June 2025 - Mailman-users - lists.mailman3.org

Stalwart plugin
by info＠joergschulz.de Aug. 30, 2025

Aug. 30, 2025

Hi all, I'm just reviewing Stalwart as a many-in-one mailing system. Did anybody yet succeed in plugging mailman into stalwart (the incoming bit seems to be difficult)?

3 2

Missing Base64 encoding from control message reply
by lists-mailman3＠janaberger.de Aug. 22, 2025

Aug. 22, 2025

Dear all, I have a setup with GNU Mailman 3.3.8 where a user tried to subscribe. When replying to the "confirm" message, the user received a completely garbled response, like so: N�z˥��ʋ�zf��&��j��u�[zZ0:��v��,j�z֢��k�e�0 4Dҹ��r�^b��r�ߊ��*'��yם��{ax�L�X��0:��v��,j�z֢��k�d�m�-��zz�rn��l]y+��-E�( �^N��'��M��tۯ��Mz��^i��׮��}�o�\ӷ��6sN�zf��ݮ��r��z˥��b�{h��݉��f�r�ne== (The line above contains numerous unprintable characters, etc.) The user then forwarded the .eml file to me, which clearly shows the contents of the mail as plain text while being announced as base64 (Content-Transfer-Encoding: base64): START OF EML Return-Path: <LISTNAME-bounces(a)lists.DOMAIN.COM> Received: from DOMAIN.COM ([144.76.173.241]) by mx-ha.USERDOMAIN.NET (mx06 [IP]) with ESMTPS (Nemesis) id 1M27WV-1qhRFk39Sr-00AQcR for <USER(a)USERDOMAIN.NET>; Thu, 21 Sep 2023 19:10:37 +0200 Received: from localhost (localhost.localdomain [127.0.0.1]) by DOMAIN.COM (Postfix) with ESMTP id 4058B3BD5EEF for <USER(a)USERDOMAIN.NET>; Thu, 21 Sep 2023 19:10:37 +0200 (CEST) Received: from DOMAIN.COM ([127.0.0.1]) by localhost (DOMAIN.COM [127.0.0.1]) (amavis, port 10024) with ESMTP id x0ngnlRnGraH for <USER(a)USERDOMAIN.NET>; Thu, 21 Sep 2023 19:10:37 +0200 (CEST) Received: from [IP] (unknown [IP]) by DOMAIN.COM (Postfix) with ESMTP id DC8603BD5EEE for <USER(a)USERDOMAIN.NET>; Thu, 21 Sep 2023 19:10:36 +0200 (CEST) Subject: =?utf-8?q?The_results_of_your_email_commands?= From: LISTNAME-bounces(a)lists.DOMAIN.COM To: USER(a)USERDOMAIN.NET Content-Transfer-Encoding: base64 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Message-ID: <169531623416.29.5762261018677554285@mailman-core> Date: Thu, 21 Sep 2023 17:10:34 +0000 Precedence: bulk X-Mailman-Version: 3.3.8 List-Id: <LISTNAME.lists.DOMAIN.COM> List-Help: <mailto:LISTNAME-request@lists.DOMAIN.COM?subject=help> List-Owner: <mailto:LISTNAME-owner@lists.DOMAIN.COM> List-Subscribe: <mailto:LISTNAME-join@lists.DOMAIN.COM> List-Unsubscribe: <mailto:LISTNAME-leave@lists.DOMAIN.COM> Envelope-To: <USER(a)USERDOMAIN.NET> X-Spam-Flag: NO The results of your email command are provided below. - Original message details: From: USER <USER(a)USERDOMAIN.NET> Subject: Re: Your confirmation is needed to join the LISTNAME(a)lists.DOMAIN.COM mailing list. Date: Thu, 21 Sep 2023 19:10:26 +0200 Message-ID: <3c1eaaf8-1677-432f-b9dc-07f18902c06c(a)email.android.com> - Results: Confirmation token did not match - Done. END OF EML Is this possibly a bug in Mailman? Any ideas on what else could be causing this?

