Dear Maintainer,

I am running postfix-policyd-spf-python with my postfix installation and logwatch. When logwatch runs, it reports unmatched lined like:

 **Unmatched Entries**
        1   Nov 10 13:06:39 mail-www policyd-spf[586022]: : prepend Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=81.3.27.42; helo=mail01.ipfire.org; envelope-from=development-bounces@lists.ipfire.org; receiver=howitts.co.uk

The the problem is that the filter is not expecting (mailfrom) in the string it is looking for. I have also seen strings like (no SPF record) and (sender SPF authorized) in the logs and they are not being picked up either.

The patch to fix the logs I have observed so far is:
--- /usr/share/logwatch/scripts/services/.postfix.orig  2024-11-10 18:12:26.555940987 +0000
+++ /usr/share/logwatch/scripts/services/postfix        2024-11-11 17:02:32.000000000 +0000
@@ -1892,7 +1892,7 @@
    # Pass;      identity=helo;     client-ip=192.168.0.2; helo=example.com; envelope-from=<>;            receiver=bogus@example.net
    # Permerror; identity=helo;     client-ip=192.168.0.4; helo=example.com; envelope-from=f@example.com; receiver=bogus2@example.net
    # Softfail;  identity=mailfrom; client-ip=192.168.0.6; helo=example.com; envelope-from=f@example.com; receiver=yahl@example.org
-   if ($line =~ /^(?:prepend Received-SPF: )?(Pass|Fail|None|Neutral|Permerror|Softfail|Temperror);? (.*)$/) {
+   if ($line =~ /^(?:: prepend Received-SPF: )?(Pass|Fail|None|Neutral|Permerror|Softfail|Temperror) \(.+\) (.*)$/) {
          my $result = $1;
          my %params = $2 =~ /([-\w]+)=([^;]+)/g;
          #$params{'s'} = '*unknown' unless $params{'s'};

There seem to be quite a few possible values to allow for in /usr/lib/python3/dist-packages/spf.py with different punctuation (-.:=~ and space) so I am doing a non-greedy match of all characters between brackets to pick them up.

Also note that I have added a ": " at the beginning of the match string.
This is needed as well, but could be possibly be considered a bug in
policyd-spf that those characters are in the log string in the first place.