mailreport 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4144dc7ef1d3210db021841accb097def4cf61d4edd582064920f994da16a262
+  data.tar.gz: cdeffe809666d65141cbbc169d110eadb3be17a30bfaf6311b5382af0ddd69ee
+SHA512:
+  metadata.gz: fe3ab048394c0dd88eb5d8ff99f1a0be42eff511c2add007753e39423e75d01d156a6815b07853a78469c8e7e839e01ffc265b404648a542494e21799b14f092
+  data.tar.gz: 8d59fb0ec330e5e5099ebeac2bd15420b9f53257a1a0f5ebb3b6c420de653ffcf26577396093f87aec4c86a26102ae1b4696a91824de7e7489addb9a1dc8cf62

data/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## 0.1.0
+
+Initial release.
+
+- DMARC aggregate reports (RFC 7489 §7.2)
+- SMTP TLS reports (RFC 8460)
+- Gzip, zip, or bare attachments; hostile input bounded

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PostRider
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,146 @@
+# mailreport
+
+📧 Read the reports receivers send back about your domain
+
+Answers one question: what are receivers seeing?.
+
+## Features
+
+- DMARC aggregate reports (RFC 7489 §7.2), gzipped, zipped, or bare
+- SMTP TLS reports (RFC 8460), gzipped, zipped, or bare
+- Bounded against hostile input, since the address these arrive at is published in DNS
+
+> A report is only as truthful as the receiver that filed it. This library reports what a document says, not whether it is true.
+
+## Contents
+
+- [Getting Started](#getting-started)
+- [DMARC Aggregate Reports](#dmarc-aggregate-reports)
+- [SMTP TLS Reports](#smtp-tls-reports)
+- [What Is Not Filled In](#what-is-not-filled-in)
+- [Unreadable Documents](#unreadable-documents)
+- [Testing](#testing)
+- [Contributing](#contributing)
+- [License](#license)
+
+## Getting Started
+
+```ruby
+gem "mailreport"
+```
+
+Requires Ruby >= 3.3.4
+
+## DMARC Aggregate Reports
+
+A domain asks for these with the `rua` tag of its DMARC record, and they arrive as attachments to ordinary mail. Hand over the attachment as it came:
+
+```ruby
+report = MailReport::Dmarc.parse(attachment_bytes)
+
+report.organization   # => "google.com"
+report.report_id      # => "14054835605949254452"
+report.range          # => 2026-07-27 00:00:00 UTC..2026-07-27 23:59:59 UTC
+
+report.policy.domain  # => "example.com"
+report.policy.p       # => "reject"
+```
+
+Each record is one sending address over the window, with the count of messages it sent:
+
+```ruby
+report.records.each do |record|
+  record.source_ip    # => "203.0.113.9"
+  record.count        # => 42
+  record.disposition  # => "none" - what the receiver did
+  record.dkim         # => "pass" - aligned, as DMARC judged it
+  record.spf          # => "pass"
+end
+```
+
+`record.dkim` and `record.spf` are the **aligned** verdicts DMARC reached. Whether the checks themselves passed is a different question, and it's in `auth_results`:
+
+```ruby
+record.auth_results.dkim  # => [#<DkimAuthResult domain: "example.com", selector: "s1", result: "pass", ...>]
+record.auth_results.spf   # => [#<SpfAuthResult domain: "example.com", scope: "mfrom", result: "pass">]
+```
+
+A message can carry a valid signature from a domain that doesn't align, and that pair is where it shows.
+
+Where a receiver applied something milder than the published policy, it says why:
+
+```ruby
+record.reasons  # => [#<Reason type: "forwarded", comment: "looks forwarded">]
+```
+
+Worth reading before concluding anything from a `fail` - forwarding breaks SPF and often DKIM, and a receiver that noticed will say so here.
+
+## SMTP TLS Reports
+
+RFC 8460 reports arrive the same way. Parse the attachment bytes:
+
+```ruby
+report = MailReport::TlsRpt.parse(attachment_bytes)
+
+report.organization  # => "Company-X"
+report.report_id     # => "5065427c-23d3-47ca-b6e0-946ea0e8c4be"
+report.range         # => 2016-04-01 00:00:00 UTC..2016-04-01 23:59:59 UTC
+
+report.policies.each do |policy|
+  policy.type       # => "sts"
+  policy.domain     # => "company-y.example"
+  policy.successes  # => 5326
+  policy.failures   # => 303
+end
+```
+
+## What Is Not Filled In
+
+Elements the sender omitted come back `nil`, including ones the RFC gives defaults for:
+
+```ruby
+report.policy.adkim  # => nil, where the sender said nothing
+```
+
+"The sender omitted `adkim`" and "the sender asked for relaxed alignment" are different facts, and only the first is in the document. Applying the RFC's defaults is left to the reader.
+
+For the same reason, nothing here counts. Totals, alignment rates, and what counts as alarming are a consumer's to compute.
+
+## Unreadable Documents
+
+Nothing raises. A document that can't be read is `nil`:
+
+```ruby
+MailReport::Dmarc.parse(garbage)  # => nil
+```
+
+This is deliberately different from a report carrying no records - that one is a receiver saying it saw no mail, and comes back as a report with an empty `records`.
+
+A `rua` address is published in DNS, so anyone can send anything to it, and the limits assume as much:
+
+- **Entity declarations are refused.** A report has none of its own, so the expansion bomb is refused with them. Escapes a real document needs (`&amp;`, `&#233;`) still read.
+- **Decompression stops at 25 MB** rather than running to completion. Lower it where you'd rather hold less:
+
+```ruby
+MailReport::Archive.open(bytes, max_size: 1024 * 1024)
+```
+
+- **External references are never resolved** - no document reads a file, a URL, or a DNS name.
+- **A zip entry is bounded as it inflates**, not on the size it claims.
+
+Where an archive holds several entries, DMARC prefers a `.xml` name and TLS a `.json` name; otherwise the first non-empty file is read. Directories and empty placeholders are skipped.
+
+## Testing
+
+```sh
+bundle install
+rake
+```
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Bug reports: [GitHub issues](https://github.com/mailpiece/mailreport/issues). Security: [SECURITY.md](SECURITY.md).
+
+## License
+
+MIT. See [LICENSE](LICENSE).

