   issues and nothing requiring board attention at the moment

## Activity:
 - Mailing list for dev & users is active with questions are being asked &
   answered, spam techniques is being discussed, new users helped & bugs open
   / closed.

## PMC changes:

 - Currently 7 PMC members.
 - No new PMC members added in the last 3 months
 - Last PMC addition was Adam Katz on Tue Jan 29 2013

## Project Branding Requirements
 - Logos and Graphics : Consistently used
 - No decision has been made or active discussion currently to register the
   trademark of the project.

## Infra
 - Zones2 deprecation is stalled due to diskspace requirements.

## Committer base changes:

 - Currently 26 committers.
 - No new committers added in the last 3 months
 - Last committer addition was Joe Quinn at Sun Mar 02 2014

## Releases:

 - Last release was 3.4.1 on Thu Apr 30 2015
 - 3.4.2 is stable in rcs but movement towards release is slow.

## Mailing list activity:

PREFACE: There is a ~6-week gap on data.

 - users@spamassassin.apache.org:
    - 1669 subscribers (down -18 in the last 3 months):
    - 948 emails sent to list (920 in previous quarter)

 - dev@spamassassin.apache.org:
    - 269 subscribers (down -3 in the last 3 months):
    - 276 emails sent to list (271 in previous quarter)

 - announce@spamassassin.apache.org:
    - 2288 subscribers (up 4 in the last 3 months):
    - 0 emails sent to list (0 in previous quarter)

 - friends@spamassassin.apache.org:
    - 15 subscribers (up 0 in the last 3 months)

 - blogspam@spamassassin.apache.org:
    - 25 subscribers (up 0 in the last 3 months):
    - 0 emails sent to list (0 in previous quarter)

 - ruleqa@spamassassin.apache.org:
    - 37 subscribers (up 1 in the last 3 months):
    - 51 emails sent to list (57 in previous quarter)

16 Sep 2015 [Kevin A. McGrail / Rich]

## Description:
SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.


## Health Report:
 - Mature project that could always use more invigoration but there are no
   issues and nothing requiring board attention at the moment

## Activity:
 - Mailing list for dev & users is active with questions are being asked &
   answered, spam techniques is being discussed, new users helped & bugs open
   / closed.

## PMC/Committership changes:
 - Currently 26 committers and 7 PMC members in the project.
 - No new PMC members added in the last 3 months
 - No new committers added in the last 3 months
 - Last committer addition was Joe Quinn at Sun Mar 02 2014

## Releases:
 - 3.4.1 was released on April 30th, 2015
 - 3.4.2 release candidate target of Sept 30th

## Project Branding Requirements
 - Logos and Graphics : Consistently used
 - No decision has been made or active discussion currently to register the
   trademark of the project.

## Infra
 - Zones2 deprecation is a bit stalled due to diskspace requirements.

## Mailing list activity:

 - users@spamassassin.apache.org:
    - 1682 subscribers (up 5 in the last 3 months):
    - 872 emails sent to list (1088 in previous quarter)

 - dev@spamassassin.apache.org:
    - 271 subscribers (down -1 in the last 3 months):
    - 246 emails sent to list (639 in previous quarter)

 - announce@spamassassin.apache.org:
    - 2284 subscribers (up 5 in the last 3 months):
    - 0 emails sent to list (1 in previous quarter)

 - friends@spamassassin.apache.org:
    - 15 subscribers (up 0 in the last 3 months)

 - blogspam@spamassassin.apache.org:
    - 25 subscribers (up 0 in the last 3 months):
    - 0 emails sent to list (0 in previous quarter)

 - ruleqa@spamassassin.apache.org:
    - 36 subscribers (up 1 in the last 3 months):
    - 54 emails sent to list (78 in previous quarter)

17 Jun 2015 [Kevin A. McGrail / Jim]

## Description:
SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

## Issues:
 - Any guidance on how to get sensitive passphrases/credentials to more
   members of the project who live in far flung parts of the world short of
the lengthy circle of trust process?  Is there some sort of verification
service we can leverage?  Registered mail service that requires identification
and makes it a crime to tamper?

## Board Q&A:
- The board requested input about the lack of promotion to the SA PMC.  The
  following response was submitted on 4/22/15 by the chair:
"The lack of promotion to PMC is likely not a valid concern at this time.  As
a project, we are consistently trying to get more committers and hence more
people on the track for the PMC.  I won't sugarcoat things though because
people aren't beating down our door to become committers though and there is
considerable brain drain caused by private enterprises hiring away talent.

However, with that said, our advancement policy at
https://wiki.apache.org/spamassassin/ProjectRoles is being followed and
committers have been invited to the PMC but declined to accept.

And we have invited several people to initiate CLAs and we are mentoring for
the GSOC with one project with the hopes that they will become regular
contributors.   I have also been reviewing open bugs and submitted patches to
try and get the hurdle of CLAs solved so we can accept more contributions from
a more diverse crowd of programmers.

Perhaps it would be good to add to the reporter tool the number of CLAs
processed by the secretary on behalf of projects?

In conclusion, we are aware of the issue and this email serves to remind the
PMC to diligently promote new contributors, contributors becoming committers
and committers becoming PMC.  We know our community is very important to the
long-term viability of the project.

Any PMC members, please feel free to add or object to my statements."

## PMC/Committership changes:
  - Currently 26 committers and 7 PMC members in the project.
 - No new PMC members added in the last 3 months
 - No new committers added in the last 3 months
 - Last committer addition was Joe Quinn at Sun Mar 02 2014

## Releases:
- 3.4.1 was released on April 30th, 2015 *NOTE: I accidentally put this in the
  database as 2014 unsure how to fix it...)
- Thanks to Sally Khudairi for her assistance in the PR for the release!
- Work has begun on 3.4.2 and 4.0.0 releases.

## Project Branding Requirements
- Logos and Graphics : include TM, use consistent   product logo on your site.
  UPDATE: The new logo along with the powered by logo was launched on our
website along with the 3.4.1 release.
- Bugzilla was also updated to use the new logo thanks to Infra.
- No decision has been made to register the trademark of the project.
- We have insured PMC control of the Sourceforge mirror for SpamAssassin

## Infra

- We are working (finally) to get zones2 deprecated
## Mailing list activity:
- Working with infra to fix the mailing list issues where moderator emails are
  being caught by the new spamassassin installation (ironic, I know)...

 - users@spamassassin.apache.org:
    - 1680 subscribers (down -14 in the last 3 months):
    - 1064 emails sent to list (908 in previous quarter)

 - dev@spamassassin.apache.org:
    - 272 subscribers (up 2 in the last 3 months):
    - 621 emails sent to list (425 in previous quarter)

 - announce@spamassassin.apache.org:
    - 2278 subscribers (down -106 in the last 3 months):
    - 1 emails sent to list (0 in previous quarter)

 - friends@spamassassin.apache.org:
    - 15 subscribers (up 0 in the last 3 months)

 - blogspam@spamassassin.apache.org:
    - 25 subscribers (up 0 in the last 3 months):
    - 0 emails sent to list (0 in previous quarter)

 - ruleqa@spamassassin.apache.org:
    - 35 subscribers (down -2 in the last 3 months):
    - 75 emails sent to list (27 in previous quarter)

22 Apr 2015 [Kevin A. McGrail / Greg]

## Description:
SpamAssassin is a mail filter to identify spam. It is an intelligent
email filter which uses a diverse range of tests to identify unsolicited
bulk email, more commonly known as Spam. These tests are applied to
email headers and content to classify email using advanced statistical
methods. In addition, SpamAssassin has a modular architecture that
allows other technologies to be quickly wielded against spam and is
designed for easy integration into virtually any email system.

## Issues:
 - There are no issues requiring board attention at this time.

## PMC/Committership changes:

 - Currently 26 committers and 7 PMC members in the project.
 - No new PMC members added in the last 3 months
 - No new committers added in the last 3 months
 - Last committer addition was Joe Quinn at Sun Mar 02 2014

 - We do not have any new people moving moving towards committer
   but do have commits and rules being discussed and passed through to
   current committers to vet and apply showing good community development
   health.  We are trying to encourage this more.

 - We have one mentor for GSoC, Kevin A. McGrail and one project
   we are excited if it is chosen from Sarang Shrivastava:

   https://www.google-melange.com/gsoc/proposal/review/org/google/gsoc2015/xlr_24/5629499534213120

   He is an open source enthusiast from Motilal Nehru National Institute of
   Technology, Allahabad, India.

## Project Branding Requirements

  - IN PROCESS - Logos and Graphics : include TM, use consistent
  product logo on your site. The artist has finished adding the TM
  mark to all our logos ready for publishing.

  NOTE: Will announce the new logo along with the powered by logo with
        the 3.4.1 release.

  - We have created the new Powered By logo for the press kit last week.

  - No decision has been made to register the trademark of the project.

## Activity

 - Releases:

   - 3.4.0 was released on 2014-02-11.

   - 3.4.1-rc2 was release on 2015-04-16.  All blockers for this release are
     closed and we are hopeful to announce a release in the next few days.
     Thanks to Sally and her work for the press release about the upcoming
     release.

   - Our rules releases have continued and with 81 rule sets published since
     the last quarterly report.

