b4: DKIM 'x' causes BADSIGs on otherwise valid emails

Arsen Arsenović <[email protected]> Sat, 25 Jul 2026 15:46:44 +0200

Newsgroups	org.kernel.linux.tools
Organization	BayLibre
Message-ID	<[email protected]>

Hi all!

DKIM signatures expire, due to the 'x' key; see
https://datatracker.ietf.org/doc/html/rfc6376#page-24

dkimpy implements this check:

    if b'x' in sig:
        if re.match(br"\d+$", sig[b'x']) is None:
            raise ValidationError(
              "x= value is not a decimal integer (%s)" % sig[b'x'])
        x_sign = int(sig[b'x'])
        now = int(time.time())
        slop = 36000 # 10H leeway for mailers with inaccurate clocks
        if x_sign < now - slop:
            raise ValidationError(
                "x= value is past (%s)" % sig[b'x'])
        if t_sign and x_sign < t_sign:
            raise ValidationError(
                "x= value is less than t= value (x=%s t=%s)" %
                (sig[b'x'], sig[b't']))

... thus, it seems to be impossible for 'b4 am' to verify signatures of
patches sent more than ten hours ago.

Of course, this makes sense for a compliant DKIM implementation, but b4
frequently verifies emails long after their delivery, so it can cause
trouble there.

Hacking this check out of dkimpy works.

Reproducer:

  b4 am --allow-unicode-control-chars https://inbox.sourceware.org/gcc-patches/[email protected]/

b4 and dkimpy version:

  ~$ qlist -Iv b4 dkim
  dev-python/dkimpy-1.1.8
  net-mail/b4-0.15.2-r1

Have a lovely day!
-- 
Arsen Arsenović

signature.asc (application/pgp-signature, 300 B)