mta_sts 0.1.0 โ†’ 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +4 -0
  3. data/README.md +41 -29
  4. data/lib/mta_sts/version.rb +1 -1
  5. data/mta_sts.gemspec +2 -3
  6. metadata +3 -5
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 0de9b2cdb6adccb9fb59489860cebd39ea5ccd9b31bafad218d05334bbbd79c5
4
- data.tar.gz: 4d4390e9071edf2f2ca6a1decbd32a8a862f24572d042464241cc11abb226594
3
+ metadata.gz: 6a086ee4ab9118b9e83ca143ba5c353410b2ff8700e5e322211678b7dfa9bbe4
4
+ data.tar.gz: ea8ff974a581d31003e7a535d896c76d8c440842ea07114f9481778d2116a3c1
5
5
  SHA512:
6
- metadata.gz: 836678183d43c161fdff348dc1b6c466a485f071bfc2e6606b805631c89ddd6848dbe8f1e511219f6861a7e40df83c3197c1cacf70cca0f89062f9e4aa4cd12a
7
- data.tar.gz: aeeadc31d4ccf52cbd5b54267050ea1fcb01b891e49a9295f7dbd19beff6ea64f064e6299ae3d11208c68c2ea30552b0e6be1eec05bb1b639fe7e9d49b938c6d
6
+ metadata.gz: 0a0eae0d2cdc73838df1045457af6a3c27f7110aef3aed1375d78a1a05744a22df90438f95bc9c9de8be2a96a4e16a28409ca52bcb949ade8e04a2c799a3463e
7
+ data.tar.gz: 0de333d23526642595a595745048b94c9b525c8f89e19ad76b1fba4a00a07ddc435533c60d766088f882e9505f8962325abe4db36bef24dd78e5900924bed8bc
data/CHANGELOG.md CHANGED
@@ -1,5 +1,9 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.1.1
4
+
5
+ Documentation
6
+
3
7
  ## 0.1.0
4
8
 
5
9
  Initial release.
data/README.md CHANGED
@@ -1,10 +1,30 @@
1
1
  # mta_sts
2
2
 
3
- ๐Ÿ”’ SMTP MTA Strict Transport Security for Ruby
4
-
5
- Answers one question before a message goes out: **must this connection be encrypted, and to which servers?**
6
-
7
- Resolve a recipient domain's MTA-STS policy (RFC 8461) and find out which of its mail servers may be used and whether TLS is optional. Also discovers where the domain wants TLS failure reports sent (RFC 8460 TLSRPT) โ€” discovery only; generating and submitting reports is yours.
3
+ ๐Ÿ”’ SMTP MTA Strict Transport Security for Ruby.
4
+
5
+ Answers one question before delivering a message: must this connection be encrypted, and to which servers?
6
+
7
+ **mta_sts** resolves a recipient domain's MTA-STS policy (RFC 8461) and finds out which of its mail servers may be used and whether TLS is optional. It also discovers where the domain wants TLS failure reports sent (RFC 8460 TLSRPT).
8
+
9
+ ## Contents
10
+
11
+ - [Installation](#installation)
12
+ - [How It Works](#how-it-works)
13
+ - [Looking Up a Policy](#looking-up-a-policy)
14
+ - [Results](#results)
15
+ - [Status and Policy Are Separate Axes](#status-and-policy-are-separate-axes)
16
+ - [Holding On to a Policy](#holding-on-to-a-policy)
17
+ - [TLSRPT Record Discovery](#tlsrpt-record-discovery)
18
+ - [Custom Resolver & Fetcher](#custom-resolver--fetcher)
19
+ - [Publishing a Policy](#publishing-a-policy)
20
+ - [Command Line](#command-line)
21
+ - [What It Is Strict About](#what-it-is-strict-about)
22
+ - [What It Is Not That Strict](#what-it-is-not-that-strict)
23
+ - [What It Does Not Check](#what-it-does-not-check)
24
+ - [Testing](#testing)
25
+ - [History](#history)
26
+ - [Contributing](#contributing)
27
+ - [License](#license)
8
28
 
9
29
  ## Installation
10
30
 
@@ -91,7 +111,6 @@ Four statuses, each with a predicate:
91
111
 
92
112
  `policy` is present whenever there's one to honor: fresh, renewed, or the `known` one you passed in that hasn't expired.
93
113
 
94
-
95
114
  | what happened | status | policy | `enforce?` |
96
115
  | ----------------------------------------- | ----------- | ------- | ---------- |
97
116
  | fresh fetch, `mode: enforce` | `found` | present | true |
@@ -99,7 +118,6 @@ Four statuses, each with a predicate:
99
118
  | TXT record gone, held an enforcing policy | `none` | held | **true** |
100
119
  | never had one, no TXT record | `none` | nil | false |
101
120
 
102
-
103
121
  The third row looks wrong and isn't. ยง5.1 keeps a policy in force for its `max_age` regardless of what DNS says now - deleting the TXT record does not withdraw enforcement, only serving `mode: none` does.
104
122
 
105
123
  Use `enforce?` and `allows?` for the connection decision, not `status`:
@@ -219,7 +237,7 @@ Exit codes answer the MTA-STS question only. TLSRPT is printed for diagnostics a
219
237
  ## What It Is Strict About
220
238
 
