Repository navigation
Incorporate spf-tools into postallow - #40
Merged
Merged
Conversation
- Task 9 Step 4: replace the broken 'git stash back to pre-Task-1' regression check (every task ends in a commit, so there's nothing to stash by Task 9) with a git worktree-based before/after comparison against 568b9bf. - Task 8 Step 3: verified README.md:188-190 is a numbered list and wrote the exact renumbering instead of hedging with 'if this was a numbered step'.
Frees up the name cleanup() for despf.inc.sh's loop-detection-tempfile cleanup function, which is about to be ported in verbatim. Two functions sharing one name would mean POSIX sh keeps only the textually-last definition — silently breaking whichever one loses, including a mid-run scenario where tmp1 (which accumulates SPF results across every query_host() call) gets deleted mid-loop.
Adapted verbatim from spf-tools (Apache-2.0, see LICENSES/Apache-2.0.txt). Adds despf_run() as new integration glue replacing despf.sh's own loopfile-provisioning wrapper. Not yet wired to any call site — that's the next task.
Restored three trailing-whitespace instances that were inadvertently removed when the code block was initially inserted: - dea() line: added trailing space after 'do' - getamx() line: added trailing space after 'do' - despfit() blank line: changed to single space (not completely empty) All changes verified against brief using cat -A to ensure exact byte-for-byte match with the spf-tools upstream source.
Adapted verbatim (Apache-2.0). Not yet wired to any call site.
query_host/query_block_host/query_yahoo_host, the --quick-add block, and
the main allowlist/blocklist aggregation pipeline now call despf_run/
normalize_cidrs directly instead of shelling out to ${spftoolspath}/despf.sh
and ${spftoolspath}/normalize.sh. No behavior change intended - same
functions, same logic, now in-process.
Task 9's straggler grep surfaced dead spftoolspath=/usr/local/bin lines in every job's postallow.conf heredoc and stale comments describing contrib/install.sh as installing spf-tools — both left over from before the spf-tools incorporation (Tasks 1-8), and explicitly called out as in-scope in the spec's Removals section but missed by those tasks. No functional CI behavior change: the config lines were already harmless (sourced but unused), this just removes the dead config and corrects the comments to match what install.sh actually does now.
- Remove stale "Requires SPF-Tools" header lines from postallow now that spf-tools is built in rather than an external dependency. - Grant AppArmor rules the ported despf code actually needs: the despf-sort- tempfile pattern, tr, and rm (pre-existing gap); update stale despf.sh comment references. - Confine ~/.spf-toolsrc sourcing to despf_run()'s subshell instead of postallow's top-level shell, so it can no longer override postallow's own config variables. - Fix a stale normalize.sh comment reference to say normalize_cidrs.
The plan (docs/superpowers/plans/2026-09-16-incorporate-spf-tools.md) was scratch/working scaffolding for the 9-task subagent-driven implementation of the already-merged spec (docs/superpowers/specs/2026-09-15-incorporate-spf-tools.md). Git history is the record now; removing it per the branch-workflow instruction to strip planning artifacts before opening the final PR.
edmundlod
changed the title
edmundlod
added a commit
that referenced
this pull request
Sep 16, 2026
Brings in the just-merged spf-tools inlining (PR #40) and resolves the resulting conflicts: dropped the now-removed spftoolspath setting everywhere both branches touched it, removed the resulting dead dependency-install blocks from contrib/install.sh (neither spf-tools nor aggregateCIDR.pl needs a separate fetch anymore), and reconciled the doc/CI/AppArmor text so both changes are described together.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports spf-tools' SPF-parsing/DNS-querying (despf.sh/despf.inc.sh/global.inc.sh) and CIDR-normalisation (normalize.sh) directly into postallow, removing the external spf-tools runtime dependency entirely. Apache-2.0 attribution included for the ported code.
Implements docs/superpowers/specs/2026-09-15-incorporate-spf-tools.md (already on main).
Summary
postallow; renamed postallow's owncleanup()tocleanup_tmpfiles()to avoid colliding with the portedcleanup().spftoolspathand all its supporting plumbing (Makefile probe, installer download step, AppArmor rules, config/man docs).Verification
sh -n postallowandsh -n contrib/install.shpassinvalid_cidr=remove+enable_blocklist=yes(previously untested combination)--quick-addand the Yahoo DNS-override subshell scoping verifiedNote
Found and left untouched (pre-existing, unrelated to this change, confirmed identical before/after):
cleanup_tmpfiles()'senable_blocklist=yespath checks$blktmp1..5but the actual variables are named$blocktmp1..5— causes the script to always exit 1 (skipping "Done!") and leak blocklist tempfiles whenever blocklisting is enabled. Worth a separate bug-fix task.