 - We have some exciting ideas for what will likely be Apache SpamAssassin 4.0

## Mailing list activity:

 - users@spamassassin.apache.org:
    - 1685 subscribers (down -20 in the last 3 months):
    - 1216 emails sent to list (1419 in previous quarter)

 - dev@spamassassin.apache.org:
    - 269 subscribers (down -7 in the last 3 months):
    - 672 emails sent to list (289 in previous quarter)

 - announce@spamassassin.apache.org:
    - 2392 subscribers (up 11 in the last 3 months):
    - 0 emails sent to list (0 in previous quarter)

 - friends@spamassassin.apache.org:
    - 15 subscribers (up 0 in the last 3 months)

 - blogspam@spamassassin.apache.org:
    - 25 subscribers (up 0 in the last 3 months):
    - 0 emails sent to list (0 in previous quarter)

 - ruleqa@spamassassin.apache.org:
    - 36 subscribers (down -1 in the last 3 months):
    - 53 emails sent to list (70 in previous quarter)

@Greg: Any prospects for new committers/PMC members?

18 Mar 2015 [Kevin A. McGrail / Rich]

No report was submitted.

17 Dec 2014 [Kevin A. McGrail / Rich]

Description
-----------
SpamAssassin is a mail filter to identify spam. It is an intelligent
email filter which uses a diverse range of tests to identify unsolicited
bulk email, more commonly known as Spam. These tests are applied to
email headers and content to classify email using advanced statistical
methods. In addition, SpamAssassin has a modular architecture that
allows other technologies to be quickly wielded against spam and is
designed for easy integration into virtually any email system.

Releases
--------
3.4.0 was released on 2014-02-11.

Our rules releases have continued and with 73 rule sets published since the
last quarterly report.

The first release candidate for 3.4.1 was created today on Dec 16th.


Community & Development
-----------------------
The most recent addition to our PMC is Adam Katz added on 2013-01-30.

The most recent addition to the committers is Joe Quinn added on
2014-02-27.

The community has started the process to revive the SOUGHT rules project

However, we do not have any new people moving moving towards committer
but do have commits and rules being discussed and passed through to
current committers to vet and apply showing good community development
health.

Our RuleQA dev list has been active and community support is good.

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

We still need to get our Jenkins build slave working under FreeBSD
instead of Solaris1 (Bug 6887).

https://builds.apache.org/job/SpamAssassin-trunk/ is offline and not working.

We are preparing to deprecate the zones2 server.

Thanks to Infra for the work on the SVN recovery!


Project Branding Requirements
-----------------------------
 IN PROCESS - Logos and Graphics : include TM, use consistent
product logo on your site

NOTE: Will announce the new logo along with the powered by logo.  Planned with
3.4.1 release.

Committee Record Review
-----------------------
We compared http://svn.apache.org/repos/asf/spamassassin/trunk/CREDITS to
https://svn.apache.org/repos/private/committers/board/committee-info.txt
and no discrepancies were found.

Issues
------
No further issues.

17 Sep 2014 [Kevin A. McGrail / Jim]

SpamAssassin is a mail filter to identify spam. It is an intelligent
email filter which uses a diverse range of tests to identify unsolicited
bulk email, more commonly known as Spam. These tests are applied to
email headers and content to classify email using advanced statistical
methods. In addition, SpamAssassin has a modular architecture that
allows other technologies to be quickly wielded against spam and is
designed for easy integration into virtually any email system.

Releases
--------
3.4.0 was released on 2014-02-11.

Our rules releases have been restored publishing 63 rule sets.

The release of 3.4.1 is pending and expected on or about Sept 30th.

No other releases for this quarter.


Community & Development
-----------------------
The most recent addition to our PMC is Adam Katz added on 2013-01-30.

The most recent addition to the committers is Joe Quinn added on
2014-02-27.

We still have 3 contributors invited to submit a CLA on the project and
begin moving towards committer karma with commits passed through to
current committers to vet and apply showing good community development
health.

Our RuleQA dev list has been active and community support is good.

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

We still need to get our Jenkins build slave working under FreeBSD
instead of Solaris1 (Bug 6887).


Project Branding Requirements
-----------------------------
 IN PROCESS - Logos and Graphics : include TM, use consistent
product logo on your site

NOTE: Pending TM being added to one version of the logo to make
the announcement for the new logo

No other Branding issues known but we look forward to the Powered by
Apache logo!

Issues
------
SA was asked to clarify a previous report item mentioned.

In SpamAssassin, the ASF software product is the hammer.

However, the SpamAssassin rules published by the project are the nails.

With SA v3.3.0, we separated the rules from the code to make it so we
could more readily use an update infrastructure donated by anti-spam
community members to deliver daily rule updates.

As spam evolves, one of the tools that has grown to heavy use is called
an RBL or Real-time Blocklist also know as a DNSBLs because the
underlying technology that has been leveraged to deliver the RBL
world-wide is DNS-based.

I have begun the framework at
https://raptor.pccc.com/raptor.cgim?template=RBL with the intention to
run this under the project if permitted.  My concern is that this is
less of a "software" and more of a support resource.

As such, is this something that the ASF would support or would the board
frown on such an item?

@Jim: ask SpamAssassin to discuss budget issues with treasurer

18 Jun 2014 [Kevin A. McGrail / Chris]

Description
-----------
SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

Releases
--------
3.4.0 was released on 2014-02-11.

Our rules releases have been down since mid-April when our ASF Zones box
was lost in a catastrophic failure.  Thanks to Infra for setting up a new VM.

We published one test set of rules on 2014-06-14 and are moving towards full
restoration of rules production shortly.

The release of 3.4.1 is pending as it took a backseat to the zones failure.

No other releases for this quarter.


Community & Development
-----------------------
The most recent addition to our PMC is Adam Katz added on 2013-01-30.

The most recent addition to the committers is Joe Quinn added on 2014-02-27.

We still have 3 contributors invited to submit a CLA on the project and begin
moving towards committer karma.

Our RuleQA dev list has been active and community support is good.

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

We still need to get our Jenkins build slave working under FreeBSD
instead of Solaris1 (Bug 6887).


Project Branding Requirements
-----------------------------
 IN PROCESS - Logos and Graphics : include TM, use consistent product logo
on your site - NOTE: Pending TM being added to one version of the logo to make
the announcement for the new logo.

The PMC had no input regarding the branding request to trademark SpamAssassin
as this was trademarked and abandoned previously.

Issues
------
No other issues requiring board attention.

19 Mar 2014 [Kevin A. McGrail / Jim]

Description
-----------
SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

Releases
--------
3.4.0-rc6 was released on 2/5/14.

3.4.0 was a big release introducing 2+ years of fixes and features. It was
released on 2/11/14.  Thanks to Sally Khudairi and the press team for their
help in announcing this to the world (http://s.apache.org/G6b).

Our rules releases have been fairly consistent with hiccups caused by both the
new 3.4.0 release and a need for more masscheckers.

The release of 3.4.1 is imminent.

No other releases for this quarter.


Community & Development
-----------------------
The most recent addition to our PMC is Adam Katz added on 2013-01-30.

The most recent addition to the committers is Joe Quinn added on 2014-02-27.

We also have 3 contributors invited to submit a CLA on the project and begin
moving towards committer karma.

We cleaned up
https://people.apache.org/committers-by-project.html#spamassassin fixing two
users with name problems (Henrik and Doc)

We also cleaned up the PMC by removing the following PMC members who are now
considered emeritus by the project and which the board approved unanimously:
 - Theo Van Dinter
 - Matt Kettler
 - Daryl C. W. O'Shea
 - Daniel Quinlan
 - Dale 'Doc' Schneider
 - Malte S. Stretz "

Our RuleQA dev list has been active and community support is good allowing the
project to publish rules more consistently.

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

We have migrated our website and dist to svnpubsub.

We are waiting on CentOS VM to transfer our zones and zones2 server off of
Solaris (Bug 6886)

We are working on getting our Jenkins build slave working under FreeBSD
instead of Solaris1 (Bug 6887).


Project Branding Requirements
-----------------------------
James Thompson at cPanel, Inc. drew and donated a new logo for the project.

The website was revised considerably with the new logo and the new release of
3.4.0.  Therefore, here is a report on Project Branding Report Checklist:

 DONE - Project Website Basics : homepage is project.apache.org

 DONE - Project Naming And Descriptions : use proper Apache forms, describe
product, etc.

 DONE - Website Navigation Links : navbar links included, link to
www.apache.org included

 DONE - Trademark Attributions : attribution for all ASF marks included in
footers, etc.

 IN PROCESS - Logos and Graphics : include TM, use consistent product logo
on your site - NOTE: Pending TM being added to one version of the logo to make
the announcement for the new logo.

 DONE - Project Metadata : DOAP file checked in and up to date

 DONE - added Read PMC Branding Responsibilities


Issues
------

As the project continues to battle spam, we find we are working quite often on
rules and related anti-spam resources that are not code such as real-time
blacklists (RBLs).  I believe there is considerable value to the project, the
foundation and the anti-spam community if we were to spearhead these resources
under the ASF umbrella.  I have begun the framework at
https://raptor.pccc.com/raptor.cgim?template=RBL with the intention to run
this under the project if permitted.  I would like feedback if this is
possible or if it needs to be run outside of ASF.