221
239
  - HTTP 3xx are never followed
222
- - HTTP caching (RFC 7234) is never used - freshness comes from the TXT `id` and `max_age` only
240
+ - HTTP caching (RFC 7234) is never used. Freshness comes from the TXT `id` and `max_age` only
223
241
  - Only `200` is a policy
224
242
  - The certificate is verified against `mta-sts.<domain>`, the policy host name
225
243
  - The `_mta-sts` discovery record must match the ABNF (`v=STSv1;` case-sensitive, a single well-formed `id`)
@@ -227,16 +245,21 @@ Exit codes answer the MTA-STS question only. TLSRPT is printed for diagnostics a
227
245
 
228
246
  ## What It Is Not That Strict
229
247
 
230
- - `Content-Type: text/plain` is checked but not enforced - ยง3.2 says SHOULD, not MUST, and real policies in the wild omit it
248
+ - `Content-Type: text/plain` is checked but not enforced
231
249
  - Line terminators may be bare `LF` as well as `CRLF`
232
250
 
233
251
  ## What It Does Not Check
234
252
 
235
- - **Certificate revocation.** `Net::HTTP` doesn't check it, and this library doesn't wire up OCSP or CRL. Pass your own `fetcher` if you need it.
236
- - **The address the policy host resolves to.** Fetched at whatever address DNS returns. The certificate check is what protects you here.
237
- - **DANE.** A separate mechanism needing DNSSEC validation and the peer certificate mid-handshake, which this library never sees.
238
- - **TLSRPT report generation or submission.** This library finds the `rua`; building and sending aggregate reports is the application's job.
239
- - **Anything about the SMTP connection.** This library opens one socket, to fetch a policy over HTTPS. It never speaks SMTP.
253
+ - **Certificate revocation.**
254
+ `Net::HTTP` doesn't check it, and this library doesn't wire up OCSP or CRL. Pass your own `fetcher` if you need it.
255
+ - **The address the policy host resolves to.**
256
+ Fetched at whatever address DNS returns. The certificate check is what protects you here.
257
+ - **DANE.**
258
+ A separate mechanism needing DNSSEC validation and the peer certificate mid-handshake, which this library never sees.
259
+ - **TLSRPT report generation or submission.**
260
+ This library finds the `rua`; building and sending aggregate reports is the application's job.
261
+ - **Anything about the SMTP connection.**
262
+ This library opens one socket, to fetch a policy over HTTPS. It never speaks SMTP.
240
263
 
241
264
  ## Testing
242
265
 
@@ -245,30 +268,19 @@ bundle install
245
268
  rake
246
269
  ```
247
270
 
248
- Nothing leaves the machine. Every lookup takes a `resolver:` and a `fetcher:`, and the test doubles stand a hash in for DNS and a string in for the policy host.
249
-
250
271
  ## History
251
272
 
252
- View the [changelog](https://github.com/mailpiece/mta_sts/blob/main/CHANGELOG.md)
273
+ View the [changelog](CHANGELOG.md).
253
274
 
254
275
  ## Contributing
255
276
 
256
- Everyone is encouraged to help improve this project. Here are a few ways you can help:
277
+ Everyone is encouraged to help improve this project:
257
278
 
258
279
  - [Report bugs](https://github.com/mailpiece/mta_sts/issues)
259
- - Fix bugs and [submit pull requests](https://github.com/mailpiece/mta_sts/pulls)
280
+ - Fix bugs and submit pull requests
260
281
  - Write, clarify, or fix documentation
261
282
  - Suggest or add new features
262
283
 
263
- To get started with development:
264
-
265
- ```sh
266
- git clone https://github.com/mailpiece/mta_sts.git
267
- cd mta_sts
268
- bundle install
269
- bundle exec rakecl
270
- ```
271
-
272
284
  ## License
273
285
 
274
- MIT. See [LICENSE](LICENSE).
286
+ MIT. See [LICENSE](LICENSE).
data/lib/mta_sts/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module MtaSts
2
- VERSION = "0.1.0"
2
+ VERSION = "0.1.1"
3
3
  end
data/mta_sts.gemspec CHANGED
@@ -6,10 +6,9 @@ Gem::Specification.new do |spec|
6
6
  spec.version = MtaSts::VERSION
7
7
  spec.platform = Gem::Platform::RUBY
8
8
  spec.required_ruby_version = ">= 3.3.4"
9
- spec.authors = [ "PostRider" ]
10
- spec.email = [ "support@postrider.dev" ]
9
+ spec.authors = [ "Simon Lev" ]
11
10
 
12
- spec.summary = "MTA-STS policy discovery and enforcement for outbound SMTP in Ruby."
11
+ spec.summary = "SMTP MTA Strict Transport Security for Ruby."
13
12
  spec.description = "Answers one question before delivering a message: must this connection be encrypted, and to which servers?"
14
13
 
15
14
  spec.homepage = "https://github.com/mailpiece/mta_sts"
metadata CHANGED
@@ -1,10 +1,10 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mta_sts
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.0
4
+ version: 0.1.1
5
5
  platform: ruby
6
6
  authors:
7
- - PostRider
7
+ - Simon Lev
8
8
  bindir: exe
9
9
  cert_chain: []
10
10
  date: 1980-01-02 00:00:00.000000000 Z
@@ -39,8 +39,6 @@ dependencies:
39
39
  version: '0.2'
40
40
  description: 'Answers one question before delivering a message: must this connection
41
41
  be encrypted, and to which servers?'
42
- email:
43
- - support@postrider.dev
44
42
  executables:
45
43
  - mta-sts
46
44
  extensions: []
@@ -84,5 +82,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
84
82
  requirements: []
85
83
  rubygems_version: 4.0.3
86
84
  specification_version: 4
87
- summary: MTA-STS policy discovery and enforcement for outbound SMTP in Ruby.
85
+ summary: SMTP MTA Strict Transport Security for Ruby.
88
86
  test_files: []