PERL-NOCEM(8)

💅 perl-nocem — the manual (PERL-NOCEM(8)) 🎀

InterNetNews Documentation ✨ bestie edition ✨

---

🌸 NAME 🌸

perl-nocem — a NoCeM-on-spool implementation for INN 2.x 🦋

---

✨ SYNOPSIS ✨

perl-nocem [-hlu] [-b directory] [-c filename] [-g command] [-G command]
[-i filename] [-k keyring] [-v level]

That's the whole vibe check right there 👑 — the flags show up again down below (-g/-G for the gpg commands, -k for the keyring, -l for logging, -v for the debug level), so keep reading 💖

---

💜 DESCRIPTION 💜

Okay so first things first: NoCeM is literally pronounced "No See 'Em" 🗣️ and it's a protocol that lets authenticated third parties drop notices you can use to cancel unwanted articles — think spam, and also articles in moderated newsgroups that their moderators never approved 🙈. Readers can use it as a third-party killfile too. The whole point? It's intended to eventually replace the protocol for third-party cancel messages, because those can be forged way too easily — cancel messages aren't authenticated, unlike NoCeM notices. Periodt. 💀

perl-nocem processes third-party, PGP-signed article cancellation notices 🔏. And here's the slay part: you can honour a selective set of NoCeM notices, not all of them 🎯. You configure the list of NoCeM issuers you trust in nocem.ctl in pathetc, and add the corresponding public PGP keys to your NoCeM keyring — by default no PGP keys are installed, so nobody is trusted 🙅‍♀️. Whether you honour their notices is entirely up to you, based on the criteria they use. You're encouraged to regularly peek at the official NoCeM Registry at https://rosalind.home.xs4all.nl/nocemreg/nocemreg.html to check for possible new NoCeM issuers to add and see an overview of their policy 👀. The daily summary of NoCeM messages sent at https://www.novabbs.com/SEARCH/search_nocem.php?stats=daily may also be useful 🍓.

perl-nocem expects either storage tokens or file names on its standard input, and it'll read and process the corresponding article 📥. It appends all status messages to perl-nocem.log in pathlog if the syslog facility isn't available or the -l flag is explicitly used; otherwise the syslog facility is used, in which case status messages are appended to a file usually named news.notice in pathlog 📝. (> Some logs will be written only if debug level is set up to be logged via syslog. iykyk 🧚)

---

🌈 CONFIGURATION 🌈

Processing NoCeM notices is, lowkey, easy to set up 👑

1. Get GnuPG (or an equivalent OpenPGP implementation) so you can verify the signature of NoCeM messages 🔐. It'll give you the gpg and gpgv programs. If GnuPG was already installed back when INN was configured, then the paths to these programs were taken into account ✨. Otherwise, you can use the -g and -G flags to set — or even override — the commands perl-nocem will use to run these programs 💫.

All still active NoCeM issuers use rather modern PGP keys accepted by both GnuPG 1.x and 2.x versions 👑. It is no longer needed to explicitly use gpg1 to process NoCeM notices, so don't come for me about that 💅

2. Import the public keys of the NoCeM issuers you trust so you can check the authenticity of their notices 🫶. Run this:

gpg --no-default-keyring --allow-non-selfsigned-uid \
    --primary-keyring <pathetc>/pgp/ncmring.gpg --no-options \
    --no-permission-warning --batch --import <key-file>
chmod 644 <pathetc>/pgp/ncmring.gpg

Here <pathetc> is the value of the pathetc parameter set in inn.conf, and <key-file> is the file containing the public key(s) to import 🔑. The keyring lives in <pathetc>/pgp/ncmring.gpg by default — you only have to create the directory <pathetc>/pgp before using gpg (it will automatically generate the ncmring.gpg file) and make sure the news user can read this file once it's generated 👀. You can use another location and file name for the keyring, and then run perl-nocem with the -k flag 🌸.

The public keys of NoCeM issuers can be found on the web site of The NoCeM Registry at https://rosalind.home.xs4all.nl/nocemreg/nocemreg.html, where you can even download a unique file which contains all the public keys 🎁.