No other issues requiring board attention.

AI: Jim: discuss service hosting issue (licensing, trademark, etc.) with PMC.

15 Jan 2014 [Kevin A. McGrail / Roy]

Description
-----------
SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

Releases
--------
Release of version 3.4.0 is still imminent.  The latest release candidates
were created Jan 11th and Oct 10th.

Our rules releases have been much more consistent with 62 nightly rule
collections published since 8/9 which is a perfect record!

No other releases for this quarter.

3.4.0 will be a major release.  It introduces over two years of bug fixes
and features including the Bayes Redis back-end (bug 6879), eDNS changes (bug
6910), Native IPv6 Support, numerous URIBL.pm changes/features and a small API
change in libspamc (bug 6562) with many other subtle changes.

Overall, this release has been tested in many production-level environments
for nearly a year.  It is highly recommended and stable.

Additionally, as the project continues to battle spam, we find we are
working quite often on rules and related anti-spam resources that are not
code such as real-time blacklists (RBLs).  I believe there is considered
value to the project, the foundation and the anti-spam community if we were
to spearhead these resources under the ASF umbrella.  I have begun the
framework at https://raptor.pccc.com/raptor.cgim?template=RBL with the
intention to run this under the project if permitted.

Community & Development
-----------------------

The most recent addition to our PMC is Adam Katz added on 2013-01-30.

Our RuleQA dev list has been active and community support is good allowing
the project to publish rules more consistently.  We have had virtually no
problems this quarter getting rules published nightly!

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

Still need to migrate our website to svnpubsub (Bug 6885), Need to migrate
our zones and zones2 server off of Solaris (Bug 6886) and Need to get our
Jenkins build slave working under FreeBSD instead of Solaris1 (Bug 6887).


Project Branding Requirements
-----------------------------
None.

One note, cPanel reached out to us about changing our logo and we used the
opportunity to greatly improve the branding of Apache SpamAssassin in this
product including properly calling it Apache SpamAssassin and linking back to
the project website.  http://go.cpanel.net/paperlantern shows the new version
of their interface where you can click on Apache SpamAssassin and see the
changes.

Issues
------
Bill from Sonic.net for donated resources believed resolved.

No other issues requiring board attention.

18 Dec 2013 [Kevin A. McGrail / Doug]

No report was submitted.

16 Oct 2013 [Kevin A. McGrail / Brett]

SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

Releases
--------
Release of version 3.4.0 is still imminent.  The latest release candidates
were created Jun 20th and Oct 10th.

Our rules releases have been much more consistent with 62 nightly rule
collections published since 8/9 which is a perfect record!

No other releases for this quarter.

3.4.0 will be a major release.  It introduces nearly two years of bug fixes
and features including the Bayes Redis back-end (bug 6879), eDNS changes (bug
6910), Native IPv6 Support, numerous URIBL.pm changes/features and a small API
change in libspamc (bug 6562) with many other subtle changes.

Overall, this release has been tested in many production-level environments
for nearly a year.  It is highly recommended and stable.

Community & Development
-----------------------

Our RuleQA dev list has been active and community support is good allowing the
project to publish rules more consistently.  We have had much fewer problems
this quarter getting rules published nightly!

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

Need to migrate our website to svnpubsub. Bug 6885.  We may have a volunteer
for this task!

Need to migrate our zones and zones2 server off of Solaris to yet to be
determined resource. Bug 6886.

Need to get our Jenkins build slave working under FreeBSD instead of Solaris1.
Bug 6887.  Need access to the box to figure out what is killing it on the
build slave.


Project Branding Requirements
-----------------------------
None

Issues
------
None

18 Sep 2013 [Kevin A. McGrail / Jim]

No report was submitted.

No report was received; requested to report next month.

19 Jun 2013 [Kevin A. McGrail / Roy]

SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

NOTE: This report includes extra information since the last report
submitted was in December.

Releases
--------
No releases for this quarter.

Release of version 3.4.0 is still imminent.  A preliminary release candidate
was created on Jan 18 and a release candidate was created on Jun 17.
3.4.0 is a major release.  It introduces nearly two years of bug fixes and
features including the Bayes Redis back-end (bug 6879), eDNS changes (bug
6910), Native IPv6 Support, numerous URIBL.pm changes/features and a small API
change in libspamc (bug 6562) with many other subtle changes.

IPv6 Note: This was tested on an IPv6-only host (works fine except Razor,
using an external DNS recursive server on a dual-stack host).

And SpamAssassin was tested on a Raspberry PI (ARM6, Raspbian / Debian 7.0
Wheezy, perl 5.14.2) ... yes it's 20 times slower than an i7-960, but all
tests pass! (all long & network tests, some stress tests need increased timing
margins).

Overall, this release has been tested in many production-level environments
for nearly a year.  It is highly recommended and stable.

Community & Development
-----------------------
Need to migrate our zones and zones2 server off of Solaris to yet to be
determined resource. Bug 6886.

Need to migrate our website to svnpubsub. Bug 6885.

Need to get our Jenkins build slave working under FreeBSD instead of Solaris1.
Bug 6887.

Need access to the box to figure out what is killing it on the build slave.
Have not approached builds@ for approval for that process.

Adam Katz joined the PMC on February 4, 2013.

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

Our RuleQA dev list has been active and we have many requests to add accounts
to the project to publish rules more consistently.

Added http://sa-update.space-pro.be/ thanks to mail@rene-schwarz.com.

QUESTION FOR BOARD: Is using Coral a possibility for rules mirrors for ASF?
See https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6181

Project Branding Requirements
-----------------------------
None

Issues
------
None

15 May 2013 [Kevin A. McGrail / Roy]

No report was submitted.

AI: Roy to pursue a report for SpamAssassin

17 Apr 2013 [Kevin A. McGrail / Sam]

No report was submitted.

20 Mar 2013 [Kevin A. McGrail / Ross]

No report was submitted.

19 Dec 2012 [Kevin A. McGrail / Ross]

SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

Releases
--------
No releases for this quarter.

Release of version 3.4.0 is still imminent.  A preliminary release candidate
was created on Oct 15th.

This release will improve IPv6 support greatly.

Many people are running using trunk, however, which has great bugfixes and is
quite stable.

Community & Development
-----------------------
Need to migrate our zones and zones2 server off of Solaris to yet to be
determined resource.

Need to migrate our website to svnpubsub.  Believe this is impending.
Anything the board can do to extend the 12/31 deadline would be appreciated.

Need to get our Jenkins build slave working under FreeBSD instead of Solaris1.
Need access to the box to figure out what is killing it on the build slave.
What would the process be to approve that?

We are in the process of voting Adam Katz and John Hardin to the PMC. This
was held up by one of the nominees getting married and a copyright concern
on the PMC.

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

Our RuleQA dev list has been active and we have been adding more accounts
to the project to publish rules more consistently.

Lost one sa-update mirror and added http://sa-update.dnswl.org/ thanks to
matthias@leisi.net.

Project Branding Requirements
-----------------------------

No branding issues known but haven't reviewed May 2011 email.

Issues
------

None

Noting that the deadline has been known for a long time, the board will leave resolution of the SvnPubSub migration up to the Infrastructure team. The Branding section will need to be updated the next time SpamAssassin reports.

19 Sep 2012 [Kevin A. McGrail / Rich]

SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

Releases
--------
No releases for this quarter.  We recently revised our ReleaseGoals
(http://wiki.apache.org/spamassassin/ReleaseGoals) and chair will be doing
best to spearhead the 9/30 release.  In other words, the release of version
3.4.0 is still imminent.  This release will improve IPv6 support greatly.
Many people are running using trunk, however, which has great bugfixes and is
quite stable.

Community & Development
-----------------------
Chair attended F2F as guest.  Was attacked by ninja trashcan but otherwise was
impressed by the runnings of the board meetings.

Need to migrate our zones and zones2 server off of Solaris to yet to be
determined resource.

Need to migrate our website to svnpubsub.

Need to get our jenkins build slave working under FreeBSD instead of Solaris1.
Might need access to the box to figure out what is killing it on the build
slave though.

We are in the process of voting Adam Katz and John Hardin to the PMC.

The project users' list is active; questions get asked and answered.

The project dev list has been active with both committers and community
members contributing.

Our RuleQA project is off the ground and we added 14 masscheck accounts in
August:
 bpedersen
 odiserens
 mmiroslaw
 dlemke
 bpoliakoff
 jwallin
 hmundaca
 ewollesen
 bbailey
 vk5ztv
 talbers
 manderson
 acecchi
 maselig

The increased masscheck accounts is greatly helping our automated masscheck
process to publish rules more consistently.

Project Branding Requirements
-----------------------------

As a new chair who took over from a chair who left unexpectedly, I am not
aware of any branding issues but I wouldn't bet the farm on it.  I have the
original PMC project brand email from 5/31/2011 pulled out to review.

Issues
------

UPDATED: 9/15: Received response from Nick Bebout and confirmed he has a CLA.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6822

The issue below is likely to resolve without board input but it would be nice
to know if code that is licensed to ASF:

http://git.fedorahosted.org/cgit/auto-mass-check.git/tree/LICENSE

and written by people with CLAs:

Darxus, Warren Togami and Nick Bebout all listed at
http://people.apache.org/committer-index.html

but hosted externally can simply be brought in without explicit requests.
I chose the explicit request path to keep things more cordial but I don't like
ASF code hosted outside.