data/lib/mailreport/archive.rb

@@ -0,0 +1,118 @@
+require "stringio"
+require "zip_kit"
+require "zlib"
+
+module MailReport
+  # Attachment wrapping per RFC 7489 §7.2.1.1 / RFC 8460 §3. Detected from
+  # magic bytes, not the filename.
+  module Archive
+    GZIP = "\x1f\x8b".b
+    ZIP = "PK".b
+
+    MAX_SIZE = 25 * 1024 * 1024
+    CHUNK_SIZE = 64 * 1024
+    STORED = 0
+
+    UNREADABLE = [
+      ZipKit::FileReader::ReadError, ZipKit::FileReader::MissingEOCD,
+      ZipKit::FileReader::UnsupportedFeature, Zlib::Error
+    ].freeze
+
+    class << self
+      # `name` prefers a zip entry whose filename matches (e.g. /\.xml\z/i).
+      def open(bytes, max_size: MAX_SIZE, name: nil)
+        bytes = bytes.to_s.b
+
+        if bytes.empty?
+          nil
+        elsif gzipped?(bytes)
+          inflated(bytes, max_size)
+        elsif zipped?(bytes)
+          unzipped(bytes, max_size, name)
+        elsif bytes.bytesize <= max_size
+          bytes
+        end
+      rescue *UNREADABLE
+        nil
+      end
+
+      private
+        def gzipped?(bytes)
+          bytes.start_with?(GZIP)
+        end
+
+        def inflated(bytes, max_size)
+          Zlib::GzipReader.wrap(StringIO.new(bytes)) do |gzip|
+            inflated = gzip.read(max_size + 1)
+
+            inflated if inflated && inflated.bytesize <= max_size
+          end
+        end
+
+        def zipped?(bytes)
+          bytes.start_with?(ZIP)
+        end
+
+        def unzipped(bytes, max_size, name)
+          archive = StringIO.new(bytes)
+
+          if entry = document_entry(archive, name)
+            archive.seek(entry.compressed_data_offset)
+            content(entry, archive, max_size)
+          end
+        end
+
+        # Prefer a report-shaped name when the caller gives one; otherwise the
+        # first non-empty file. Directories and empty placeholders are skipped.
+        def document_entry(archive, name)
+          entries = ZipKit::FileReader.read_zip_structure(io: archive).select do |entry|
+            !entry.filename.end_with?("/") && entry.uncompressed_size.positive?
+          end
+
+          if name
+            entries.find { |entry| entry.filename.match?(name) } || entries.first
+          else
+            entries.first
+          end
+        end
+
+        def content(entry, archive, max_size)
+          if entry.storage_mode == STORED
+            stored(entry, archive, max_size)
+          else
+            deflated(archive, max_size)
+          end
+        end
+
+        # Require the declared byte count so a truncated entry is not mistaken
+        # for a complete document.
+        def stored(entry, archive, max_size)
+          read = archive.read([ entry.compressed_size, max_size + 1 ].min)
+
+          read if read && read.bytesize == entry.compressed_size && read.bytesize <= max_size
+        end
+
+        # Raw deflate (zip), bounded on inflated output. Require finished? so a
+        # truncated stream is not mistaken for a complete document.
+        def deflated(archive, max_size)
+          inflater = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+          inflated = +"".b
+
+          catch(:full) do
+            until inflater.finished?
+              piece = archive.read(CHUNK_SIZE) or break
+
+              inflater.inflate(piece) do |chunk|
+                inflated << chunk
+                throw :full if inflated.bytesize > max_size
+              end
+            end
+          end
+
+          inflated if inflater.finished? && inflated.bytesize <= max_size
+        ensure
+          inflater.close if inflater && !inflater.closed?
+        end
+    end
+  end
+end