3. Create or update the nocem.ctl configuration file in pathetc to say which NoCeM issuers and which types of notices you want to follow 📋. This permission file contains lines like:

bleachbot@httrack.com:spam,site
pgpmoose@killfile.org:pgpmoose-forged-moderation

This will remove all articles for which the issuer (the first part of the line, before the colon ":") has issued NoCeM notices of a type present in the comma-separated list of types specified after the colon (using "*" is possible, and means all types are accepted ✅).

Blank lines and lines beginning with a hash sign ("#") are ignored 🙈. Case is insensitive. Any entry with no corresponding public PGP key in the keyring will be skipped 💀.

You'll also find information about the issuers on the web site of The NoCeM Registry. Note that INN is shipped with an up-to-date nocem.ctl file already configured with the current NoCeM issuers 👑. (Only the public PGP keys installed at the previous step are not included — that's so as to leave you the choice of whom to trust, and let you download the most recent ones, in case they've changed 🦋.)

4. Add an entry to the newsfeeds file in pathetc so perl-nocem gets fed the NoCeM messages (cross)posted to news.lists.filters, the global newsgroup where notices should be sent 📰:

nocem!\
    :!*,news.lists.filters\
    :Tc,Wf,Ap:<pathbin>/perl-nocem

...with the correct path to perl-nocem, located in <pathbin>, plus any optional flag you want to use 💫. Then run inncheck to ensure the syntax of the modified newsfeeds file is correct, and reload it via ctlinnd reload newsfeeds 'NoCeM channel feed' 🔄.

Note that you should at least carry news.lists.filters on your news server (or other newsgroups where NoCeM notices are sent) if you wish to process them 👀.

5. Everything should now work 🎉 But fr, don't hesitate to manually test perl-nocem with a NoCeM message, using either:

grephistory '<Message-ID>' | perl-nocem -l -v 2
echo '/path/to/a/nocem/message' | perl-nocem -l -v 2

perl-nocem expects either storage tokens or file names on its standard input (grephistory returns the storage token of an article identified by its Message-ID) 🧠.

Check the logs of that test in perl-nocem.log in pathlog 📝.

You can also check the list of installed PGP public keys with the following command, adapted to the location of the NoCeM keyring 🔑:

gpg --no-default-keyring --list-keys \
    --primary-keyring <pathetc>/pgp/ncmring.gpg

✨ OPTIONS ✨

Okay bestie, here's where the fun stuff lives 💅 every flag, every default, no skips.

• -b directory — backs up cancelled articles into files in directory. That directory needs to already exist and be writable by the news user, mmkay? Files get named issuer%type, and they hold the articles that were actually removed from your news spool by that NoCeM issuer for that type of NoCeM notice. Heads up though: if a cancelled article isn't in your news spool at the moment the notice gets processed, it literally cannot be backed up 😭

This flag is mostly for auditing possible false positives. And since backups are not automatically purged, you gotta prune them yourself from time to time after you've looked at what's inside. Self-care for your disk, bestie 🧹

• -c filename — by default, perl-nocem reads a config file named nocem.ctl in pathetc. This flag lets you read some other config file instead, specified with an absolute path.
• -g command — by default, perl-nocem runs the gpg(1) binary whose path was figured out when INN was configured. If GnuPG wasn't installed at that time, or if you wanna use a different program entirely, this flag is your bestie 🫶 Please make sure command includes at least an equivalent of the default options given to gpg — otherwise perl-nocem may malfunction, and we do NOT want that vibe.

Assuming "/bin/gpg" corresponds to the gpg binary, the default is:

-g "/bin/gpg --status-fd=1 --verify --allow-weak-digest-algos"

• -G command — by default, perl-nocem runs the gpgv(1) binary whose path was determined when INN was configured. Same deal as above: if GnuPG wasn't installed back then, or you want another program, this flag helps. Please ensure at least an equivalent of the default option given to gpgv is present in command, or perl-nocem may malfunction.

Assuming "/bin/gpgv" corresponds to the gpgv binary, the default is:

-G "/bin/gpgv --status-fd=1"

Note that gpg will be preferentially used over gpgv when both are available — unless -g is given an empty string. Sneaky but true 👀

• -h — prints a usage message to standard output and exits. The classic.
• -i filename — when this flag is used, perl-nocem includes an external Perl script named filename, specified with an absolute path. It lets you load a "local_want_cancel_id" function with local rules to fine-tune, within a NoCeM notice, which articles actually get cancelled. Otherwise? Every article present in a NoCeM notice is cancelled by default. Periodt.