Is there a concern with pulling in code stored outside of ASF but licensed to
ASF?  Specifically http://git.fedorahosted.org/cgit/auto-mass-check.git/tree/

Chair sent the following email on 8/10 with no response to date:

To: nb@fedoraproject.org, wtogami@gmail.com &  Darxus@chaosreigns.com & SA PMC

Good Morning Gentleman,

I wanted to let you know that I've got a fire under masscheck right now and
one of the tasks we are working to solve is the SVN Revision: differences on
the uploaded logs.  This has led to a need to unify and standardize the
masscheck script because we'll be telling all masscheckers to use the same
script.  The new script will need to use a newer rsync channel that is more
secure which will solve Warren's concerns and we'll hopefully have some more
bells and whistles.

I'd like to invite you guys in on this because of your great work at
http://git.fedorahosted.org/cgit/auto-mass-check.git/log/.  But I also
understand if time doesn't allow so I want to ask explicitly for permission to
pull the code into the project.  I know it's noted at the top of the file that
it's but I wanted to ask anyway.  Plus, I also wanted to make sure I got the
info in CREDITS correct so my understanding is that the upgrades to the script
were by Nick Bebout, Warren Togami and Darxus.

Barring your objections, I'd like to get start on this ASAP but likely Monday
at the latest so if you could respond sooner than later, it would be greatly
appreciated.  I know the masschecks have stood idle too long but I also don't
want to lose the current momentum.

Regards,
KAM

20 Jun 2012 [Kevin McGrail / Rich]

6/4/2012

DESCRIPTION

SpamAssassin is a mail filter to identify spam. It is an intelligent email
filter which uses a diverse range of tests to identify unsolicited bulk email,
more commonly known as Spam. These tests are applied to email headers and
content to classify email using advanced statistical methods. In addition,
SpamAssassin has a modular architecture that allows other technologies to be
quickly wielded against spam and is designed for easy integration into
virtually any email system.

RELEASES

- The release of version 3.4.0 is still imminent.  This release will improve
 IPv6 support greatly.  Our project will aim for an immediate release.

CURRENT ACTIVITY
- On 4/18, Kevin A. McGrail was voted by BoD as Chair and VP, Apache
 SpamAssassin.
- Chair of Project attended BarCampDC, Enjoyed it and Would Recommend/Attend
 again.

COMMUNITY
- Many thanks owed to Doug Cutting, Nick Burch, Greg Stein, Christopher
 Schultz, and Tim Williams (and likely some other people I am forgetting) for
 helping me get my rudder in the right direction as chair.

- The project users' list is active; questions get asked and answered.
- The project dev list has been active with both committers and community
 members contributing.
- Alex Broens has been added to the PMC.
- Daniel Lemke has been added as a committer.

ISSUES
- We anticipate spending a lot of time migrating code on our zones over the
 coming months because our zones are being end of life'd.
- Rule updates are being published again for the first time since late
 February.

18 Apr 2012

Change the Apache SpamAssassin Project Chair

 WHEREAS, the Board of Directors heretofore appointed Daryl C. W. O'Shea
 to the office of Vice President, Apache SpamAssassin, and

 WHEREAS, the Board of Directors is in receipt of the resignation
 of Daryl C. W. O'Shea from the office of Vice President,
 Apache SpamAssassin, and

 WHEREAS, the Project Management Committee of the Apache SpamAssassin
 project has chosen by vote to recommend Kevin A. McGrail as the
 successor to the post;

 NOW, THEREFORE, BE IT RESOLVED, that Daryl C. W. O'Shea is relieved and
 discharged from the duties and responsibilities of the office
 of Vice President, Apache SpamAssassin, and

 BE IT FURTHER RESOLVED, that Kevin A. McGrail be and hereby is
 appointed to the office of Vice President, Apache SpamAssassin, to
 serve in accordance with and subject to the direction of the
 Board of Directors and the Bylaws of the Foundation until
 death, resignation, retirement, removal or disqualification, or
 until a successor is appointed.

 Special Order 7F, Change the Apache SpamAssassin Project
 Chair, was approved by Unanimous Vote of the directors
 present.

18 Apr 2012 [Daryl C. W. O'Shea / Brett]

- Daryl C.W. O'Shea herein resigns his role as Chair and VP, Apache
 SpamAssassin.
- Kevin A. McGrail was chosen by vote to succeed Daryl C. W. O'Shea
 as Chair and VP, Apache Spamassassin.
- A draft resolution for the board's consideration in changing the
 chair is attached.
- The release of version 3.4.0 is imminent.  This release will improve
 IPv6 support greatly.  Our project will aim for April 30th for this
 release per our release goals at
 http://wiki.apache.org/spamassassin/ReleaseGoals
- The committee finalized the Apache SpamAssassin PMC Policy for DNSBL
 Inclusion at:
 http://wiki.apache.org/spamassassin/DnsBlocklistsInclusionPolicy
- Two Blacklist have implemented our Block Notification Rule to allow
 adminstrators to know when they have exceeded blacklist restrictions
 on queries.
- The project users' list is active; questions get asked and answered.
- the project dev list has been active with both committers and
 community members contributing.
- We participated in the Google Code-In and mentored on several projects
- We have registered to Mentor in the Google Summer of Code
- We anticipate spending a lot of time migrating code on our zones over
 the coming months because our zones are being end of life'd.
- Alex Broens has been voted by the PMC and an invite to the project
 PMC is pending

21 Mar 2012 [Daryl C. W. O'Shea / Greg]

No report was submitted.

AI: Greg to pursue a report for SpamAssassin

15 Feb 2012 [Daryl C. W. O'Shea / Larry]

No report was submitted.

AI: Larry to pursue a report for SpamAssassin

24 Jan 2012

A report was expected, but not received

21 Dec 2011 [Daryl C. W. O'Shea / Jim]

No report was received from SpamAssassin.

21 Sep 2011 [Daryl C. W. O'Shea / Brett]

Status report for the Apache SpamAssassin Project

- Apache SpamAssassin 3.3.2 was released on June 16, 2011.  It was our
 first code release in 15 months as focus has been on rule development
 and sa-update update releases.

- A new release is in the works.  It will probably be version 3.4.0.
 Release date will be sometime this fall.

- Release targets/goals are now published on our website.

- Some users are asking for access to our ASF infrastructure via IPv6
 for use by some IPv6-only hosts.  I think we'll see more of these
 requests as I think mail servers are early candidates for conversion
 to IPv6 (specifically one or more of a domain's MXes).

- We continue to recruit contributors of mass-check results for use in
 scoring rules; we've signed up some more; we could use some more.

- Users' list is active; questions get asked and answered.

- Dev list has been active with both committers and community members
 contributing; we're keeping an eye out for new potential committers.

== Branding ==

** No change since last report. **

While we've been careful to ensure "proper" branding of Apache SpamAssassin
since joining the ASF nearly a decade ago, we have not started on meeting
the specific requirements of the current branding requirements.  You'd be
hard pressed not to know we were "Apache SpamAssassin" when visiting our
non-wiki web pages.  Some areas of our wiki need updating to reflect the
Apache brand.

The following is a cursory review of our current branding:

Project Website Basics: mostly compliant

 All but sa-update mirrors are hosted on ASF infrastructure under the
 apache.org domain.

 Currently no link to www.apache.org on the project home page.

Project Naming And Descriptions: somewhat compliant

 The project home page uses "Apache SpamAssassin" prominently.  The download
 page isn't as good at using "Apache" in front of "SpamAssassin, but I think
 it'd be pretty difficult to miss the big bold "The Apache SpamAssassin
 Project" at the top of every page on our website (excluding the wiki).

 We do not have a one sentence project description on our home and
 download pages, although I note that the example provided at
 http://www.apache.org/foundation/marks/pmcs#naming is actually three
 sentences in length, so I don't feel to bad about our 5 feature bullet
 points describing the project on our home page.

Website Navigation Links: not compliant

 We fail on all points.

Trademark Attributions: not compliant

 While we're generally good about using the term "Apache SpamAssassin" we're
 short on "TM"s.

Logos and Graphics: half way there

 We're consistent with logo use but lacking the "TM"s.

Project Metadata: in progress

 A DOAP file exists.  It's accurate, except for an incorrect link to our bug
 tracker.

Other Trademark Guidelines:

 spamassassin.org has been assigned to and managed by the ASF for the better
 part of a decade.

15 Jun 2011 [Daryl C. W. O'Shea / Doug]

- release of version 3.3.2 is imminent!  our first code release in 15 months
 as focus has been on rule development and sa-update update releases.

- we continue to recruit contributors of mass-check results for use in
 scoring rules; we've signed up some more; we could use some more.

- we've added more safeguards to the sa-update update generation process to
 ensure quality updates; primarily we've made sure that test rules don't
 slip out in published updates.  committers have also been reminded that
 they need to be careful in identifying rules that should not be published.

- we've removed two releases from dist/ to save the mirrors a couple of MB.

- users' list is active; questions get asked and answered.

- dev list has been active with both committers and community members
 contributing; we're keeping an eye out for new potential committers.

