mainSavannah Administration - Support: sr #109593, nongnu.org mailing list is...

 
 

sr #109593: nongnu.org mailing list is modifying BODY rendering DKIM (and S/MIME) signature invalid

Submitter:  Ivan Warren <ivanw>
Submitted:  Thu 29 Nov 2018 10:14:50 AM UTC
   
 
Category:  Project mailing lists Priority:  5 - Normal
Severity:  3 - Normal Status:  Invalid
Privacy:  Public Assigned to:  None
Operating System:  Microsoft Windows Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 29 Nov 2018 07:24:18 PM UTC, comment #2: 

Bob,

Thanks for the heads up ! It's just a shame there isn't coordination between source repositories, bug tracking and mailing lists...

I've sent the request to -email is unavailable-

Thanks again,

--Ivan

Ivan Warren <ivanw>
Thu 29 Nov 2018 06:56:29 PM UTC, comment #1: 

Hello Ivan,

I don't disagree with anything you have said.  But you have reached the Savannah administration project.  We are the volunteers who administer Savannah.  Savannah is the software forge for the GNU Project holding the version control for the software, the download area for projects, and the web UI for managing project team members.

But you are submitting a bug about the mailing lists at lists.gnu.org which is administered by the FSF admins.  The Savannah Hackers (as we are known) don't have control of that system.  There isn't much we can do about the core Mailman behavior there.

Therefore the only thing we can do here is commiserate with you about it.  Yep.  It sucks.  Terrible thing that. :-(

All I can really do is redirect you to send your report to either the mailman AT gnu.org list where Ian will see it.  Or send a message to sysadmin AT gnu.org where it will generate an RT ticket in the FSF admins ticket system.  I am not sure which is better.  Probably starting with mailman AT gnu.org is better since then a discussion can be started.

Good luck!

Bob Proulx <rwp>
Site Administrator
Thu 29 Nov 2018 10:14:50 AM UTC, original submission:  

The mailmain software running on nongnu.org is altering the contents of the body while yet indicating the from: field is the sender.
Because of this, any DKIM check makes the message invalid.
If the sending domain uses DMARC, the mail may get rejected because of that.
This means that since my domain is DMARC protected (and all my messages DKIM signed) - they will be rejected (and not received) by a receiving MTA that checks my domain's DMARC status (and makes a DKIM verification).

Furthermore, any S/MIME signature gets invalidated. (PGP/GPG won't be affected because the modifications occur outside the signed message block)

SMTP has provision for headers specific to mailing lists and should be used instead of altering the message body.


Ivan Warren <ivanw>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by ivanw (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-11-29 rwp StatusNone Invalid
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code