Postfix main.cf has:
mailbox_command = /usr/bin/procmail
/etc/procmailrc is: DROPPRIVS=yes
:0fw | /usr/bin/spamc -u $LOGNAME -x -s 100000000
/var/mail/jwz gets X-Spam-Status headers written into it. So far so good.
/etc/dovecot/dovecot.conf (for dovecot 2.0) has:
protocol lda { ... mail_plugins = sieve ... }
Dovecot is managing to read messages out of /var/mail/jwz and deliver them to me over IMAP, with SA headers intact. But it's not running sieve, possibly not even running its own lda, and everything I have googled so far is a twisty maze of illiterate wikis that may or may not be written for versions of the software that is 5+ years out of date. I thought maybe the answer was to add
| /usr/libexec/dovecot/deliver -d $LOGNAME
to the end of procmailrc, but that let me to discover that:
% cat testmsg | /usr/libexec/dovecot/deliver -d jwz
Exit 75
lda: Error: dlopen(/usr/lib64/dovecot/lda/lib90_sieve_plugin.so) failed: /usr/lib64/dovecot/lda/lib90_sieve_plugin.so: undefined symbol: tried_default_save
lda: Fatal: Couldn't load required plugins
So I guess I have the wrong version of the sieve plugin? I have: dovecot-2.0-0.18_114_rc3.el5 and dovecot-sieve-0.1.17-5.el5 on CentOS release 5.4 (Final)
Update: Ok, I seem to have figured it out. First, "dovecot-pigeonhole" is the oh-so-obviously-named package in which the proper version of sieve resides. Second, it looks like I don't actually need to let procmail darken my doorstep at all, as I can just do this in postfix's main.cf:
mailbox_command = /usr/bin/spamc -x -s 100000000 -e /usr/libexec/dovecot/deliver
Also, log_path and info_log_path have to be blank (meaning "use syslog") in the lda section of dovecot.conf, otherwise lda/sieve can't write to dovecot's log files. Hopefully this isn't doing something stupid like allowing sieve to write arbitrary files as root. With the quality of the related documentation, who can tell. But the logfile thing suggests not, I guess.
Update 2: Oh, well here's a problem: that bounces mail if spamd is down. Which it is, briefly, every night when it is restarted with -HUP after running "sa-update". Dammit. Any suggestions?
Update 3: Add "|| exit 75" to mailbox_command to have Postfix queue-and-retry on failure.