== Branding ==

June 2011: The chair will open bugs in the project's bug tracker for each of
the required branding action items so that branding things start to happen.

** No change since last report. **

While we've been careful to ensure "proper" branding of Apache SpamAssassin
since joining the ASF nearly a decade ago, we have not started on meeting
the specific requirements of the current branding requirements.  You'd be
hard pressed not to know we were "Apache SpamAssassin" when visiting our
non-wiki web pages.  Some areas of our wiki need updating to reflect the
Apache brand.

The following is a cursory review of our current branding:

Project Website Basics: mostly compliant

 All but sa-update mirrors are hosted on ASF infrastructure under the
 apache.org domain.

 Currently no link to www.apache.org on the project home page.

Project Naming And Descriptions: somewhat compliant

 The project home page uses "Apache SpamAssassin" prominently.  The download
 page isn't as good at using "Apache" in front of "SpamAssassin, but I think
 it'd be pretty difficult to miss the big bold "The Apache SpamAssassin
 Project" at the top of every page on our website (excluding the wiki).

 We do not have a one sentence project description on our home and
 download pages, although I note that the example provided at
 http://www.apache.org/foundation/marks/pmcs#naming is actually three
 sentences in length, so I don't feel to bad about our 5 feature bullet
 points describing the project on our home page.

Website Navigation Links: not compliant

 We fail on all points.

Trademark Attributions: not compliant

 While we're generally good about using the term "Apache SpamAssassin" we're
 short on "TM"s.

Logos and Graphics: half way there

 We're consistent with logo use but lacking the "TM"s.

Project Metadata: in progress

 A DOAP file exists.  It's accurate, except for an incorrect link to our bug
 tracker.

Other Trademark Guidelines:

 spamassassin.org has been assigned to and managed by the ASF for the better
 part of a decade.

16 Mar 2011 [Daryl C. W. O'Shea / Geir]

- Steve Freegard (smf) became an Apache SpamAssassin committer!

- nightly sa-update updates have temporarily ceased since our last report
 to the board due to an inadequate amount of spam being submitted; one
 of the major factors in this was the loss of my own (Daryl) spam
 corpora generating infrastructure to an IBM Deathstar that I had
 thought I had taken out of service long ago

- we had a new mailing list created to discuss rule update related stuff:
 ruleqa@spamassassin.apache.org

- we've recruited a number of new mass-check contributors; hopefully
 nightly updates will resume soon

- we continue to solicit new mass-check contributors; the more ham
 and spam emails that we can test rules against the better the
 accuracy of SpamAssassin's published ruleset.

- users' list is active; questions get asked and answered.

- dev list has been active with both committers and community members
 contributing

== Branding ==

** No change since last report. **

While we've been careful to ensure "proper" branding of Apache SpamAssassin
since joining the ASF nearly a decade ago, we have not started on meeting
the specific requirements of the current branding requirements.  You'd be
hard pressed not to know we were "Apache SpamAssassin" when visiting our
non-wiki web pages.  Some areas of our wiki need updating to reflect the
Apache brand.

The following is a cursory review of our current branding:

Project Website Basics: mostly compliant

 All but sa-update mirrors are hosted on ASF infrastructure under the
 apache.org domain.

 Currently no link to www.apache.org on the project home page.

Project Naming And Descriptions: somewhat compliant

 The project home page uses "Apache SpamAssassin" prominently.  The download
 page isn't as good at using "Apache" in front of "SpamAssassin, but I think
 it'd be pretty difficult to miss the big bold "The Apache SpamAssassin
 Project" at the top of every page on our website (excluding the wiki).

 We do not have a one sentence project description on our home and
 download pages, although I note that the example provided at
 http://www.apache.org/foundation/marks/pmcs#naming is actually three
 sentences in length, so I don't feel to bad about our 5 feature bullet
 points describing the project on our home page.

Website Navigation Links: not compliant

 We fail on all points.

Trademark Attributions: not compliant

 While we're generally good about using the term "Apache SpamAssassin" we're
 short on "TM"s.

Logos and Graphics: half way there

 We're consistent with logo use but lacking the "TM"s.

Project Metadata: in progress

 A DOAP file exists.  It's accurate, except for an incorrect link to our bug
 tracker.

Other Trademark Guidelines:

 spamassassin.org has been assigned to and managed by the ASF for the better
 part of a decade.

15 Dec 2010 [Daryl C. W. O'Shea / Jim]

- we've been releasing nightly sa-update updates pretty consistently since
 our last report to the board; these incorporate new rules and automatically
 generated scores based on nightly statistical results generated from
 current spam email.

- there is interest in releasing a new minor release in the near future,
 talks about this are underway.

- we continue to solicit new mass-check contributors; the more ham
 and spam emails that we can test rules against the better the
 accuracy of SpamAssassin's published rulesest.

- development activity has been focused on preparing Apache SpamAssassin for
 all aspects of an IPv6 world... from email (and spam!) originating on IPv6
 hosts, traversing IPv6 hosts, and ultimately being received by IPv6 hosts.
 support was already decent in version 3.3.0 (and somewhat before then),
 we're now focused on integrating things like IPv6 DNS blocklists and
 whitelists.  the ASRG (Anti-Spam Research Group) is also currently
 discussing best practices with the aim of releasing an RFC to specify a
 standard for everyone to implement in completely incompatible ways.  as
 always SpamAssassin will remain flexible to whatever varying number of
 methods become popular.

- users' list is active; questions get asked and answered.

== Branding ==

While we've been careful to ensure "proper" branding of Apache SpamAssassin
since joining the ASF nearly a decade ago, we have not started on meeting
the specific requirements of the current branding requirements.  You'd be
hard pressed not to know we were "Apache SpamAssassin" when visiting our
non-wiki web pages.  Some areas of our wiki need updating to reflect the
Apache brand.

The following is a cursory review of our current branding:

Project Website Basics: mostly compliant

 All but sa-update mirrors are hosted on ASF infrastruture under the
 apache.org domain.

 Currently no link to www.apache.org on the project home page.

Project Naming And Descriptions: somewhat compliant

 The project home page uses "Apache SpamAssassin" prominently.  The download
 page isn't as good at using "Apache" in front of "SpamAssassin, but I think
 it'd be pretty difficult to miss the big bold "The Apache SpamAssassin
 Project" at the top of every page on our website (excluding the wiki).

 We do not have a one sentence project description on our home and
 download pages, although I note that the example provided at
 http://www.apache.org/foundation/marks/pmcs#naming is actually three
 sentences in length, so I don't feel to bad about our 5 feature bullet
 points decribing the project on our home page.

Website Navigation Links: not compliant

 We fail on all points.

Trademark Attributions: not compliant

 While we're generally good about using the term "Apache SpamAssassin" we're
 short on "TM"s.

Logos and Graphics: half way there

 We're consistent with logo use but lacking the "TM"s.

Project Metadata: in progress

 A DOAP file exists.  It's accurate, except for an incorrect link to our bug
 tracker.

Other Trademark Guidelines:

 spamassassin.org has been assigned to and managed by the ASF for the better
 part of a decade.

The honest assessments are appreciated.

22 Sep 2010 [Daryl C. W. O'Shea / Bertrand]

Status report for the Apache SpamAssassin Project

- Dan McDonald became our latest mass-check corpus volunteer;
 we now have enough ham email in our contributed corpus, again, to
 be able to generate and publish nightly rule updates

- we continue to solicit new mass-check contributors; the more ham
 and spam emails that we can test rules against the better the
 accuracy of SpamAssassin's published rulesest

- development activity is quiet, but no major issues are outstanding

- users' list is active; questions get asked and answered

16 Jun 2010 [Daryl C. W. O'Shea / Geir]

Status report for the Apache SpamAssassin Project

- SpamAssassin 3.3.1 was released on March 19, 2010.  This was a minor
 bug-fix release to fix a few small bugs and add some new rules.

- SpamAssassin 3.3.2 is nearing release.  It too will be a minor
 bug-fix release.

- Our community mailing lists have been well behaved as of late.  List
 traffic is steady.  Volume seems to be up over previous years.

- Daniel Lemke is working to improve native Win32 support for
 SpamAssassin.

- We're slowly progressing to anti-virus update-like frequency of
 anti-spam rule updates.  We're currently in need of more contributors
 of hand-sorted ham (good, non-spam) email for rule QA-testing.

17 Mar 2010 [Daryl C. W. O'Shea / Geir]

Status report for the Apache SpamAssassin Project

- SpamAssassin got a little publicity at the start of the year due to a
 bug in one of our rules that caused the rule to hit on most mail sent
 on or after Jan 1, 2010.  The rule added, depending on scoreset in
 use, up to 3.4 points to the message, effectively reducing a default
 threshold of 5.0 to 1.6.  This would have increased the rate at which
 ham would be falsely marked as spam to approximately 2%.

 As soon as we became aware of the situation on Jan 1, 2010 we
 published an update via our sa-update automatic rule updates and
 started getting the word out (project home page, ASF Blog, all
 SpamAssassin mailing lists and committers@apache.org) that people
 needed to update their rules.  Within 40 hours over 100,000 sites had
 updated their rules.  Another 100,000 were updated in the following
 24 hours.

