Vote tabulation - UID/email detection doesn't work when sent from external email with strict DKIM settings

[alitheg]

If a user emails the mailing list to vote but does so from an external domain with a strict DKIM setting (p=reject), the email ATR sees is "dev@.apache.org" (example). This is due to the rewrite by the ASF mail server, and means the release manager doesn't know whose vote it is (and whether it's binding or not)

If we want to show the actual person, we'd need to do one or more of a few things:

• Detect the mailing list name itself as the FROM field
• If that's the case, check reply-to (which will include the original user if there wasn't already a reply-to set)
• If that still the mailing list, get the email from the CC field (it's either the first or last, to be investigated)
• If we get a mail, use that as the email
• If not, we could use the user's name from the From field ("Alastair McFarlane via dev@...")

Once we have a mail, we could also potentially look it up in the mail field in LDAP to see if we have a UID for them or not.

The goal is that we give the release manager all of the information that is available, but it is up to the release manager to check that information and to make the final determination.

We can decide how far we want to go to provide "all the info that is available" but I'd say we should at least pull the person's name if the email comes up as "dev@"

[sbp]

Perhaps we could always show the person's name? We could just add an extra column for that. If the email comes up as "dev@" we could perhaps show it as "—" or "Unknown", or do the CC determination and then present it as a heuristic from CC (not sure what the UI would be for that, but I'm sure we can think of something).

[alitheg]

Turns out we were already mapping emails via the LDAP alternate mail field - it was just a case of making sure we get it from the CC field.

It now looks like the below. I think this is fine?

[dave2wave]

@alitheg The logic should be able to detect that both of these votes were from the same individual.

[alitheg]

@dave2wave I talked with @sbp about this last week. In this case it should as the email was registered in LDAP (which would be required to pick that up - otherwise it could be a different Alastair McFarlane) but the view we get from lists.apache.org is anonymised (the ... in the email) so we can't match the mail against LDAP. Sean's suggestion was we talk to Infra about getting some level of exception to the anonymisation when the call comes from ATR.

[alitheg]

@sbp should we keep this open pending some change to the data we get, or should we close it and track that remaining issue another way / in another issue?