data/lib/mailreport/dmarc/document.rb

@@ -0,0 +1,180 @@
+require "rexml/document"
+
+require "mailreport/dmarc/report"
+
+module MailReport
+  module Dmarc
+    # RFC 7489 Appendix C.
+    class Document
+      ROOT = "feedback"
+
+      PREDEFINED_ENTITIES = %w[ lt gt amp quot apos ].freeze
+
+      # REXML raises a bare RuntimeError when expansion limits trip; match the
+      # message so our own RuntimeErrors are not swallowed as unreadable input.
+      EXPANSION_ABANDONED = /entity expansions exceeded|entity expansion has grown too large/
+
+      def initialize(xml)
+        @xml = xml
+      end
+
+      def report
+        if root = feedback
+          build(root)
+        end
+      rescue REXML::ParseException
+        nil
+      rescue RuntimeError => error
+        if error.message.match?(EXPANSION_ABANDONED)
+          nil
+        else
+          raise
+        end
+      end
+
+      private
+        def feedback
+          document = REXML::Document.new(@xml)
+
+          document.root if readable?(document) && document.root&.name == ROOT
+        end
+
+        # Refuse any declared entity before text is read (expansion timing).
+        def readable?(document)
+          declared_entities(document).empty?
+        end
+
+        def declared_entities(document)
+          document.doctype&.entities&.keys.to_a - PREDEFINED_ENTITIES
+        end
+
+        def build(root)
+          metadata = child(root, "report_metadata")
+
+          Report.new(
+            organization: text(metadata, "org_name"),
+            email: text(metadata, "email"),
+            extra_contact_info: text(metadata, "extra_contact_info"),
+            report_id: text(metadata, "report_id"),
+            range: range(metadata),
+            errors: errors(metadata),
+            policy: policy(child(root, "policy_published")),
+            records: records(root)
+          )
+        end
+
+        def errors(metadata)
+          elements(metadata, "error").filter_map { |element| text_of(element) }
+        end
+
+        # Epoch seconds (§7.2), as UTC.
+        def range(metadata)
+          dates = child(metadata, "date_range")
+          starts, ends = integer(dates, "begin"), integer(dates, "end")
+
+          Time.at(starts).utc..Time.at(ends).utc if starts && ends && starts <= ends
+        end
+
+        def policy(element)
+          Policy.new(
+            domain: text(element, "domain"),
+            adkim: text(element, "adkim"),
+            aspf: text(element, "aspf"),
+            p: text(element, "p"),
+            sp: text(element, "sp"),
+            pct: counted(element, "pct"),
+            fo: text(element, "fo")
+          )
+        end
+
+        def records(root)
+          elements(root, "record").map { |element| record(element) }
+        end
+
+        def record(element)
+          row = child(element, "row")
+          evaluated = child(row, "policy_evaluated")
+
+          Record.new(
+            source_ip: text(row, "source_ip"),
+            count: count_of(row),
+            disposition: text(evaluated, "disposition"),
+            dkim: text(evaluated, "dkim"),
+            spf: text(evaluated, "spf"),
+            reasons: reasons(evaluated),
+            identifiers: identifiers(child(element, "identifiers")),
+            auth_results: auth_results(child(element, "auth_results"))
+          )
+        end
+
+        def reasons(evaluated)
+          elements(evaluated, "reason").map do |element|
+            Reason.new(type: text(element, "type"), comment: text(element, "comment"))
+          end
+        end
+
+        def identifiers(element)
+          Identifiers.new(
+            header_from: text(element, "header_from"),
+            envelope_from: text(element, "envelope_from"),
+            envelope_to: text(element, "envelope_to")
+          )
+        end
+
+        def auth_results(element)
+          AuthResults.new(dkim: dkim_results(element), spf: spf_results(element))
+        end
+
+        def dkim_results(element)
+          elements(element, "dkim").map do |dkim|
+            DkimAuthResult.new(domain: text(dkim, "domain"), selector: text(dkim, "selector"),
+              result: text(dkim, "result"), human_result: text(dkim, "human_result"))
+          end
+        end
+
+        def spf_results(element)
+          elements(element, "spf").map do |spf|
+            SpfAuthResult.new(domain: text(spf, "domain"), scope: text(spf, "scope"), result: text(spf, "result"))
+          end
+        end
+
+        def child(element, name)
+          element.elements[name] if element
+        end
+
+        def elements(element, name)
+          if element
+            element.get_elements(name)
+          else
+            []
+          end
+        end
+
+        def text(element, name)
+          text_of(child(element, name))
+        end
+
+        def text_of(element)
+          value = element&.text.to_s.strip
+
+          value unless value.empty?
+        end
+
+        def integer(element, name)
+          Integer(text(element, name), exception: false)
+        end
+
+        def counted(element, name)
+          value = integer(element, name)
+
+          value unless value.nil? || value.negative?
+        end
+
+        # A count the sender omitted is nil, not zero: "no messages" is a
+        # finding, and only the sender can report one.
+        def count_of(row)
+          counted(row, "count") || 0 if text(row, "count")
+        end
+    end
+  end
+end