- SpamAssassin 3.3.0 was released on Jan 27, 2010.  Like previous
 releases, 3.3.0 catches more of today's spam than older releases.
 The release has been well received with no significant issues
 reported by the approximately 10% of sites that have already upgraded
 from 3.2.x versions.

- Sally Khudairi assisted in releasing a press release announcing the
 release of Apache SpamAssassin 3.3.0, the project's first major
 release in two years.

- The SpamAssassin PMC Chair continues to follow the legal-internal
 list; everything there is currently in an OK state in regards to the
 SpamAssassin project.

- The project started publishing fully automated rule updates (after
 the rules pass through a series of automated QA steps).  We expect
 that some teething issues will inevitably pop up, and one has so far,
 so we're keeping a close eye on it.

- Infra has setup a 'spamassassin_role' svn account for our automated
 rule update processes to use.  The account will only be used to
 commit automated changes to our DNS zones and changes to our rule
 updates generated by our statistically driven rule update processes.
 As always, all intellectual property coming into the project will be
 via a commit by a committer and not via this 'spamassassin_role'
 account.

- The SpamAssassin project has talked to Infra about getting the
 spamassassin.org DNS zone's hidden master moved to people.apache.org.
 It is currently running on spamassassin.zones.apache.org, which Infra
 is not in favour of.  The SpamAssassin project agrees that, while
 less convenient for the SpamAssassin project, having the
 spamassassin.org zone's hidden master on people.a.o would be a more
 reliable setup since people.a.o's uptime is higher in priority, for
 Infra, than the Solaris zones.

- We continue to have an issue with one individual causing unrest on
 the SpamAssassin Users' mailing list.  After we removed him from the
 mailing list in December for harassing users and vendors (of DNSBLs)
 he signed back up using a new name.  The new name behaved for quite
 some time so we let it be rather than starting a game of
 whack-a-mole.  Now, recently, he's started posting with another new
 name.  This new name is back to causing unrest.  If the issues
 persist we may have to start a game of whack-an-IP and have Infra
 start blocking his IP.  We'll let the Board know if we take any
 action to remove the user again.

--Daryl C. W. O'Shea, on behalf of the SpamAssassin PMC.

Shane to inquire as to rules being published (released?) without adequate oversight (e.g. a vote).

16 Dec 2009 [Daryl C. W. O'Shea / Jim]

- We're well on our way to a major release, 3.3.0.  Beta1 was recently
 cut nearly two weeks ago, no major issues so far.

- We had an issue with a users@sa list member harassing/attacking a
 representative of Return-Path and sending abusive emails to PMC members.
 We've revoked posting privs from the user and made it clear on the users
 list that such behaviour will not be tolerated in our community.  board@
 was copied in my email titled "Note from SA PMC: Removal of an abusive
 list member", sent at Tue, 08 Dec 2009 23:01:59 -0500.  Other than that,
 the mailing lists are active and healthy.

- We added two new committers since the last report: Warren Togami Jr.
 (wtogami) and Adam Katz (khopesh).  That brings our active committer
 count to approximately 13.

Justin gave kudos to the project for taking effective action on the mailing list issue.

23 Sep 2009 [Daryl C. W. O'Shea / Brian]

- we're working towards a 3.3.0 release (our first major release in over two
 years) -- rule score generation mass-checks are underway; I expect a
 release date inside of the next two months

- mailing lists are active, which is always good

15 Jul 2009 [Daryl C. W. O'Shea / Geir]

- we added three new committers to the ASF and the project:
 Alex Broens, John Hardin and Henrik Krohns; congrats to them!

- a push for a 3.3 release has begun, 3.3.0-alpha1 is out

- the mailing lists have their usually flow of questions and
 answers, which is good

- Karsten Braeckelmann (availid KB) volunteered to be a mailing
 list moderator, which is also good :)

17 Jun 2009 [Daryl C. W. O'Shea / Sam]

Sam to pursue a report for SpamAssassin

18 Mar 2009 [Daryl C. W. O'Shea / Greg]

- users' mailing list seems to be healthy with a number of questions
 being asked and most, if not all, questions be answered/resolved daily

- we haven't heard anything about our trademarks being registered, we'll
 have to ping Larry about that

- we've been working with ReturnPath (a major email accreditor) to have
 them improve their DNSBLs, respond better to abuse by their customers,
 work better with SpamAssassin users (regarding abuse reports
 concerning their customers) and help us better guage our install base;
 they've also started accrediting email from 140.211.11.2 for us gratis

 if spam (e.g. backscatter, or relayed-via-list spam) is relayed
 through that IP, we may lose the accreditation, but it won't affect
 our status in a negative way -- we won't get blacklisted; so there's
 no downside there

- jm moved I/O heavy operations off spamassassin.zones onto
 spamassassin2.zones at the request of infrastructure

--Daryl C. W. O'Shea, on behalf of the SpamAssassin PMC.

17 Dec 2008 [Daryl C. W. O'Shea / Geir]

- not a lot of code development recently; mainly performance tweaks and
 changes to avoid triggering hard to debug Perl bugs

- very few, if any, really pressing open bugs (lots of enhancement ideas
 though); I'm confident anything major would be quickly addressed

- users' mailing list seems to be healthy with a number of questions
 being asked and most, if not all, questions be answered/resolved daily

- Larry Rosen is (hopefully) still in the process of fully registering
 the two SpamAssassin trademarks

- no committer representation at ApacheCon... probably has a lot to do
 with none of our active committers doing SpamAssassin as a central
 part of their day job (and ApacheCon being reportedly more web, than
 email, centric)

Sam notes that the holdup isn't Larry, but rather Sam.

17 Sep 2008 [Daryl C. W. O'Shea / J Aaron]

- we released Apache SpamAssassin 3.2.5 on June 12, 2008

- not a lot of development over the summer, which has been a slow period for
 us over the last few years

- we've vacated the "vmsa" VMWare instance to take our load off of that
 machine and moved into a new solaris zone on odyne

- I took over as PMC chair from Justin Mason, thanks Justin!

- we're in the process of getting PRC, legal and then board approval to get
 "actual use" documents filed for our existing "SPAMASSASSIN" and "POWERED
 BY SPAMASSASSIN" "intent to use" trademarks filed; apparently this will be
 inexpensive and we have some volunteers on the legal list to get this done

20 Aug 2008

Change the Apache SpamAssassin Project Chair

 WHEREAS, the Board of Directors heretofore appointed Justin Mason to
 the office of Vice President, Apache SpamAssassin, and

 WHEREAS, the Board of Directors is in receipt of the resignation of
 Justin Mason from the office of Vice President, Apache SpamAssassin,
 and

 WHEREAS, the Project Management Committee of the Apache SpamAssassin
 project has chosen by vote to recommend Daryl C. W. O'Shea as the
 successor to the post;

 NOW, THEREFORE, BE IT RESOLVED, that Justin Mason is relieved and
 discharged from the duties and responsibilities of the office of Vice
 President, Apache SpamAssassin, and

 BE IT FURTHER RESOLVED, that Daryl C. W. O'Shea be and hereby is
 appointed to the office of Vice President, Apache SpamAssassin, to
 serve in accordance with and subject to the direction of the Board of
 Directors and the Bylaws of the Foundation until death, resignation,
 retirement, removal or disqualification, or until a successor is
 appointed.

 Special Order 7A, Change the Apache SpamAssassin Project
 Chair, was approved by Unanimous Vote of the directors
 present.

25 Jun 2008 [Justin Mason / Jim]

Releases

- We are in the process of voting on tarballs for a 3.2.5 release.

Community

- added Karsten Bräckelmann as a committer.

Legal

- nothing of note.

Other

- We're sharing more of our spamtrap data with third parties.  Barracuda are
 sending spam our way, in a reciprocal arrangement.  In addition, we are
 hosting a "frontline" spamtrap server as a virtual machine at Amazon's EC2,
 paid for by MailChannels, and in return send them some of our spam which they
 use to test their product.

 By doing this we're ensuring that we have a good mix of sources of spam,
 which helps deal with spammers hiding their output from us.

 (it'd be nice to host these on ASF infrastructure, but it takes a lot of CPU
 and bandwidth for little real gain; it is a lot easier to use third-party
 hardware/VMs.)

19 Mar 2008 [Justin Mason / J Aaron]

Releases

- we released SpamAssassin 3.2.4 on 2008-01-05.

Community

- added Mark Martinec as a PMC member.

Legal

- the crypto export policy has been applied, and
 http://www.apache.org/licenses/exports/ has been updated to include
 SpamAssassin, with a 5D002 ECCN code.

Other

- we've been discussing the possibility of building a Hadoop-based
 mass-checking system; there's nothing concrete there yet, though.

19 Dec 2007 [Justin Mason / Greg]

Nothing much has happened in the past 3 months.

We've moved our backend stuff to use gaea and vmsa as the core hosts for
rule update generation. Unfortunately, external time limitations are
getting in the way, I think, so progress is slow.

Approved by General Consent.

19 Sep 2007 [Justin Mason / Greg]

- We won an Infoworld "Best Of Open Source Software 2007" award:
 http://www.infoworld.com/article/07/09/10/37FE-boss-security_1.html

- Multiple vendors are looking to make donations that we'd like Infra to
 use to procure hardware for us, in order to relieve the strain we
 apparently cause to the zones machine.  Discussions are ongoing with
 Infrastructure about this.