This function is called for every article in the notice and has access to several variables: the Message-ID "$msgid" of the NoCeM message, the Message-ID "$artid" of the article to cancel, the comma-separated list of newsgroups "$groups" to which the article to cancel was posted, and the hash reference "$hdrs" to the pseudo header fields of the NoCeM notice, in lowercase value. The article is kept if the function returns "0", and cancelled otherwise.

Here's a lil illustration of what this function can do, when defined in filename and the -i flag is used:

sub local_want_cancel_id {
    my ($msgid, $artid, $groups, $hdrs) = @_;

    my $carried = 0;

    # Walk through the newsgroups the article was posted to.
    foreach my $group (split(/,/, $groups)) {
        # Keep it if posted to news.software.nntp.
        return 0 if $group eq "news.software.nntp";

        # Keep it if posted to fr.* and the issuer is "john".
        return 0
          if $group =~ /^fr\./ and $hdrs->{issuer} eq "john";

        # The article has been posted to at least a newsgroup
        # in the fr.* or news.* hierarchy.  You may use here
        # a regular expression corresponding to the newsgroups
        # pattern you ask your feeds to send you.
        $carried = 1 if $group =~ /^(fr|news)\./;
    }

    # In case the server only carries fr.* and news.*, this
    # rule permits discarding NoCeM notices related to
    # newsgroups not carried by the server, and therefore
    # neither treating nor remembering in the history file
    # Message-IDs of articles which won't reach the server.
    return 0 if not $carried;

    # Keep it if only posted to news.admin.net-abuse.usenet
    # and the type of the notice is "spam".
    return 0
      if $groups eq "news.admin.net-abuse.usenet"
      and $hdrs->{type} eq "spam";

    # Cancel it!
    return 1;
}

If any syntax problem happens when Perl loads the function, perl-nocem will die and report the reason in the logs 😭 You'll then have to fix the function. No pressure.

• -k keyring — by default, perl-nocem verifies the signatures of NoCeM messages with the PGP public keys present in a keyring named ncmring.gpg in the pathetc/pgp directory. This flag lets you use another keyring, specified with an absolute path.

A --keyring= flag with the keyring value is then passed to the gpg(1) and gpgv(1) commands — unless keyring is an empty string.

• -l — by default, perl-nocem sends logs to syslog(3). In case the syslog facility isn't available, or this flag is used, logs get sent to perl-nocem.log in pathlog. Error log level will still additionally be sent to syslog if it's available. Double-dipping, iconic.
• -u — by default, innreport will show unprocessed NoCeM notices in the daily reports it generates. When this flag is used, issuers or types of notices not configured in nocem.ctl will still be mentioned in the logs, but the corresponding log lines will not be parsed by innreport. Lowkey stealth mode 🙈
• -v level — increases log verbosity to that level, from 1 to 3. Default is "1". Turn it up 🎚️

---

🌸 FILES 🌸

• pathbin/perl-nocem — the Perl script itself, used to process NoCeM messages.
• pathetc/nocem.ctl — the configuration file that specifies which NoCeM notices get processed. Another file can be specified with the -c flag.
• pathetc/pgp/ncmring.gpg — the keyring containing the public keys of trusted NoCeM issuers. Another file can be specified with the -k flag.
• pathlog/perl-nocem.log — the log file used when the syslog facility isn't available, or when the -l flag is used.

---

🦋 NOTES 🦋

The accuracy of the newsgroups following the Message-IDs to cancel in the NoCeM body is not checked — nor is the Newsgroups pseudo header field, if present. And honestly? The reasoning is kinda sweet: since we already trust the issuer of the notice about the Message-IDs they mark as spam, let's also be confident about the listed newsgroups 💖 (Yes, that's really the logic fr fr.)

---

🎀 HISTORY 🎀

Copyright 2000 by Miquel van Smoorenburg <miquels@cistron.nl>.

Copyright 2001 by Marco d'Itri <md@linux.it>.

---

🌈 SEE ALSO 🌈

gpg(1), gpgv(1), grephistory(1), inn.conf(5), innreport(8), newsfeeds(5), pgp(1).

---

And that's the whole thing, bestie — go read those other manpages, you got this 🫶 This page is from INN 2.7.4, dated 2026-06-12. Slay, go cancel some spam 💅✨