Re: b4: DKIM 'x' causes BADSIGs on otherwise valid emails

On Sat, Jul 25, 2026 at 03:46:44PM +0200, Arsen Arsenović wrote:
> Hi all!
> 
> DKIM signatures expire, due to the 'x' key; see
> https://datatracker.ietf.org/doc/html/rfc6376#page-24
> 
> dkimpy implements this check:
> 
>     if b'x' in sig:
>         if re.match(br"\d+$", sig[b'x']) is None:
>             raise ValidationError(
>               "x= value is not a decimal integer (%s)" % sig[b'x'])
>         x_sign = int(sig[b'x'])
>         now = int(time.time())
>         slop = 36000 # 10H leeway for mailers with inaccurate clocks
>         if x_sign < now - slop:
>             raise ValidationError(
>                 "x= value is past (%s)" % sig[b'x'])
>         if t_sign and x_sign < t_sign:
>             raise ValidationError(
>                 "x= value is less than t= value (x=%s t=%s)" %
>                 (sig[b'x'], sig[b't']))
> 
> ... thus, it seems to be impossible for 'b4 am' to verify signatures of
> patches sent more than ten hours ago.

Correct, hence my 3-year-old bug:
https://bugs.launchpad.net/dkimpy/+bug/2047054

I even suggest the simplest way to fix it, but dkimpy appears to be abandoned.
I've not yet decided what would be a better course of action here.

-K