Re: [Savannah-hackers-public] Sender address@hidden

[Bob Proulx]

I will comment upon the headers to the best of my knowledge of them.

> Return-Path: <address@hidden>

This will be the envelope sender recorded as the Return-Path.

> Delivered-To: address@hidden
> Received: by calliope (Postfix) id 8FFC56F5B1; Wed, 20 Jul 2016 13:39:03 
> -0400 (EDT)
> Delivered-To: address@hidden
> Received: by calliope (Postfix, from userid 110) id 89FD06F605; Wed, 20 Jul 
> 2016 13:39:03 -0400 (EDT)
> X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on calliope
> X-Spam-Level: 
> X-Spam-Status: No, score=-2.4 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD,
>  T_HEADER_FROM_DIFFERENT_DOMAINS,URIBL_BLOCKED autolearn=ham
>  autolearn_force=no version=3.4.0
> Received: from calliope (localhost [127.0.0.1]) by calliope (Postfix) with
>  ESMTP id 6FF3C6F5B1 for <address@hidden>; Wed, 20 Jul 2016 13:39:02 -0400 
> (EDT)
> Envelope-to: address@hidden
> Delivery-date: Wed, 20 Jul 2016 13:38:22 -0400
> Received: from fencepost.gnu.org [208.118.235.10] by calliope with POP3
>  (fetchmail-6.3.26) for <address@hidden> (single-drop); Wed, 20 Jul 2016 
> 13:39:02 -0400 (EDT)

Those are all pretty normal on your receiving side of things.  Was
delivered to fencepost.  You used POP to receive it from fencepost.

> Received: from eggs.gnu.org ([2001:4830:134:3::10]:38251) by
>  fencepost.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:256) (Exim 4.82)
>  (envelope-from <address@hidden>) id 1bPvRu-0000j0-4X for
>  address@hidden; Wed, 20 Jul 2016 13:38:22 -0400
> Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
>  (envelope-from <address@hidden>) id 1bPvRp-0005g1-PE for
>  address@hidden; Wed, 20 Jul 2016 13:38:20 -0400
> Received: from savannah.gnu.org ([208.118.235.70]:37416
>  helo=frontend.savannah.gnu.org) by eggs.gnu.org with esmtp (Exim 4.71)
>  (envelope-from <address@hidden>) id 1bPvRp-0005ft-M8 for
>  address@hidden; Wed, 20 Jul 2016 13:38:17 -0400
> Received: by frontend.savannah.gnu.org (Postfix, from userid 33) id
>  5AB1D85D67; Wed, 20 Jul 2016 17:38:17 +0000 (UTC)

This is the trail from Savannah's frontend to fencepost.  Looks normal.

> To: address@hidden
> Subject: Project Approved

Normal.

> X-PHP-Originating-Script: 0:sendmail.php

I recall that PHP adds a header like this.

> X-Savane-Server: savannah.nongnu.org:443 [208.118.235.71]
> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
>  Firefox/38.0 Iceweasel/38.8.0

Those are locally generated headers by the Savnanah PHP code.  I am
pretty sure.

> X-Apparently-From: 210.78.142.28 (Savane authenticated user hlam)

Having looked at this in a little more detail I see that Hugh Mayfield
is the Savannah volunteer who reviewed the project and approved it.
(Thanks Hugh!)  Savannah records this as the identity of the person
who triggered the action.  Which is why it shows up there.  Makes
sense.  I hadn't put all of the pieces together at the initial
viewing.

> Message-Id: <address@hidden>
> Date: Wed, 20 Jul 2016 17:38:17 +0000 (UTC)

Normal.

> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x
> X-Received-From: 208.118.235.70

Added by eggs on incoming messages.  eggs is the MX relay receiving
mail for fencepost.  It is normal for incoming mail to come through
eggs on the way to fencepost.

> X-UIDL: `Tp"!IfV!!~^A"!l^8"!

Added by qpopper on fencepost.  (Which I specifically mention because
otherwise that header really looks like a jumble of modem line noise.
(If anyone remember what modem line noise from "back in the day" is
these days.)

> MIME-Version: 1.0
> Content-Type: text/plain
> Content-Transfer-Encoding: quoted-printable

Normal.

And so the secondary mystery is solved.  The original mystery is still
unknown however.  I think the From: header is getting left empty for
some reason and therefore root AT localhost is getting substituted.  I
will keep looking into that part of the problem.

Bob