Skip to content

v0.2.2

Choose a tag to compare

View all tags
@christhomas christhomas released this 25 Jul 15:16
· 3 commits to main since this release
v0.2.2
b7370fe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Restores ARC-Message-Signature verification — which regressed once go-dkim began enforcing the RFC 6376 v= version rule, since a versionless ARC-Message-Signature (RFC 8617 §4.1.2) carries no v= — together with a set of RFC 8617 verify/seal correctness fixes. The public API (Seal, Verify, SealOptions, SealResult) is unchanged.

Changed

  • Bumped go-dkim to v0.2.1 and switched ARC-Message-Signature verification onto its new policy-free primitive (dkim.VerifySignatureBare): ARC now verifies the DKIM crypto mechanism and applies RFC 8617 policy itself, rather than inheriting RFC 6376 DKIM policy. This fixes ARC verification, which DKIM's v= requirement had broken for the versionless ARC-Message-Signature (RFC 8617 §4.1.2).

Fixed

  • Verify now enforces the RFC 8617 §5.1.1 maximum of 50 ARC sets before any structural or cryptographic check (#9, #24).
  • Seal now scopes a cv=fail ARC-Seal to the current set only, never signing the prior (failed) chain, per RFC 8617 §5.1.2 (#25).
  • Verify and Seal now reject an ARC-Seal that carries a forbidden h= tag, per RFC 8617 §4.1.3 (#26).
  • The ARC-Seal now requires its s= (selector) and d= (domain) tags, with no fallback to a substituted default selector (#27).
  • Seal now derives the new set's instance number from the highest instance present rather than the count of prior sets, so a gapped chain no longer collides at an existing instance (#28).
  • Verify and Seal now validate ARC instance numbers strictly, reject a repeated DKIM tag in an ARC-Message-Signature or ARC-Seal, and sanitize Seal output against header injection (#29).
  • Seal now rejects an incomplete prior ARC set instead of panicking (#23).
Assets 2
Loading