7 16

Heads up: settings.ACCOUNT_AUTHENTICATION_METHOD is deprecated
by Andreas Vetter Aug. 1, 2025

Aug. 1, 2025

Hello, I have a venv installation of: mailman postorius django-mailman3 hyperkitty mailman-web I just did a pip install -U --upgrade-strategy eager When running mailman-web runjobs -l I get the following Warning: System check identified some issues: WARNINGS: ?: settings.ACCOUNT_AUTHENTICATION_METHOD is deprecated, use: settings.ACCOUNT_LOGIN_METHODS = {'email', 'username'} I guess this is from allauth (version django-allauth-65.4.1). Changing ACCOUNT_AUTHENTICATION_METHOD to ACCOUNT_LOGIN_METHODS in /etc/mailman3/settings.py is not enough. One has to edit venv/lib/python3.11/site-packages/mailman_web/settings/mailman.py -- Mit freundlichen Gruessen, Andreas Vetter

4 9

Upgrading other python packages than the mailman ones in a venv results in dependency conflicts
by Ulf R. July 29, 2025

July 29, 2025

Hello, I know this should be the way to upgrade: https://docs.mailman3.org/en/latest/upgrade-guide.html I have 3.3.10 installed. I saw that some python packages are outdated an tried this which install all outdated packages in a row: pip list --outdated --format=json | jq '.[].name' | xargs -n1 pip install -U One outdated package was django and this part happened: ------------------------------- vDownloading Django-5.1.4-py3-none-any.whl (8.3 MB) Installing collected packages: Django Attempting uninstall: Django Found existing installation: Django 4.2.16 Uninstalling Django-4.2.16: Successfully uninstalled Django-4.2.16 ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts. hyperkitty 1.3.12 requires django<5.1,>=4.2, but you have django 5.1.4 which is incompatible. mailman-web 0.0.9 requires django<4.3,>=4.0, but you have django 5.1.4 which is incompatible. postorius 1.3.13 requires django<5.1,>=4.2, but you have django 5.1.4 which is incompatible. django-mailman3 1.3.15 requires django<5.1,>=4.2, but you have django 5.1.4 which is incompatible. Successfully installed Django-5.1.4 ------------------------------- So I made a roll back. Is this really the only secure way to update the venv?: pip install -U mailman postorius django-mailman3 hyperkitty mailman-web May be yes and I have to ignore the rest? ;-) Thank you und regards

5 6

Enforcing SSO and subscription options
by dlb-ml＠anl.gov July 21, 2025

July 21, 2025

Contrary to the messages I found in the archive, rather trying to delete or remove the social login portion of the sign in page, I'm looking to see if there's any way to isolate the third-party login section and prevent local account sign in and sign up. This way, we can ensure that the people within our organization are using a stronger auth method that prioritizes MFA, rather than just username/password. To do this, our plan is to block signups using "ACCOUNT_ADAPTER = 'django_mailman3.views.user_adapter.DisableSignupAdapter'" and to remove the portions of the login template such that the username/password/forgot password fields are removed, leaving just the button to our SSO instance. I'm anticipating that this should be sufficient to block username/password sign ins, and is resistant to page manipulation due to CSRF tokens, but I wanted to ask to see if there was a better way, like an official configuration (which I have not found yet). I did see that there is the SOCALACCOUNT_ONLY option, as provided by allauth (https://docs.allauth.org/en/latest/socialaccount/configuration.html) but that broke any attempt to display the sign in page, and I'm assuming is not supported with the current version of MM3. Is my plan to modify the templates viable? Additionally, because external users would not have access to their own dashboards within the web UI, and since we are planning on disabling anonymous subscriptions with "SHOW_ANONYMOUS_SUBSCRIBE_FORM=False", the only two viable ways to subscribe to a list for them would be: 1) Send a request directly to the list owner or a superadmin to subscribe/unsubscribe the address 2) Allow email commands to subcribe/unsubscribe users (i.e. $LISTNAME-join@$DOMAIN) Given the discussions on disabling the anonymous subscription form, are the email commands a less spam-susceptible solution or are they just as vulnerable as the form? Thanks

4 7

Caching problem with templates
by Mark June 29, 2025

June 29, 2025

Caching problem with templates. GNU Mailman 3.3.10 Python 3.11.2 Postorius Version 1.3.13 Venv installation per docs Hi All, A footer template is created and initially it works as expected. Editing the footer template sees the new content written to the database, In addition to viewing the edited content in the database, the new template can also be viewed in Lynx on localhost at: http://localhost:8000/mailman3/api/templates/list/<IDENTIFIER>/list:member:regular:footer The problem is that the original template is being cached somewhere and the old footer persists in new emails. In trying to get the edited footer to show in the emails I've restarted mailman3/mailmanweb, rebooted the server - but no joy. Any advice on how to flush the cache or hammer this gremlin greatly appreciated. Thanks, Mark

