mailman has a dependency on "webserver", but it is configured with "apache" as the CGI user/group. That smells like trouble; for example the boa package in Extras provides "webserver", but does not create the "apache" user, nor is it really its business. Fix: change "Requires: webserver" to "Requires: httpd".
hmm, right, but one could create those user/grp and run mailman with another webserver?
Probably. But how does someone know that the user and group must be created manually? And even if they exist, can that other webserver actually run the scripts as apache:apache, and if not, how does that affect mailman?
right, right.... I'll change that...