- SpamAssassin 3.2.2 was released on 25th July, with 3.2.3 released on
 August 8th.

- We added Mark Martinec as a committer.

- Bob Menschel and John Gardiner Myers both moved to the "inactive
 committers" list, since they haven't committed code in six months;
 hopefully they'll be back soon.

Approved by General Consent.

20 Jun 2007 [Justin Mason / Jim]

- SpamAssassin 3.2.0, a new major release, hit www.apache.org/dist at the
 start of May.  hooray!

- SpamAssassin 3.2.1 and 3.1.9 were released last week, in response to the
 discovery of a local-user symlink-attack DoS security issue in a
 little-used feature of "spamd" (CVE-2007-2873). doh.

- we adopted a new PMC policy, whereby virtually all active committers are
 on the PMC, based on their activity level.   This resulted in the
 addition of Doc Schneider, Matt Kettler, and Kevin A. McGrail to the
 PMC.

- We have a couple of Google Summer of Code projects underway:
 'Implementing "Dobly" Noise Reduction for SpamAssassin', by Jianyong
 Dai, and 'The Persistent Database Connection Plugin' by Zhang Shunchang,
 both mentored by Michael Parker.

It was noted that 'Dobly' is, in fact, correct.

Approved by General Consent.

28 Mar 2007 [Justin Mason / Sander]

- A security issue was reported, and assigned CVE-2007-0451, which affects
 SpamAssassin's handling of lots of large URLs, causing denial of service
 through heavy memory consumption.  The message was found "in the wild", but
 was a non-spam message; attackers are not using this (yet).  We released
 SpamAssassin 3.1.8 to fix it.

- SpamAssassin 3.2.0, our next major release, is impending; hopefully only
 weeks away.  We've completed the heavy CPU lifting (the "mass-check" step and
 new score generation); it's just a few little bugs and release-candidate
 tarballs to go.

- We changed our prerelease issuing policy; previously, we had required 3
 committer +1's to name a snapshot as a developer-test prerelease. However, we
 were running into situations where this was failing due to lack of committer
 votes.  We've now voted on and switched to a model where a prerelease tarball
 can be issued with just "lazy consensus".

- we are discussing changing our committer/PMC structure, adopting something
 closer to a Roy-style "all committers == PMC" model, instead of the current
 one where our PMC is a smaller "core" of the committer group.  Right now,
 we're thinking that committers who have been committers for over 6 months,
 and have committed any code in the previous 3 months, automatically receive
 an invitation to join the PMC.  Comments welcome!

Approved by General Consent.

20 Dec 2006 [Justin Mason / Justin]

- We won 'Best Linux-based Anti-spam Solution' at the Linux New Media
 Awards 2006, winning 69% of the vote!

- SpamAssassin 3.1.6 was released in October, swiftly followed by a
 quick-fix 3.1.7 release -- we're allowed one brown-bag moment per
 stable release branch ;)

- SpamAssassin 3.2.0 is rapidly nearing release -- we're getting to the
 stage where we could start performing the time-consuming
 score-generation process with the current code and ruleset.  We'll
 probably do this in January (although haven't yet put it to a vote...)

- we added ASF member Tony Finch as a committer.

- no change to the PMC composition.

Justin asked if there was any PR about the Linux New Media Aware received by SpamAssassin. Jim reported that there was none from the PRC, nor was any requested. The board noted that the projects should be encouraged to work with the PRC and to update the "News" area of the site when noteworthy events or awards happen.

Approved by General Consent.

20 Sep 2006 [Justin Mason / Henri]

- PMC news: we added Daryl O'Shea to the PMC. I took over as PMC chair
 from Daniel Quinlan.  (Thanks Dan!)

- We released SpamAssassin 3.1.5, updating our source licensing comments
 to the new style as part of that.  Shockingly, this is about the third
 or fourth release in a row where we've been on-schedule, somehow ;)

- Several SpamAssassin committers met up at CEAS 2006, one of the major
 anti-spam conferences, and resolved a long-standing veto deadlock over
 plans for part of the SpamAssassin core; good news.

- We adopted a security issue disclosure policy for the project; 1.
 notifications of security issues in SpamAssassin are made in advance to
 vendor-sec and anyone the committers feel like informing, as long as it
 is kept private; 2. public releases are made at an agreed upon time,
 ideally 1-2 business days after the notification to vendor-sec.

- Our 3 Google Summer of Code projects have completed, and two at least
 (as far as I can see) have produced very useful code.

- We are having a little trouble with an external SpamAssassin
 rule-development project, which a few of us feel is distracting
 potential committers from joining our project; however, we're as yet
 unsure what to do about this, or if anything needs to be done.

Justin asked if there was a need for an ASF-wide security disclosure policy, since SA created their own? The board agreed that the Security Team should work on that. Ken asked who the "I" was mentioned in the report ('I took over') and Justin noted that it was Justin Mason. It was noted that the SA project is concerned about an external rule project, and the board was not sure why they were concerned about it. For example, the HTTP project does not worry about external module sites. Henri volunteered to contact the SA PMC to determine what their concerns are.

Approved by General Consent

19 Jul 2006

Change chair of the Apache SpamAssassin Project

 WHEREAS, the Board of Directors heretofore appointed Daniel
 Quinlan to the office of Vice President, Apache SpamAssassin
 Project, and

 WHEREAS, the Board of Directors is in receipt of the
 resignation of Daniel Quinlan from the office of Vice
 President, Apache SpamAssassin Project;

 NOW, THEREFORE, BE IT RESOLVED, that Daniel Quinlan is relieved
 and discharged from the duties and responsibilities of the
 office of Vice President, Apache SpamAssassin Project, and

 BE IT FURTHER RESOLVED, that Justin Mason be and hereby is
 appointed to the office of Vice President, Apache SpamAssassin
 Project, to serve in accordance with and subject to the
 direction of the Board of Directors and the Bylaws of the
 Foundation until death, resignation, retirement, removal or
 disqualification, or until a successor is appointed.

 Special Order 6C, Resolution to change chair of the Apache SpamAssassin
 Project, was approved by Unanimous Vote.

19 Jul 2006 [Daniel Quinlan / Cliff]

* 2006-05-25: SpamAssassin 3.1.2 released.

* Security releases to address CVE 2006-2447: SpamAssassin 3.1.3 on
 2006-06-06 and SpamAssassin 3.0.6 on 2006-06-05.

* Continued development on SpamAssassin 3.2.

* PMC Chair is changing from Daniel Quinlan to Justin Mason.

* Michael Parker is giving two talks on SpamAssassin at ApacheCon US.

* No issues (other than the PMC chair change) that require attention
 from the Board at this time.

Henri noted the CVE advisory: http://spamassassin.apache.org/advisories/cve-2006-2447.txt

Approved by General Consent

27 Jun 2006 [Daniel Quinlan / Cliff]

Tabled due to time constraints.

15 Mar 2006 [Daniel Quinlan / Stefano]

- SpamAssassin 3.1.1 was released.

- One new committer added: Kevin A. McGrail.

- (actually happened December) One new PMC member added: Sidney Markowitz

- The rules project is making good progress.

Approved by General Consent.

21 Dec 2005 [Daniel Quinlan / Sam]

Well, even though our bullets were written and I was at the Hackathon,
I somehow failed to get this in before the meeting.  I assume I should
check this into January at this point...

 * On December 6, 2005, we released SpamAssassin 3.0.5, a maintenance
   release.

 * We moved from our BZ install to issues.apache.org.  There are
   still some outstanding issues, but it's 95+% complete.

 * We (still) have an open query with legal regarding US export
   control status of SpamAssassin and what, if any, action we need to
   take in that regard.

 * Infrastructure created to encourage and facilitate SpamAssassin
   rule development in the new SpamAssassin rule project.

 * Added several new committers on the rule-development side of the
   project.

Approved by General Consent.

21 Sep 2005 [Daniel Quinlan / Justin]

Highlights of Events from June to now:

* SpamAssassin 3.1.0 was released on September 14th.

* Working to create a rule-development sub-project to help facilitate
rule acceptance for SpamAssassin.

* We have an open query with legal regarding US export control status of
SpamAssassin and what, if any, action we need to take in that regard.

* Currently in discussions with Yahoo! regarding their proposed DKIM
standard and its patent licensing, which appears to be ASL friendly, at
this stage.

* ASF Integration: spamassassin.org has now been transferred to the ASF

* Added two new committers, waiting for infrastructure to create
accounts.

Approved by General Consent.

22 Jun 2005 [Daniel Quinlan]

 * SpamAssassin 3.0.3 and 3.0.4 were released.  3.0.4 was released on
   June 6th to address a denial of service vulnerability.  The
   vulnerability was announced on June 15th in coordination with
   vendors (with security@apache.org in the loop).

 * SpamAssassin 3.1.0-pre1 was released on June 17th.

 * Since 5 SpamAssassin developers will be in the Palo Alto, CA area
   during the CEAS conference we're planning a one-day SpamAssassin
   hackathon the Saturday after the conference ends.

 * SpamAssassin 3.1.0 is roughly scheduled to be completed and
   released between July 13th and July 20th.

 * Number of committers, PMC members, etc. stable.