2 12

redirecting -bounces replies
by Hirayama, Pat June 26, 2025

June 26, 2025

Greetings, Is it possible to redirect the -bounces alias of a specific list so that it also goes to a person, in addition to the normal bounces processing for that list? In Mailman2, I know that I could do that by modifying the aliases table. I've been poking around in Mailman3, but haven't managed to figure out which container I need to be looking at. And rather than keep spinning, I figured that I'd ask the hive mind, since I'm sure one of you can quickly point me to the correct location. Thanks! -p Pat Hirayama Pronouns: he/him/his Systems Engineer IT | Systems Engineering - Infrastructure Fred Hutch Cancer Center O 206.667.4856 phirayam(a)fredhutch.org<mailto:phirayam@fredhutch.org>

5 14

Change the default value for the General Archive Policy
by Markus Grandpré June 26, 2025

June 26, 2025

Dear list, currently, when I create a new mailing list with MM3 the value for "Archive policy" is always set to "Public archives". I'd like to change the default value for "Archive policy" to "Do not archive this list". How can I do this? In Debian 12 I find in </usr/lib/python3/dist-packages/postorius/forms/list_forms.py>: mlist_properties = ['archivers'] archive_policy_choices = ( ('public', _('Public archives')), ('private', _('Private archives')), ('never', _('Do not archive this list')), ) archive_rendering_mode_choices = ( ('text', _('Plain text')), ('markdown', _('Markdown text')), ) archive_policy = forms.ChoiceField( choices=archive_policy_choices, widget=forms.RadioSelect, label=_('Archive policy'), help_text=_('Policy for archiving messages for this list'), ) but have no idea how to change the settings here. Your help is very appreciated. Best regards, Markus Grandpré -- Markus Grandpré Universität Konstanz Kommunikations-, Informations- und Medienzentrum (KIM) Abteilung IT-Dienste Forschung, Lehre und Infrastruktur Sachgebiet Diensteadministration Tel: ++49 7531 88 4342

4 6

Creating users via RestAPI / User-Management - a bunch of questions
by Christian Schneider June 23, 2025

June 23, 2025

Dear Mark and companions, somehow I can not cope with the user management... (I am running a venv-installation, latest stable versions) I read this manual: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/rest/docs/… and played with the RestAPI calls... I know about the fine grained differences between user and member, admin/owner, superuser... and about the two user databases in PostgreSQL and Django-Framework. What I stumble upon is the RestAPI calls to create a "working" user (with the ability to login via WebUI). When I follow the manual (from the url above) I create a user (including password) that appears in the PostgreSQL database. (And this user is visible on the User-URL (https://example.com/mailman3/users)) Even when I (via WebUI) set the user as "approved" this user is not able to log in... I assume this restriction is in accordance to the fact that there is not equivalent Django user. (There was a mail in the archive of the MM3 user group...stating that one has to use the Django RestAPI to create the appropriate user) When I create the user using the WebUI (https://example.com/accounts/signup/?next=/mailman3/lists/) the new user is created in the right (complete) way...appearing in the PostgreSQL database and as a user in Django. How is this sync between the two databases realized? (The Django user also has the correct status (no staff status / no superuser status / just active status) how is this realized?) As I am not very familiar with python programming (I know Perl/Java/C++ and have an (maybe outdated) concept of OOP), is there a quick way to implement this kind of sync by copying the register logic from mailman's python action script for registering? Other questions: Will there be a create_admin_user-script that is callable via CLI (like createsuperuser or create_list)? (This script ought create a user in PostgreSQL and as Django user) How will a social account provider (like oidc) linkage (in Django) fit in this concept? Will oidc-accounts be copied to the Django's user database (or PostgreSQL db) or is it an on-the-fly check against the oidc-provider? (I assume second option) What are the status-flags (staff status/superuser status/active status) of the linked oidc-accounts? (Can I specify the status flags?) A conceptual thought: When "user1" (with email user1(a)example.com) is known to django via oidc linkage and I create "user1" (also with email user1(a)example.com) via RestAPI calls (following the url https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/rest/docs/…) do I have a "complete" user then? I mean a user who is able to login and who can be assigned to a list as admin (e.g.) (In this case I would not have to care about the Django user database... ;-)) Thank you for some clarifying hints... :-) Chris

3 3

two signatures on sent mail?
by STR June 20, 2025

June 20, 2025

Hi, I am a very non-savvy mailman list user. I am trying to set up a list via cPanel but when I send emails there are two signatures. One is my usual signature and the other, below, is appended by Mailman and includes an http link to a non-existent page on my website. How do I strip the auto signature, just leaving my own? I use Mailman via cPanel on two separate hosting accounts. One works fine and this new one attaches the list address. I can't see what I did differently with the first! any help gratefully received Kate

3 3