data/lib/mailreport/dmarc/report.rb

@@ -0,0 +1,57 @@
+module MailReport
+  module Dmarc
+    # Named as RFC 7489 Appendix C.
+
+    DkimAuthResult = Data.define(:domain, :selector, :result, :human_result) do
+      def initialize(domain: nil, selector: nil, result: nil, human_result: nil)
+        super
+      end
+    end
+
+    SpfAuthResult = Data.define(:domain, :scope, :result) do
+      def initialize(domain: nil, scope: nil, result: nil)
+        super
+      end
+    end
+
+    AuthResults = Data.define(:dkim, :spf) do
+      def initialize(dkim: [], spf: [])
+        super
+      end
+    end
+
+    Identifiers = Data.define(:header_from, :envelope_from, :envelope_to) do
+      def initialize(header_from: nil, envelope_from: nil, envelope_to: nil)
+        super
+      end
+    end
+
+    # Override reasons from §7.2 (`forwarded`, `mailing_list`, …).
+    Reason = Data.define(:type, :comment) do
+      def initialize(type: nil, comment: nil)
+        super
+      end
+    end
+
+    # `dkim` / `spf` are DMARC aligned verdicts; check results are in auth_results.
+    Record = Data.define(:source_ip, :count, :disposition, :dkim, :spf, :reasons, :identifiers, :auth_results) do
+      def initialize(source_ip: nil, count: nil, disposition: nil, dkim: nil, spf: nil,
+                     reasons: [], identifiers: Identifiers.new, auth_results: AuthResults.new)
+        super
+      end
+    end
+
+    Policy = Data.define(:domain, :adkim, :aspf, :p, :sp, :pct, :fo) do
+      def initialize(domain: nil, adkim: nil, aspf: nil, p: nil, sp: nil, pct: nil, fo: nil)
+        super
+      end
+    end
+
+    Report = Data.define(:organization, :email, :extra_contact_info, :report_id, :range, :errors, :policy, :records) do
+      def initialize(organization: nil, email: nil, extra_contact_info: nil, report_id: nil,
+                     range: nil, errors: [], policy: Policy.new, records: [])
+        super
+      end
+    end
+  end
+end