Approved by General Consent.

30 Mar 2005 [Daniel Quinlan]

 Support needed:

 * I need some legal help from some quarter to finish the Yahoo! patent
   DomainKeys license review, but I had some help from Larry Rosen, so I
   might just wing it at this point.

 * There's an open question about whether we can implement our own
   distributed checksum system to detect bulk email in the face of the
   Commtouch patent (or if we can somehow get the patent invalidated).

Highlights of Events from December to now:

 * SpamAssassin 3.0.2 was released on December 16.

 * In February, receiving twice as many votes as the closest contender,
   we took top honors in the Anti-Spam category of Datamation's Product
   of the Year: http://itmanagement.earthweb.com/secu/article.php/3481971

 * We are steady at 6 PMC members from a pool of 9 active committers.
   We added a new committer, Daryl C. W. O'Shea, but increased from 2 to
   3 inactive committers.

 * We added a new "blogspam" list (instead of creating a subproject).
   Some discussion has ensued, but anti-blogspam development outside of
   the list seems stronger than on the list.

 * We lost some core functionality due to a broad patent.  The Commtouch
   patent on bulk email detection (and their usage of it) caused DCC to
   no longer be open source.

 * Reasonable progess on finishing the ASF infrastructure integration.

 * SpamAssassin 3.1 real soon now.  It will have lots of good stuff.

Apache SpamAssassin Project report approved as submitted by general consent.

15 Dec 2004 [Daniel Quinlan]

 Support needed:

 * We need attention from ASF legal on standards licensing issues,
   particularly the Yahoo! patent license.

Highlights of Events from August to now:

 * SpamAssassin 2.64 was released on 2004-08-04 as a non-ASF release
   to address a potential denial of service attack open to certain
   malformed messages (only seen once in wild, probably broken
   spamware).  3.0.0 was fixed prior to release.

 * We had a successful 3.0.0 release on 2004-09-22 and a successful
   3.0.1 release on 2004-10-22.

 * We finished our logo contest in time for the 3.0.0 release, the
   winning logo came from Christian Rauh.

 * We are roughly targeting February for our 3.1 release which
   focuses on speed and accuracy improvements.

 * The ASF, SpamAssassin PMC, and James PMC submitted comments to
   IETF MARID working group regarding patent-encumbrances in the
   Sender-ID specification.  We dodged a bullet where the IETF might
   have endorsed an email standard incompatible with open source.

 * We are still talking (primarily through Larry Rosen of OSI) to
   Microsoft regarding the Sender-ID patent license (Microsoft is
   still strongly pushing the technology) and are also in the process
   of reviewing the Yahoo! patent license for DomainKeys, which might
   set a reasonable precedent for email patent licensing.

 * We added a new PMC member, Michael Parker.  We now have 6 PMC
   members from a pool of 9 active committers.

 * ApacheCon: There were 3 SpamAssassin sessions at ApacheCon and a
   BOF: SpamAssassin Tutorial, Daniel Quinlan New and upcoming
   features in SpamAssassin v3, Theo Van Dinter Storing SpamAssassin
   User Data in SQL Databases, Michael Parker

 * ASF integration progress:
     - Replacing the one private non-ASF mailing list still in use
       with an ASF list is still to be done.
     - Moving the spamassassin.org domain: not much progress.
       Changing ownership for .org domains is apparently
       non-trivial. However, the spamassassin.org domain is not
       really used any more.

Apache SpamAssassin Project report approved as submitted by general consent.

18 Aug 2004 [Daniel Quinlan]

 Highlights of Events from the last month:

 * Pre-releases: SpamAssassin 3.0.0-pre1, SpamAssassin 3.0.0-pre2

   The project is zeroing in on our 3.0.0 release, we've completed the
   first set of mass-checks (contributors submit corpora results and
   they are used to train the score optimizer).  pre3 should be coming
   out in the next few days, followed by the second set of mass-checks,
   and then we will put out a release candidate.

 * New committer: Henry Stern (author of the perceptron that will do
   the score optimizations for SpamAssassin 3.0)

 * ASF integration (moving from the incubator to TLP status and
   transitioning away from a few bits of remaining non-ASF
   infrastructure) continues at a slow, but steady pace.  The web site
   is completely transitioned and under SVN control, lists are moving
   from incubator to TLP, we're in the process of moving the
   spamassassin.org domain registration.

   Two issues: a private non-ASF list that has been used for
   communication with other anti-spammers (privacy is competing with
   transparency) and Jira's non-open-source licensing resulted in a
   veto on moving to Jira, and the ASF bugzilla is reportedly
   undersupported, so we're still using our own bugzilla (supported by
   our committers and a contributor at an ISP) for the time being.

 * We can't claim credit for the integration work, but we have heard
   that installing SpamAssassin on the ASF mail servers has helped
   quite a bit, and we have helped out a bit with DNSBL selection.  :-)

 * We are holding a logo contest to replace our old project logo:
   http://wiki.apache.org/spamassassin/LogoContest

Approved by General Consent.

8. Unfinished Business

9. New Business

21 Jul 2004 [Daniel Quinlan]

 Highlights of Events from the last month:

 * Pre-releases: SpamAssassin 3.0.0-pre1, SpamAssassin 3.0.0-pre2

   The project is zeroing in on our 3.0.0 release, we've completed the
   first set of mass-checks (contributors submit corpora results and
   they are used to train the score optimizer).  pre3 should be coming
   out in the next few days, followed by the second set of mass-checks,
   and then we will put out a release candidate.

 * New committer: Henry Stern (author of the perceptron that will do
   the score optimizations for SpamAssassin 3.0)

 * ASF integration (moving from the incubator to TLP status and
   transitioning away from a few bits of remaining non-ASF
   infrastructure) continues at a slow, but steady pace.  The web site
   is completely transitioned and under SVN control, lists are moving
   from incubator to TLP, we're in the process of moving the
   spamassassin.org domain registration.

   Two issues: a private non-ASF list that has been used for
   communication with other anti-spammers (privacy is competing with
   transparency) and Jira's non-open-source licensing resulted in a
   veto on moving to Jira, and the ASF bugzilla is reportedly
   undersupported, so we're still using our own bugzilla (supported by
   our committers and a contributor at an ISP) for the time being.

 * We can't claim credit for the integration work, but we have heard
   that installing SpamAssassin on the ASF mail servers has helped
   quite a bit, and we have helped out a bit with DNSBL selection.  :-)

 * We are holding a logo contest to replace our old project logo:
   http://wiki.apache.org/spamassassin/LogoContest

8. Unfinished Business

9. New Business

10. Announcements

11. Adjournment

23 Jun 2004

Establish SpamAssassin PMC

   WHEREAS, the Board of Directors deems it to be in the best
   interests of the Foundation and consistent with the
   Foundation's purpose to establish a Project Management
   Committee charged with the creation and maintenance of
   open-source software related to identifying unsolicited email,
   for distribution at no charge to the public.

   NOW, THEREFORE, BE IT RESOLVED, that a Project Management
   Committee (PMC), to be known as the "Apache SpamAssassin PMC",
   be and hereby is established pursuant to Bylaws of the
   Foundation; and be it further

   RESOLVED, that the Apache SpamAssassin PMC be and hereby is
   responsible for the creation and maintenance of software
   related to identifying unsolicited email; and be it further

   RESOLVED, that the office of "Vice President, Apache
   SpamAssassin" be and hereby is created, the person holding such
   office to serve at the direction of the Board of Directors as
   the chair of the Apache SpamAssassin PMC, and to have primary
   responsibility for management of the projects within the scope
   of responsibility of the Apache SpamAssassin PMC; and be it
   further

   RESOLVED, that the persons listed immediately below be and
   hereby are appointed to serve as the initial members of the
   Apache SpamAssassin PMC:

     Theo van Dinter <felicity@apache.org>
     Duncan Findlay <duncf@apache.org>
     Justin Mason <jm@apache.org>
     Daniel Quinlan <quinlan@apache.org>
     Malte S. Stretz <mss@apache.org>

   NOW, THEREFORE, BE IT FURTHER RESOLVED, that Daniel Quinlan be
   and hereby is appointed to the office of Vice President, Apache
   SpamAssassin, to serve in accordance with and subject to the
   direction of the Board of Directors and the Bylaws of the
   Foundation until death, resignation, retirement, removal or
   disqualification, or until a successor is appointed; and be it
   further

   RESOLVED, that the initial Apache SpamAssassin PMC be and
   hereby is tasked with the creation of a set of bylaws intended
   to encourage open development and increased participation in
   the Apache SpamAssassin Project.


 Stefano noted that the list of the PMC was small.  Concerned about size,
 and Greg concerned that there are no members participating.  General
 question was about the diversity of the community.  Sander noted that
 they were conservative about granting new committer access.  It was
 noted that incubation went well for them, and the the holdups had to
 do with trademark issues.

 Greg reported that trademark issues were cleared up - that documents
 are in process or already filed with the USPTO.  The trademarks were
 transferred from Network Associates, and it was noted that Network
 Associates retains a license to use them.  We are working to get
 copies of the transfer documentation so we have the agreement here on
 file.

 Sander will continue to monitor the project.

 By unanimous vote, the creation of the SpamAssassin PMC was approved.