b4: DKIM 'x' causes BADSIGs on otherwise valid emails

Hi all!

DKIM signatures expire, due to the 'x' key; see
https://datatracker.ietf.org/doc/html/rfc6376#page-24

dkimpy implements this check:

    if b'x' in sig:
        if re.match(br"\d+$", sig[b'x']) is None:
            raise ValidationError(
              "x= value is not a decimal integer (%s)" % sig[b'x'])
        x_sign = int(sig[b'x'])
        now = int(time.time())
        slop = 36000 # 10H leeway for mailers with inaccurate clocks
        if x_sign < now - slop:
            raise ValidationError(
                "x= value is past (%s)" % sig[b'x'])
        if t_sign and x_sign < t_sign:
            raise ValidationError(
                "x= value is less than t= value (x=%s t=%s)" %
                (sig[b'x'], sig[b't']))

... thus, it seems to be impossible for 'b4 am' to verify signatures of patches sent more than ten hours ago.

Of course, this makes sense for a compliant DKIM implementation, but b4 frequently verifies emails long after their delivery, so it can cause trouble there.

Hacking this check out of dkimpy works.

Reproducer:

  b4 am --allow-unicode-control-chars https://inbox.sourceware.org/gcc-patches/[email protected]/

b4 and dkimpy version:

~$ qlist -Iv b4 dkim
dev-python/dkimpy-1.1.8
net-mail/b4-0.15.2-r1

Have a lovely day!

Arsen Arsenović

Correct, hence my 3-year-old bug:
https://bugs.launchpad.net/dkimpy/+bug/2047054

I even suggest the simplest way to fix it, but dkimpy appears to be abandoned. I've not yet decided what would be a better course of action here.

-K