data/lib/mailreport/dmarc.rb

@@ -0,0 +1,16 @@
+require "mailreport/archive"
+require "mailreport/dmarc/document"
+require "mailreport/dmarc/report"
+
+module MailReport
+  # RFC 7489 §7.2 aggregate reports.
+  module Dmarc
+    REPORT_NAME = /\.xml\z/i
+
+    def self.parse(bytes)
+      if xml = Archive.open(bytes, name: REPORT_NAME)
+        Document.new(xml).report
+      end
+    end
+  end
+end

data/lib/mailreport/tls_rpt.rb

@@ -0,0 +1,134 @@
+require "json"
+require "time"
+
+require "mailreport/archive"
+
+module MailReport
+  # RFC 8460.
+  module TlsRpt
+    REPORT_NAME = /\.json\z/i
+
+    # §4.4.
+    Failure = Data.define(:result_type, :count, :sending_mta_ip, :receiving_mx_hostname,
+      :receiving_mx_helo, :receiving_ip, :additional_information, :failure_reason_code) do
+      def initialize(result_type: nil, count: nil, sending_mta_ip: nil, receiving_mx_hostname: nil,
+        receiving_mx_helo: nil, receiving_ip: nil, additional_information: nil, failure_reason_code: nil)
+        super
+      end
+    end
+
+    Policy = Data.define(:type, :domain, :mx_hosts, :policy_string, :successes, :failures, :failure_details) do
+      def initialize(type: nil, domain: nil, mx_hosts: [], policy_string: [], successes: nil, failures: nil,
+        failure_details: [])
+        super
+      end
+    end
+
+    Report = Data.define(:organization, :report_id, :contact, :started_at, :ended_at, :policies) do
+      def initialize(organization: nil, report_id: nil, contact: nil, started_at: nil, ended_at: nil, policies: [])
+        super
+      end
+
+      def range
+        started_at..ended_at if started_at && ended_at && started_at <= ended_at
+      end
+    end
+
+    class << self
+      def parse(bytes)
+        json = Archive.open(bytes, name: REPORT_NAME)&.force_encoding(Encoding::UTF_8)
+
+        # A report is JSON, and JSON is UTF-8 (RFC 8460 §3, RFC 8259 §8.1).
+        document = JSON.parse(json) if json&.valid_encoding?
+
+        report_from(document) if document.is_a?(Hash)
+      rescue JSON::ParserError
+        nil
+      end
+
+      private
+        def report_from(document)
+          window = hash_at(document, "date-range")
+
+          Report.new(
+            organization: document["organization-name"],
+            report_id: document["report-id"],
+            contact: document["contact-info"],
+            started_at: time_at(window["start-datetime"]),
+            ended_at: time_at(window["end-datetime"]),
+            policies: array_at(document, "policies").filter_map { |entry| policy_from(entry) }
+          )
+        end
+
+        def policy_from(entry)
+          if entry.is_a?(Hash)
+            policy, summary = hash_at(entry, "policy"), hash_at(entry, "summary")
+
+            Policy.new(
+              type: policy["policy-type"],
+              domain: policy["policy-domain"],
+              mx_hosts: listed(policy["mx-host"]),
+              policy_string: listed(policy["policy-string"]),
+              successes: count_at(summary, "total-successful-session-count"),
+              failures: count_at(summary, "total-failure-session-count"),
+              failure_details: array_at(entry, "failure-details").filter_map { |failure| failure_from(failure) }
+            )
+          end
+        end
+
+        def failure_from(entry)
+          if entry.is_a?(Hash)
+            Failure.new(
+              result_type: entry["result-type"],
+              count: count_at(entry, "failed-session-count"),
+              sending_mta_ip: entry["sending-mta-ip"],
+              receiving_mx_hostname: entry["receiving-mx-hostname"],
+              receiving_mx_helo: entry["receiving-mx-helo"],
+              receiving_ip: entry["receiving-ip"],
+              additional_information: entry["additional-information"],
+              failure_reason_code: entry["failure-reason-code"]
+            )
+          end
+        end
+
+        # Scalar or array — reporters send either.
+        def listed(value)
+          case value
+          when Array then value
+          when nil then []
+          else [ value ]
+          end
+        end
+
+        def hash_at(document, key)
+          document[key].is_a?(Hash) ? document[key] : {}
+        end
+
+        def array_at(document, key)
+          listed(document[key])
+        end
+
+        # A count the sender omitted is nil, not zero: "no sessions" is a
+        # finding, and only the sender can report one.
+        def count_at(document, key)
+          counted(document[key]) if document.key?(key)
+        end
+
+        def counted(given)
+          value = given.is_a?(Integer) ? given : Integer(given.to_s, exception: false)
+
+          if value && !value.negative?
+            value
+          else
+            0
+          end
+        end
+
+        def time_at(value)
+          Time.iso8601(value.to_s)
+        rescue ArgumentError
+          nil
+        end
+    end
+  end
+end

