Subject: bug#876: spamassassin: Running filter twice ends with message marked as NO spam (kmail)

From: Noel Torres <[email-masked]>
Date: Sat, 08 Feb 2025 00:36:42 +0000

Package: spamassassin
Version: 4.0.1-3
Severity: normal
X-Debbugs-Cc: [email-masked]

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
   Running kmail with spamassassin. 
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   1)I configured kmail to run with spamassassin. Check command is
   "Redirect through" "spamc"
   2)I ran the filter more than once for the same message.
   * What was the outcome of this action?
   Spam score for the message drop from 20.7 to -0.0
   * What outcome did you expect instead?
   Spam score to stay at 20.7

*** End of the template - remove these template lines ***

Example message here
==8<---
From: <[email-masked]>
To: [email-masked]
Subject: 
Date: Wed, 5 Feb 2025 03:55:15 +0800 (CST)

This is a multi-part message in MIME format.

------------=_67A6A169.DC9D382C
Content-Type: text/plain; charset=UTF-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "kmail.rolamasao.org",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  

Content analysis details:   (20.7 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.3 EMPTY_MESSAGE          Message appears to have no textual parts
 3.6 RCVD_IN_SBL_CSS        RBL: Received via a relay in Spamhaus SBL-CSS
                            [114.223.79.138 listed in zen.spamhaus.org]
 0.7 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
                            [114.223.79.138 listed in zen.spamhaus.org]
 3.6 RCVD_IN_PBL            RBL: Received via a relay in Spamhaus PBL
                            [114.223.79.138 listed in zen.spamhaus.org]
-2.0 RCVD_IN_VALIDITY_SAFE  RBL: Sender in Validity Safe - Contact
                            [email-masked]
[Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]
 2.7 RCVD_IN_PSBL           RBL: Received via a relay in PSBL
                            [114.223.79.138 listed in psbl.surriel.com]
-3.0 RCVD_IN_VALIDITY_CERTIFIED RBL: Sender in Validity Certification -
                            Contact [email-masked]
[Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]
 1.3 RCVD_IN_VALIDITY_RPBL  RBL: Relay in Validity RPBL,
                            https://senderscore.org/blocklistlookup/
                           [114.223.79.138 listed in bl.score.senderscore.com]
 1.0 SPF_SOFTFAIL           SPF: sender does not match SPF record (softfail)
 0.0 RCVD_IN_MSPIKE_BL      Mailspike blocklisted
 2.7 RCVD_IN_MSPIKE_ZBI     No description available.
 3.6 HELO_LOCALHOST         No description available.
 0.0 FSL_HELO_NON_FQDN_1    No description available.
 0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 1.3 RDNS_NONE              Delivered to internal network by a host with no rDNS
 0.6 HTML_MIME_NO_HTML_TAG  HTML-only message, but there is no HTML tag
 1.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
 1.2 DMARC_QUAR             DMARC quarantine policy

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

------------=_67A6A169.DC9D382C
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Date: Wed, 5 Feb 2025 03:55:15 +0800 (CST)
From:  <[email-masked]>
To: [email-masked]
Subject: 

------=_Part_685995_310455639.1738698915440
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

------=_Part_685995_310455639.1738698915440--

------------=_67A6A169.DC9D382C--

==8<---

-- System Information:
Distributor ID:	Devuan
Description:	Devuan GNU/Linux 6 (excalibur/ceres)
Release:	6
Codename:	excalibur ceres
Architecture: x86_64

Kernel: Linux 6.1.0-30-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)
LSM: AppArmor: enabled

Versions of packages spamassassin depends on:
ii  adduser                     3.137
ii  libhtml-parser-perl         3.83-1+b2
ii  libhttp-date-perl           6.06-1
ii  libio-string-perl           1.08-4
ii  libmail-dkim-perl           1.20240923-1
ii  libnet-dns-perl             1.49-1
ii  libnetaddr-ip-perl          4.079+dfsg-2+b5
ii  libsocket6-perl             0.29-3+b4
ii  libsys-hostname-long-perl   1.5-3
ii  libwww-perl                 6.77-1
ii  perl [libarchive-tar-perl]  5.40.0-8
ii  w3m                         0.5.3+git20230121-2.1

Versions of packages spamassassin recommends:
ii  gnupg                      2.2.46-1
ii  libbsd-resource-perl       1.2911-2+b4
ii  libmail-dmarc-perl         1.20240314-1
ii  libmail-spf-perl           3.20240923-1
ii  perl [libsys-syslog-perl]  5.40.0-8
ii  sa-compile                 4.0.1-3
ii  spamc                      4.0.1-3

Versions of packages spamassassin suggests:
ii  libdbi-perl                   1.647-1
pn  libencode-detect-perl         <none>
pn  libgeoip2-perl                <none>
ii  libio-socket-ssl-perl         2.089-1
pn  libnet-patricia-perl          <none>
ii  perl [libcompress-zlib-perl]  5.40.0-8
pn  pyzor                         <none>
pn  razor                         <none>

-- no debconf information