DKIM2 v0.3.3

Commit Summary

Changed

• Change: Move the library module to the repository root (ce0076c)

Fixed

• Fix: Refresh workspace checksums through a sync-workspace target (da19ecc)
• Fix: Harden the root library layout after review (d64bf5f)

Full Changelog: v0.3.2...v0.3.3

DKIM2 v0.3.2

Commit Summary

Documentation

• Docs: Explain ML-DSA-44 keys in the keys and DNS guide (7f8615c)

Full Changelog: v0.3.1...v0.3.2

DKIM2 v0.3.1

Commit Summary

Documentation

• Docs: Add reproducible manual pages for the DKIM2 commands (401bab4)
• Docs: Add example-driven administrator guides for DKIM2, Postfix, and Exim (628dea2)

Build And CI

• Build: Remove the unused runtimesecret Go experiment (e0662fe)

Full Changelog: v0.3.0...v0.3.1

DKIM2 v0.3.0

Commit Summary

Added

• Add: Describe the recorded DKIM2 chain without verification (306bddf)

Changed

• Change: Review the root library API against the Draft-09 surface (4255d86)
• Change: Advance the DKIM2 baseline to Draft-09 (542c3c0)
• Change: Review the root library API after adding the recorded chain description (ea80f6f)

Full Changelog: v0.2.0...v0.3.0

DKIM2 v0.2.0

Commit Summary

Added

• Add: Self-identifying replay values for retry-safe network stores (388d3be)

Changed

• Change: Replace the Valkey replay provider with a Redis/Valkey store (5088267)

Documentation

• Docs: Document the Redis/Valkey replay store and its migration (1797131)

Build And CI

• Ci: Run the Redis replay harness against pinned Valkey with TLS (a857bfd)

Full Changelog: v0.1.49...v0.2.0

DKIM2 v0.1.49

Commit Summary

Added

• Add: Store and sign with ML-DSA-44 credentials in dkim2d (3725fcc)
• Add: Verify and sign pure ML-DSA-44 in the library (cd9e09f)

Changed

• Change: Review the root library API after removing the ignored status (bb34697)
• Change: Review the root library API against the Draft-08 surface (6655c4e)
• Change: Prepend library trace fields at the top of the header block (e45506f)
• Change: Place this hop's trace fields at the top of the header block (a73b262)
• Change: Bind DSN signing identity to Draft-08 Section 16.2 recipients (e5c0d5a)
• Change: Require 2048-bit RSA keys for signing (bac34cc)
• Change: Name the selector of every non-passing signature set (f6dc489)
• Change: Map verification states and reasons to Draft-08 Fully Verified (760e7b0)
• Change: Evaluate Draft-08 AND/OR signature and hash groups (b1c2dbd)
• Change: Parse Draft-08 hash and signature groups (d4fc7a4)
• Change: Sign Auto-Submitted and VBR-Info per Draft-08 Section 4 (98a31c4)
• Change: Advance the baseline identifiers to Draft-08 and DNS-02 (f02b9e7)

Fixed

• Fix: Resolve one module cache and gate private proxy reconstruction (5aa5f33)
• Fix: Install scanner views by verified descriptor copy without reflinks (e3aceb0)
• Fix: Require a real source for an aggregate unsupported_algorithm reason (7e418b9)
• Fix: Pick decisive sets by group and report unknown algorithms as permerror (38edd52)
• Fix: Evaluate historical hash tuples through the single Section 14.7 owner (54775d2)
• Fix: Complete the live datasource integration allowlists and report binding (64ab12f)
• Fix: Restrict verifier projection algorithms to the Draft-08 vocabulary (19aad3c)
• Fix: Derive the datasource hard limits from three credentials per profile (9784c78)
• Fix: Recompute the Rspamd Policy E2E projection bindings for Draft-08 (b9a54dc)
• Fix: Count the ML-DSA-44 conformance cases in the portable evidence freeze (952ff93)
• Fix: Address the Postfix not_local notification under the foreign domain (2684d51)
• Fix: Derive datasource handle bounds from three credentials per profile (a3938ae)
• Fix: Restore the Postfix qualification run on the Go 1.27.3 image (209591d)
• Fix: Bind the header-boundary conformance case to its renamed test (361ce4b)

Tests

• Test: Freeze the Postfix helper guardrail through Makefile prerequisites (3627e9c)
• Test: Cover all-known values in the hash precondition table (e449bcb)
• Test: Extend the dkim2ctl oracle socket deadlines for oversized bodies (66e5e32)

Documentation

• Docs: Attribute the ignored-status rejection to the adapter validation (5e03d6a)
• Docs: Correct the algorithm vocabulary and test command references (2ac9c7b)
• Docs: Complete the Draft-08 migration documentation (18a3f7b)

Build And CI

• Build: Run gate tests without the go test result cache (7ffc31a)
• Build: Gate tools-module tests and Rspamd projection bindings in guardrails (3df0b86)

Full Changelog: v0.1.48...v0.1.49

DKIM2 v0.1.47

Commit Summary

Removed

• Remove: Drop the mldsa44-ed25519-sha512 composite algorithm (5f73495)

Documentation

• Docs: Record the removal of the composite algorithm (76cd6f8)

Full Changelog: v0.1.46...v0.1.47

DKIM2 v0.1.46

Commit Summary

Fixed

• Fix: Restore header fold points in the Milter and Exim adapters (26d3885)

Tests

• Test: Refresh the conformance manifest for the Milter peer test (694ceb0)

Full Changelog: v0.1.45...v0.1.46

DKIM2 v0.1.44

Commit Summary

Added

• Add: Sign Postfix bounces under a reporting MTA domain (9d1dede)

Fixed

• Fix: Restore SQL candidate sealing and locked current reads (5225516)
• Fix: Scan and bind nullable SQL source generations (049de50)
• Fix: Leave MySQL source-binding routine grants to the site template (363e636)

Refactored

• Refactor: Move the provider purge contract into datasourceadmin (364b54a)

Tests

• Test: Refresh the conformance manifest for the replay deriver test (6c970e3)

Documentation

• Docs: Upgrade replay drafts in place instead of draining (aeb1331)

Full Changelog: v0.1.43...v0.1.44

DKIM2 v0.1.42

Commit Summary

Added

• Add: Count direct deliveries as opt-in local replay policy (e9a8743)
• Add: Sign with mldsa44-ed25519-sha512 in dkim2d (dd6edac)
• Add: Sign with mldsa44-ed25519-sha512 in the library (e0b4097)

Changed

• Change: Use the LAMPS composite construction for mldsa44-ed25519-sha512 (e18cf4e)

Build And CI

• Build: Move the toolchain to Go 1.27.3 (3fc96a6)

Full Changelog: v0.1.41...v0.1.42