data/lib/mailreport/version.rb

@@ -0,0 +1,3 @@
+module MailReport
+  VERSION = "0.1.0"
+end

data/lib/mailreport.rb

@@ -0,0 +1,8 @@
+require "mailreport/version"
+require "mailreport/archive"
+require "mailreport/dmarc"
+require "mailreport/tls_rpt"
+
+# DMARC aggregate reports (RFC 7489 §7.2) and SMTP TLS reports (RFC 8460).
+module MailReport
+end

data/mailreport.gemspec

@@ -0,0 +1,37 @@
+$LOAD_PATH.push File.expand_path('lib', __dir__)
+require_relative "lib/mailreport/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "mailreport"
+  spec.version = MailReport::VERSION
+  spec.platform = Gem::Platform::RUBY
+  spec.required_ruby_version = ">= 3.3.4"
+  spec.authors = [ "Simon Lev" ]
+  spec.email = [ "support@postrider.dev" ]
+
+  spec.summary = "DMARC aggregate and SMTP TLS reports, parsed in pure Ruby."
+  spec.description = "Answers one question about your domain: what are receivers seeing?"
+
+  spec.homepage = "https://github.com/mailpiece/mailreport"
+  spec.license = "MIT"
+
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+  spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues"
+  spec.metadata["rubygems_mfa_required"] = "true"
+
+  # Dir, not `git ls-files`: an uncommitted checkout would package an empty gem.
+  spec.files = Dir[
+    "lib/**/*.rb",
+    "CHANGELOG.md",
+    "README.md",
+    "LICENSE",
+    "mailreport.gemspec"
+  ]
+  spec.require_paths = [ "lib" ]
+
+  # CVE-2024-43398 (DoS, fixed 3.3.6); CVE-2024-49761 (ReDoS, fixed 3.3.9;
+  # Ruby 3.1-only in practice — we require >= 3.3.4).
+  spec.add_dependency "rexml", ">= 3.3.9"
+  spec.add_dependency "zip_kit", "~> 6.3"
+end

metadata

@@ -0,0 +1,83 @@
+--- !ruby/object:Gem::Specification
+name: mailreport
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Simon Lev
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rexml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.3.9
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.3.9
+- !ruby/object:Gem::Dependency
+  name: zip_kit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '6.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '6.3'
+description: 'Answers one question about your domain: what are receivers seeing?'
+email:
+- support@postrider.dev
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/mailreport.rb
+- lib/mailreport/archive.rb
+- lib/mailreport/dmarc.rb
+- lib/mailreport/dmarc/document.rb
+- lib/mailreport/dmarc/report.rb
+- lib/mailreport/tls_rpt.rb
+- lib/mailreport/version.rb
+- mailreport.gemspec
+homepage: https://github.com/mailpiece/mailreport
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/mailpiece/mailreport
+  changelog_uri: https://github.com/mailpiece/mailreport/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/mailpiece/mailreport/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.3.4
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.3
+specification_version: 4
+summary: DMARC aggregate and SMTP TLS reports, parsed in pure Ruby.
+test_files: []