An issue -- each time an update tarball is created, the zone serial number for the "top level" spamassassin.org SOA needs to be incremented.
I'd prefer to avoid this, but I can't really see a way to do so, unless we explicitly set up updates.spamassassin.org. as a separate zone with a separate SOA of its own -- and therefore separate secondaries etc! suggestions? Theo? --j.