rspamd 3.5 ratelimit issues, bundled in debian-mail-overlay image

[diroots]

Hello. we recently noticed a weird behaviour with rspamd ratelimits once switching to latest mailserver image (we were not on previous one, but on older one shipping old 3.4 rspamd.

after some searches, a similar issue was raised in other mailstacks like mailcow : https://github.com/mailcow/mailcow-dockerized/issues/5168

they got exact similar issues when switching to rspamd 3.5

instead of bundling a static version from github repo, why not use rspamd repos? they propose the sources in their download page, section debian / ubuntu : https://rspamd.com/downloads.html

also, proposing a newer debian mail overlay based on debian12.2-slim could help switch to latest

• clamav bundled in bookworm, which is now 1.0.3 (instead of 1.0.1) https://packages.debian.org/bookworm/clamav
• postfix bundled in bookworm which is now 3.7.6 (instead of 3.7.5-2) https://packages.debian.org/bookworm/postfix

[AndrewSav]

Hey, just wanted to get a bit more info about this. As I understand your post, there is some issues people are facing with rspamd 3.5 and you are suggesting that using apt repo for rspamd instead of github repo will solve this issue. Could you please give more information as to why you think it might have an impact? It would be surprising if they publish secret bug-free version in their apt repo but keep the buggy one on GitHub. I think GitHub is the source of truth, the rest (docker images, apt, etc) is just packaging.

In general I personally in favour of making the least changes, unless there is overwhelming evidence that they are in the right direction. In particular, Debian official apt repos always severely lag behind, so getting the latest versions from elsewhere (if that's how it's done currently) is a no brainer to me. (The fact that we are lagging behind now, IMO is irrelevant, because that's something we control, and Debian we cannot control).

Any thoughts are welcome!

[diroots]

Hello.

to be more precise, it's only the version 3.5 in which there is a bug.

there was multiple points in my message :

• upgrade rspamd to 3.6 or latest 3.7.4
• add the debian repositories for rspamd in the image, repositories served by rspamd.com and maintained by the rspamd maintainer
• also provide an uptodate debian-mail-overlay image with latest debian12.2-slim image in order to get updated versions of clamav and postfix.

my thought there was to integrate the official rspamd deb repositories in the debian mail base image, so when mailserver is set up, it could install rspamd alongside with other packages in here : https://github.com/mailserver2/mailserver/blob/master/Dockerfile#L8 and at this moment, will get the latest stable version.

first and last point, of course, can be done also with your usual script as i did propose in the PR #23